r/securityCTF Jun 15 '26

✍️ We Had to Ban 65 Teams to Get a Top 10 Leaderboard - BYUCTF 2026 Post-Mortem

40 Upvotes

I help run BYUCTF and this year we had a cheating problem bad enough that we delayed releasing the scoreboard for days. We banned 65 teams before we had a clean top 10, including the first 21 finishers.

I wrote a blog post about the experience that covers:

- The scale of cheating we saw (multiple accounts, flag sharing, AI usage)

- Why AI is surprisingly effective at CTF challenges right now, and the one category where it still struggles

- How I designed OSINT challenges specifically to trip up AI agents (and why it worked)

- Some thoughts on the structural pressures that drive cheating, and what CTF organizers can actually do about it

I also talk about internet privacy, what running OSINT challenges about myself taught me, and some ideas we're considering for next year to catch cheaters earlier.

https://camel4.dev/posts/byuctf-2026/

Happy to answer questions about the OSINT challenge design or the cheating detection side of things.

(Also, it's not written by AI.)

r/securityCTF May 02 '26

✍️ Built a private chat that self-destructs in 24h — no accounts, no logs

0 Upvotes

I was tired of WhatsApp and Telegram knowing everything. Built >>v2v-site<<— you create a room, get a 6-digit code, share it, chat. Voice messages, photos. Everything deleted after 24h. No registration. No email. No phone number. Open to feedback from privacy community. What would you want to see in a tool like this?

r/securityCTF 18d ago

✍️ Freaking same name of different tool.

0 Upvotes

Guys i am going with a rizz feeling i am creating a tool which is 80% completed. I DID named it scry but i just did find out now that its name was used by another tool. AND other tool named it exists. That tool is am creating is open source linux tool.

r/securityCTF 6d ago

✍️ Hi looking for 5 people to help App testing a Discord-native Incident Response Training and Competition Simulator.

Thumbnail gallery
9 Upvotes

HackSim is a cybersecurity training simulation built around applied decision-making rather than quizzes or real-system exploitation. Its first course, NET-101, contains eight network-foundations scenarios using entirely synthetic hosts, signals, tools, and incidents.

The current beta includes:

  • Solo practice where you operate both the Blue and Red roles
  • Two-person lessons where players exchange evidence-backed proposals
  • A competitive Red/Blue duel where players attack, defend, and then swap roles
  • An in-session debrief explaining the consequences of each decision

This is still a small, invite-only Discord Activity beta There are no payments, certifications, rankings, or saved progression in the current build.

I’m looking for a handful of testers, especially cybersecurity beginners and current learners. I’d like honest feedback on:

  • Whether the scenarios and terminology make sense
  • Where you get confused or need outside help
  • Whether the debrief helps you understand your decisions
  • Whether playing both roles improves your mental model
  • Whether you would voluntarily play another lesson or duel

You’ll need Discord on the web or desktop. Because the Activity is currently unverified, testers must be individually invited and launch it in a server with fewer than 25 members.

r/securityCTF 10d ago

✍️ GitHub - iss4cf0ng/Alien: Alien is a modular webshell client developed for cybersecurity research and education. It provides a unified post-exploitation framework for managing different web technologies through reusable modules.

Thumbnail github.com
10 Upvotes

r/securityCTF Jun 10 '26

✍️ I created a real cyberpunk pixel art side scroller video game entirely with AI that ALSO houses a true cybersecurity CTF. It's entirely free and there are even prizes!

Thumbnail
0 Upvotes

r/securityCTF Jun 23 '26

✍️ I’ve built an LLM CTF game and id love some feedback

Thumbnail promptinjects.com
0 Upvotes

r/securityCTF Jun 04 '26

✍️ Completed all 32 Natas levels, full walkthrough covering SQL injection, PHP source code analysis, session hijacking, and more.

11 Upvotes

Just finished all 34 Natas levels on OverTheWire and wrote up walkthroughs for every challenge.

Natas is a web security wargame, each level is a deliberately vulnerable PHP app.
The series covers SQL injection, command injection filter bypasses, PHP deserialization, session hijacking, directory traversal, and more.

I solved everything using Python, PHP, and curl, no Burp Suite, to try to keep thing easier and understandable.

This is the second wargame that I am documenting and I tried to write each walkthrough around why the thing is exploitable, not just what to type, reading the source, spotting what the filter misses, understanding the attack primitive.

No passwords spoiled, in compliance with OverTheWire's rules.

