I solved this challenge! Here's my GitHub repository if you'd like to check out my writeup and exploit script:

https://github.com/amirazarmehr/Remote-heap-buffer-overflow-1.git

نشرت الحلقة الخامسة من سلسلة رحلتي في PortSwigger، واللي أشارك فيها رحلتي في تعلم Web Security من خلال التطبيق العملي.
في هذه الحلقة أشرح:
تحديد عدد الأعمدة باستخدام UNION SELECT.
اكتشاف الجداول عبر information_schema.tables.
معرفة الأعمدة باستخدام information_schema.columns.
استخراج البيانات داخل مختبر تدريبي مصرح به.
تحليل تقرير SQL Injection حقيقي من HackerOne وفهم الـ PoC.
أحاول أركز على فهم سبب كل خطوة، بدلًا من مجرد نسخ الحلول.
🎥 https://youtu.be/VGJo6XnE31I

I lost at this hackathon yesterday but i still wanna solve it

The readme outlines 4 questions- I'm talking only about the first one! The decryption one

https://github.com/neelanjanmanna2021/vit-dortress-cybersecuritymonth-hackathon-2026/blob/main/README.md

Recentemente não estou conseguindo acessar os sites das máquinas do Hack the Box.

Por exemplo faço a leitura do ip do alvo, tem o protocolo HTTP mas quando jogo no navegador o site não aparece.

Coisas que já me atentei e não resolveram...

Sim conectei na VPN com sudo (antes e depois de conseguir o ip da maquina, nenhum dos dois cenários funcionou)

Sim coloquei pra receber TCP quando criei o pacote para VPN

Sim tentei pingar com o IP e estava comunicando

Sim desativei os firewalls para conexão HTTP

Sim nenhuma máquina abre

e atualizei o Kali e refiz tudo isso.

Não sei se com vocês está acontecendo o mesmo, mas prpcurei até no site deles e não fala nada sobre, já fiz outras máquinas e funcionaram normal.

Many of us enjoy the crypto and OSINT parts of CTFs. Outside of a live event, though, there aren't many puzzle hunts where the prize is real and you can check for yourself that the organizer played fair.

ProofOfSolve is trying to fill that gap. Each puzzle hides the seed words to a funded Bitcoin wallet, and the fastest correct solver wins the bitcoin in it. The puzzles chain layers together, use ciphers invented for each puzzle, and include real-world clues found on Google Street View. Every clue can be solved from Street View, including older imagery via "See more dates", so nobody needs to visit a location.

I think the verification side is what this sub will care about most:

• The prize wallet address is published at launch, so you can check it on a public explorer such as mempool.space.
• A SHA-256 fingerprint of the answer is published before anyone plays. The answer is revealed after the win, so anyone can confirm it never changed.
• Entries are timestamped to the millisecond, and the first correct entry wins.
• Past puzzles are listed with prize address, answer fingerprint, solve time and payout, each linked so anyone can check it.

Some practical details. Answer words come from the BIP39 English word list (2,048 everyday words). You can use any tool you like, AI chatbots included. You get a limited number of guesses per day. The winner restores the wallet in Electrum using a passphrase sent by ProofOfSolve, then moves the prize to their own wallet. You don't need any crypto knowledge to play.

Smaller puzzles are free to play and have smaller BTC prizes. Bigger puzzles are paid. Prize amounts are announced at launch. Players must be 18 or over, and paid puzzles are not open in some US states.

Nothing is live yet. The first puzzles open Saturday, October 24, 2026 at 6:00 AM Central, and each one unlocks for everyone at the same minute. New puzzles open every Saturday after that. Joining the email list is free, needs no purchase, and tells you the moment puzzles open. The site also has a free seed word lookup that runs in your browser and checks words against BIP39 in 10 languages, SLIP39, old Electrum and Monero.

https://proofofsolve.com

This sub has a no-spoilers rule, so once puzzles are live, please take talk about specific puzzles to r/proofofsolve and keep it out of here.

A question for people who run or play CTFs: is a pre-published hash commitment plus a public prize address enough for you to trust a contest like this? Or is there something else you'd want to see before putting time into it?

Disclosure: I'm posting this on behalf of the Proof of Solve team.

New "Beginner" vulnerable VM aka "Ledger" is now available at hackmyvm.eu :) Have fun!

Hey everyone,

While grinding boxes for cert prep, my workflow was always a mess: a Google Sheet for pwned machines, a random .txt file for creds, Obsidian for writeups, and constantly re-typing LHOST and TARGET_IP into commands.

I built ZeroBox to put everything into a single, keyboard-driven dashboard that runs 100% offline in your browser (or as a Tauri desktop app).

No account, no backend, no tracking. Everything stays in your browser's LocalStorage/IndexedDB with 1-click JSON backup.

What’s inside:

• 1,005 HTB & THM Machines: Track boxes across a Kanban board (Backlog -> Recon -> Foothold -> Pwned), table view, or pivot attack graph.
• Curated Cert Pathways: Built-in lists for OSCP, CPTS, and CRTO prep.
• Dynamic Cheatsheet & 130+ Revshells: Set LHOST, LPORT, and TARGET_IP once and every command updates automatically for 1-click copy.
• Loot Vault: Save flags, creds, and keys per machine with auto hash identification (20+ formats).
• 24h Exam Simulator: Practice under OSCP/CPTS/CRTO timers, scoring, and Markdown report export.

