Forensics

Two images XOR together to reveal the hidden content. No flag recorded.

A pile of Windows .evtx logs and a four-part question set, answered by hunting the events with Chainsaw and the Sigma ruleset.

A PCAP of an unencrypted session to a Metasploitable box. Following the TCP stream replayed the attacker shell, flag and all.

An image-upload challenge that echoed parsed metadata back. Controlling fields like width and height let us write into the metadata block and reach the flag. Long grind with Kiwi.

A GIF of a scribbled-over QR code, recovered by stacking every frame so the gaps filled each other in.