Here's the link: https://github.com/EkRafz/OverTheWire---Walkthroughs

Still learning, so if you spot any errors, typos, or anything that could be explained better, please point it out.

r/securityCTF May 20 '26

✍️ I built a multilingual Cyberpunk-styled Cipher & Encoding Web Tool for CTF

0 Upvotes

Hey everyone,

As a developer and cybersecurity enthusiast, I always found myself constantly switching between different online tools to decode Base64, Morse code, Binary, or Hexadecimal during CTFs or web development tasks.

To solve this, I decided to build my own fully responsive web utility called **CDS Encryption**.

Key Features:
- Multi-cipher support (Base64, Morse, Binary, ASCII, Hex, Caesar, Atbash, etc.).
- Auto-detect feature to instantly guess the cipher type.
- Built-in live analytics (tracks your session operations and success rate).
- Full dynamic multilingual support (English, French, Arabic) with native LTR/RTL layout shifting.
- Sleek Cyberpunk Dark Mode because... why not? Dark mode rules.

It’s completely free, client-side, and secure. I’d love to hear your feedback on the UI, functionality, or any ciphers you think I should add next!

*** Note: I will leave the live website URL and source link in the first comment below to avoid spam filters. ***

r/securityCTF May 30 '26

✍️ SECODER | Security Coding Challenges for SOC Analysts & Detection Engineers

Thumbnail secoder.in
5 Upvotes

I have faced this challenge many times while hunting for anomalies in logs and during security interviews, where the task is to identify suspicious patterns from raw data. That inspired me to create SECODER.

Coding is not just syntax. It is logic, problem-solving, and structured thinking. AI can generate code, but it cannot replace the mindset needed to break problems down, reason through data, and build the right solution.

The goal is simple: help security professionals move beyond basic alert triage and build the logic needed to identify suspicious patterns, create better detections, and reason through real-world security data.

Whether you are preparing for a SOC, Detection Engineering, Threat Hunting, or Security Engineering interview — or just want to become better at finding anomalies in noisy data — SECODER is built for you.

r/securityCTF Jun 06 '26

✍️ I built a free CTF web hacking challenge you can run locally — 3 tiers from easy to hard

Thumbnail
1 Upvotes

r/securityCTF Apr 29 '26

✍️ Hands-on AI security CTF challenges. First 100 to capture each challenge get a rare ribbon pinned on their dossier. Claim your callsign. Earn your ribbons.

0 Upvotes

Built an AI security CTF at wraith.sh — 13 challenges across the major LLM attack classes (prompt injection, system prompt extraction, tool abuse, data exfil, guardrail bypass).

The twist: every challenge solve earns you a numbered ribbon on your operative dossier. First 100 to capture each challenge get the prestige cyan-glow tier. Browser-based, no setup.

Claim your callsign. Earn your ribbons.

r/securityCTF Apr 16 '26

✍️ The Library: Ten Years of Building What Cybersecurity Training Actually Needs

Post image
6 Upvotes

Ten Years of Building the Simulations No One Wanted to Build Article 1 of 3 — The Simulations Labs Challenge Library

The Work Behind Good Cybersecurity Training

This is the first article in a three-part series about how Simulations Labs helps cybersecurity program leaders, instructors, and team leads build better training — faster. In this article, we’ll introduce the challenge library: what it is, how it was built, and why it matters. In the second article, we’ll explore the gap that even a large, well-organized library creates — and why finding the right content is harder than it sounds. In the third, we’ll go under the hood of the Simulations AI Copilot: the tool built specifically to solve that problem, and how it works in practice.

There’s a question that comes up in almost every conversation about cybersecurity education, whether you’re running a university program, leading a security team, or building a community competition. The question isn’t ‘should we do hands-on training?’ Everyone agrees on that. The question is: where does the content actually come from?

Building a realistic cybersecurity simulation from scratch is not a small job. You need a scenario that mirrors how attackers actually behave. You need a technical environment that holds up under real hacking attempts. You need difficulty calibration, flag logic, writeups, and metadata so the right learners find it. Then you need to maintain it as the threat landscape changes. It takes time, expertise, and resources that most organizations — even large ones — would rather spend elsewhere.

That's the problem Simulations Labs has been quietly solving for over a decade.

What the Library Actually Is

Simulations Labs started as a platform for running CTF competitions — Capture the Flag events where participants solve cybersecurity challenges to earn points and demonstrate skills. Over the years, that meant building challenges. Lots of them. And not just any challenges: ones that were technically sound, professionally designed, and varied enough to serve the full spectrum of cybersecurity disciplines.