Live App (Free, no login): https://ctftracker.com
GitHub Repo: https://github.com/0xdnd/ctf-tracker

I'd love to hear your feedback, especially if there are specific machines, pathways, or commands you want added next!

Hey everyone!

We're Exun Clan, the student-run tech club at DPS R.K. Puram, New Delhi, and we're back with the 16th edition of Sudocrypt, our flagship international CTF!

Sudocrypt is an international Cryptic Hunt x Capture The Flag (CTF) event where participants from around the world tackle a series of cybersecurity and cryptic challenges. Expect code-breaking, cryptography, and plenty of problem-solving as you work your way through the levels.

The competition is entirely online, so you can participate from anywhere in the world.

Dates: October 27–28, 2026

Prizes: With a prize pool of over $900 USD in previous editions, along with over $500 USD in goodies and prizes, Sudocrypt v16.0 promises an exciting challenge for cryptic enthusiasts and CTF players alike.

Event website: https://sudocrypt.com/

CTFtime listing: https://ctftime.org/event/3443/

You can also check out the other events at Exun 2026 here: https://exun.co/26/events

Hope to see you on the scoreboard!

Hey everyone!

We’re Cyberlearner.org, a free hands-on cybersecurity and AI security training platform, and we’re running our first public competition: First Flag CTF.

First Flag CTF is a one-day, jeopardy-style CTF for individuals. Six challenges across web exploitation, reverse engineering, cryptography, forensics, and binary exploitation, plus one mystery category (likely to be AI related), built for a range from complete newcomers to experienced players.

The competition is  online and open to everyone.

Date: Saturday 7 November 2026
Entry: Free
Prizes: £100 / £50 / £25 in gift cards for the top three, plus a signed Certificate of Participation for everyone who submits at least one correct flag

Registration and event page: https://cyberlearner.org/ctf

You can practice for free too, as we have over 100 free labs in similar categories.

Hope to see you there!

Cybergames is Wordle meets cybersecurity. Six daily puzzles shared by everyone, plus 15 themed tracks (networking, cloud, AI, forensics, and so on) with 50 levels each. Free, no ads, no account needed.

Site: https://cybergames.neeraj.ca/ iOS: https://apps.apple.com/us/app/cybergames-it-puzzles/id6805700596 • Android: https://play.google.com/store/apps/details?id=ca.neeraj.cybergames

Some build notes:

The ten puzzle engines are pure TypeScript in a shared package. The Next.js site and the Expo app consume the same core, so a puzzle plays identically on web and mobile. About 1,300 unit tests across the workspace.

All 7,500 puzzles are pre-generated and deterministic. One generator script per track, byte identical on re-runs, plus a validator that knows the legal score bounds for each game so obvious cheating gets rejected server side.

Answers are sealed in the payload with XOR and base64. Not real crypto, just enough that the answer isn't sitting in plain JSON in devtools.

Hosting is one Railway box with Postgres, about $5 a month. No analytics SDK.

Hello guys! Found this task in a CTF, MISC category, the only description is "AI can't help you"

The author gave us this "CiiQaQ2DWEG1+IhDYWMcbBKs0NDf6C0="

Any ideas on how to solve it?

Just posted a new RE/malware analysis challenge, PEB Walker. The binary manually resolves windows API's, making static analysis harder. Reverse the hashing algorithm and recover the API names to get the flag.

Try the challenge and other like it at ReRange.org

https://docs.google.com/spreadsheets/d/1ZXB6pnQEvym9pkDDoSxl49mxiiMAkzx0tS50OuwRt3Q/edit?usp=sharing

I’m a high school student doing my first few CTFs, and I’m curious how other beginners handle getting stuck. When you hit a challenge you can’t solve, what do you actually do? And has anything ever made you quit a challenge or a whole CTF?

I have working on pwn.college for about roughly a month maybe. I am currently finishing up the Computing 101 challenges. I was stuck on a specific Linux Luminarium challenge called fork bomb.

To those unaware, this challenge requests that you create a fork bomb to create background process and keep duplicating until no more processes can be run and it becomes overloaded. It asks that you run /challenge/check in another terminal and run the bomb afterwards. Back in the first terminal it has been running a specific prompt, but after becoming overloaded, it should display the flag and challenge is completed. But it isn't giving me the flag. I've been stuck on this for roughly a week and progressed past, but I want to be able to complete this so I can move on. I have double checked my work with multiple AI's, as well as their built in help AI, but I can't seem to figure out what is going on. Anyone have any experience with this? I can run through my process as well. Thanks.

A question, Is it expected that as a beginner I will look up commands online when solving?

Hey everyone!

We're Exun Clan, the student-run tech club at DPS R.K. Puram, New Delhi, and we're back with the 16th edition of Sudocrypt, our flagship international CTF!

Sudocrypt is an international Cryptic Hunt x Capture The Flag (CTF) event where participants from around the world tackle a series of cybersecurity and cryptic challenges. Expect code-breaking, cryptography, and plenty of problem-solving as you work your way through the levels.

The competition is entirely online, so you can participate from anywhere in the world.

Dates: October 27–28, 2026

Prizes: With a prize pool of over $900 USD in previous editions, along with over $500 USD in goodies and prizes, Sudocrypt v16.0 promises an exciting challenge for cryptic enthusiasts and CTF players alike.

Event website: https://sudocrypt.com/

CTFtime listing: https://ctftime.org/event/3443/

You can also check out the other events at Exun 2026 here: https://exun.co/26/events

Hope to see you on the scoreboard!