Packet Capture CTF · Act I: The Signal
8 writeups
- OSINTDigital FootprintBans and deletions remove content from the live site, not from the internet.4 steps · 2 min read
- OSINTForgotten RepositoryDeleting a secret in a new commit doesn't remove it from git history.4 steps · 1 min read
- OSINTHidden ProfileDeleted or hidden posts can still exist in web archives.5 steps · 2 min read
- OSINTLast BreadcrumbEach pivot reuses the latest clue on a site already visited (hash > YouTube > Mastodon > paste > PGP keyserver > Mastodon > YouTube).9 steps · 4 min read
- OSINTScattered IdentitiesEvery identity here is linked, not named.6 steps · 3 min read
- OSINT · MediumSilent ObserverEach clue was in an overlooked place (image metadata, an encoded tweet, a what3words address hidden in an anonymous message), while the obvious leads (the face in the photo, the account's food posts) were decoys.6 steps · 3 min read
- OSINTTreasure Hunt TimeWhen the file says "wrong hole", go back to the brief.5 steps · 2 min read
- OSINT · internet historyUnder ConstructionThe description itself is the search query.4 steps · 2 min read
Packet Capture CTF · Act II: The Breach
2 writeups
Packet Capture CTF · Act III: The Echo
6 writeups
- Digital Forensics · Disk / File CarvingDeleted Doesn't Mean GoneDeleting or wiping the file table doesn't erase the data.3 steps · 1 min read
- SteganographyHidden WithinTest each colour channel's LSB on its own as well as interleaved.2 steps · 1 min read
- Network ForensicsLast PacketICMP payloads are a common covert channel.4 steps · 2 min read
- Digital ForensicsMemory EchoesIn a set of identical-looking records, look for the structural outlier, here the one file with an extra named data stream.4 steps · 2 min read
- Digital Forensics · MemoryRegistry SecretsTie the process list to network activity first.3 steps · 1 min read
- Digital ForensicsUSB SecretsKnow what a normal artifact looks like (vendor, product, rev, serial) so the field that breaks the pattern stands out.3 steps · 1 min read