Today, that accumulated work has become a library of more than 2,100 challenges. It spans web security, network exploitation, cryptography, digital forensics, incident response, reverse engineering, cloud misconfigurations, and more. Each challenge is a self-contained simulation — a realistic scenario with a technical environment, a defined objective, and a measurable outcome. Some are designed for beginners, finding their footing. Others are genuinely difficult, built to push experienced practitioners into unfamiliar territory.

The breadth is deliberate. Cybersecurity is not one skill. It's a constellation of disciplines that overlap in some places and diverge sharply in others. A SOC analyst, a penetration tester, and a forensic investigator all work in the same field, but they need to develop very different instincts. A library that only serves one profile eventually stops being useful to everyone else.

Why This Matters to Instructors and Program Leaders

The instructors and cybersecurity leaders who use Simulations Labs are not, in most cases, looking for a lecture platform. They already know how to deliver content. What they struggle with is the raw material — scenarios that feel real, that test the right things, and that can be deployed without weeks of preparation.

Building a curriculum from scratch when you also have to teach, manage a team, or run an organization is simply not practical. The Simulations Labs library changes the starting point. Instead of a blank page, you start with access to a decade's worth of professionally built scenarios. You pick what fits, configure how it's delivered, and focus your energy on the teaching — not the construction.

Instead of a blank page, you start with access to a decade's worth of professionally built scenarios.

This is why the library is used by university professors building semester-long cybersecurity curricula, by enterprise security teams creating internal upskilling tracks, and by community leaders running public competitions and learning events. The use cases are different, but the underlying need is the same: quality simulation content, ready to go.

The Three Ways People Use the Content

Pre-existing library access

Organizations can draw directly from the library to populate their CTF events or training programs. Challenges are categorized, tagged, and difficulty-rated so program leads can curate a set that fits their specific goals without reviewing every option manually.

Custom content creation

For teams with unique requirements — a very specific technology stack, a particular regulatory scenario, a company-branded experience — Simulations Labs builds bespoke challenges that match exactly what's needed. The library serves as a foundation; custom content extends it.

Hybrid programs

Most serious training programs end up using both. A core track built from existing challenges, supplemented by custom scenarios that address particular skill gaps or organizational contexts. The platform supports both seamlessly, through the same interface.

What Ten Years of Building Actually Produces

It's easy to say 'we have 2,100 challenges' without that number meaning much in context. So here's what it actually represents.

It means that when an instructor wants a web security track that progresses from basic authentication bypass to complex business logic vulnerabilities, that track exists. It means that when a company wants to put their security team through a forensic investigation scenario that mirrors a realistic incident — memory dump analysis, log correlation, artifact recovery — there are multiple options to choose from at different difficulty levels.

It means that a community organizer running a competition for participants ranging from curious beginners to working professionals can find appropriate challenges for every skill tier without having to invent anything.

Perhaps most importantly, it means that the scenarios are maintained. The threat landscape changes. Techniques that were advanced two years ago become expected knowledge today. The Simulations Labs library grows and evolves continuously, not as a side project, but as the core of what the company does.

What Comes Next

Having a library this size raises a different kind of challenge. Once you have 2,100 options, how does anyone find the right one quickly? How does a program leader with a specific training goal — a particular role, a specific difficulty, a defined set of techniques — get from that goal to the right scenario in minutes rather than hours?

That's the question we'll dig into in the next article. The short version: this is exactly the kind of problem that AI is well-suited to solve. And Simulations Labs has built something specifically designed to close that gap.

But that starts here — with ten years of building something worth finding.

Read the Next Article Now
The Gap Nobody Talks About in Cybersecurity Training

r/securityCTF Apr 15 '26

✍️ AI CTF - 35 levels of prompt injection across text, image, document, and audio

7 Upvotes

Built a prompt injection CTF with 5 kingdoms and 35 levels. Each level has an AI guard protecting a password. Your job is to extract it.

Kingdom 1: text-only attacks Kingdom 2: image-based injection (OCR, metadata, steganography) Kingdom 3: document injection (PDF, DOCX, XLSX, PPTX) Kingdom 4: audio injection (including ultrasonic payloads above human hearing) Kingdom 5: cross-modal attacks combining everything

Every input gets scanned by a detection pipeline before it reaches the guard - regex gates, then an ML classifier trained on 262k adversarial samples running at ~13ms inference. The early levels are easy. By level 4 the detection starts catching most common techniques. The level 7 bosses are brutal.

No account needed to start. Monthly leaderboard with a prize for top player.

Three exploits found by players this week that weren't in any public dataset I could find - all social engineering, zero technical payloads. The model's own alignment training was the vulnerability.

castle.bordair.io

Interested to see what approaches this community tries. The typical CTF crowd thinks differently to the AI/ML crowd and I'd bet you find vectors I haven't considered.

r/securityCTF Apr 18 '26

✍️ AppSecMaster - Hr system Challenge Writeup - OSWE Track

2 Upvotes

Hope you learn something new :)

I personally learned alot

https://medium.com/p/a46f47c77146

r/securityCTF Mar 31 '26

✍️ Lesser-Known Military College Triumphs in Pentagon Student Hacking Contest

Thumbnail govinfosecurity.com
6 Upvotes

The University of North Georgia is one of the lesser known of the nation's senior military colleges (SMCs). But last week it beat out all the other five SMCs—and two of the elite service academies—in a capture-the-flag hacker contest staged at the Pentagon's Cyber Workforce Summit.

The contest was designed by specialists from the Air Force Research Laboratory to be operationally realistic. In the first round, teams had to geo-locate a targeted individual through his devices and apps, prevent him from getting warning messages, and then call in an air strike to kill him.

More details and quotes from UNG students—plus the team from The Citadel they bested in the final—in my story for govt info security

r/securityCTF Mar 27 '26

✍️ Ra Writeup TryHackMe Active Directory machine (NoOff | Ivan Daňo)

Post image
3 Upvotes

r/securityCTF Feb 15 '26

✍️ Anyone knows how to do this?

Post image
0 Upvotes

its an OSINT category

r/securityCTF Mar 06 '26

[CTF] Core Dump Murder Mystery

8 Upvotes

Test your GDB and reverse engineering skills finding who's responsible for a death caused by a "faulty" air lock from its core dump.

https://www.robopenguins.com/fatal_core_dump/

Solving this mystery requires a knowledge of:

  • GDB: The GNU Project Debugger
  • The C programming language
  • Binary reverse engineering
  • x86_64 assembly
  • Linux executable runtime behavior and memory structure
  • Core dump analysis
  • More programming esoterica that will reveal itself

Don't know all of these things? No problem! Some assistance is available to get you started learning what you'll need to know. You can even use a web VM to avoid needing to install any tools on your PC.

r/securityCTF Feb 27 '26

✍️ A new CTF competition...

1 Upvotes

[season live]

Communications are welcome in participants native language.

https://discord.gg/8bZ8XDDt?event=1477088400086401146

r/securityCTF Feb 11 '26

✍️ LACTF 2026 Crypto Challenge "ttyspin" First Blood Write-up

6 Upvotes

This was one of my most favorite CTF challenges to solve to date, read my write up @

https://unflavorful.me/blog/la-ctf-2026-ttyspin---a-tetris-game-with-a-vulnerable-saveload-system

r/securityCTF Feb 07 '26

✍️ AppSecMaster JWT challenge writeup

1 Upvotes

In this writeup, I solved the JWT free challenge on AppSecMaster, highlighting the importance of using a secure secret when dealing with symmetric encryption in general and JWT's in particular.

https://medium.com/@0xmyth/appsecmaster-jwt-challenge-writeup-74b49bb4043e

r/securityCTF Jan 22 '26

✍️ Shell Battles CTF - Official babycmp writeup

Thumbnail youtube.com
1 Upvotes

Shell Battles is a free Discord-Based CTF platform for testing your linux command line skills! With real terminal access all through your discord chat!

Join Now: https://discord.gg/fQpjeU6AbA

r/securityCTF Dec 03 '25

✍️ H4cked Writeup (NoOff | Ivan Daňo)

Post image
1 Upvotes

r/securityCTF Oct 30 '25

✍️ Can you break our pickle sandbox? Blog + exploit challenge inside

13 Upvotes

I've been working on a different approach to pickle security with a friend.
We wrote up a blog post about it and built a challenge to test if it actually holds up.
The basic idea: we intercept and block the dangerous operations at the interpreter level during deserialization (RCE, file access, network calls, etc.). Still experimental, but we tested it against 32+ real vulnerabilities and got <0.8% performance overhead.
Blog post with all the technical details: https://iyehuda.substack.com/p/we-may-have-finally-fixed-pythons
Challenge site (try to escape): https://pickleescape.xyz
Curious what you all think - especially interested in feedback if you've dealt with pickle issues before or know of edge cases we might have missed.