Oh God, I've been stuck on the same challenge for exactly two weeks now 😭

If anyone has solved Remote Heap buffer overflow 1 from the App-System category on Root-Me.org, please DM me 🙏

Gonna be in NYC from Boston for the last two weeks of October, heading back on Nov 1

I already got Wiz's Rogue Agent House CTF on my list but just wanted to check if there's anything else happening while I'm there

Anyone know of other CTFs or hands on security events around that time? Would be nice to squeeze at least one more before heading home

Posted a breakdown of Jinja2 Server-Side Template

Injection for anyone learning web exploitation.

The basic detection payload is simple:

{{7*7}}

If the app renders "49" instead of the literal string,

the template engine is evaluating your input. From there

you can fingerprint Jinja2 specifically and start

climbing the object hierarchy to reach RCE.

What makes SSTI dangerous is that it runs server-side —

you're not just injecting into the page, you're executing

inside the application's Python process.

Great technique to know for CTFs and bug bounty.

Full video breakdown on YouTube. Happy to answer

questions on payloads or escalation paths.

https://youtu.be/2xYPOoveUds

As a beginner, what is the most effective way for learning CTF?

I am unable to find the resources for this CTF

please help 🙏🏻

New "Beginner" vulnerable VM aka "Echo" is now available at hackmyvm.eu :) Have fun!

I was looking for Teams or people willing to help me learn. I'm in college studying cybersecurity and love coding in Python, but every time I join a Discord server and say I'm trying to learn, everyone immediately puts me down. I want to be able to build a portfolio and work with a solid team, either through spectating or active participation. Feel free to DM or comment below.

Hey everyone!

I'm Karim, a final-year Computer Science student. In my free time, I focus on bug bounty hunting and Web2 security research.

I've recently started getting into CTFs the old-school way, without AI, to improve my technical skills, learn new things, and explore different areas of security.

I feel like learning and competing with others would be much more fun and rewarding, so I'm looking for a CTF team to play with, share knowledge, improve together, and hopefully make some friends in the infosec community along the way :)

If your team is looking for new members, or you're in a similar situation, feel free to reach out!

Hey everyone, I'm Abhi.

I'm building a cybersecurity community. Right now, it's limited to a Discord server, but we're slowly growing. To keep things running smoothly, I'm looking for 3–4 active people who want to be part of this journey.

One of the positions will be for a Community Mentor & Server Growth Manager. Both roles will be handled by the same person.

Just to be clear, there are no gifts or rewards for now. But if the community starts generating profits in the future, I'll make sure the people working with me get something out of it too.

We're also working on building a platform of our own.

The other members will focus on their preferred fields, work on research, and help guide or mentor others who share similar interests. I'm also looking for creative people who can come up with challenges for the community. Of course, if you contribute something, you'll get proper credit for your work.

For most of these roles, you should have at least a junior-level understanding of cybersecurity or your specific field. Beginners are welcome to join the community too, though. There's a lot to learn here.

If you're interested, just DM me directly. I'll share the Discord username with you, and you can get all the details there.

Or just drop a comment, and I'll send you the link.

Found a ROT13 encoded string in a CTF challenge that

decoded to a hint about a bypass header:

X-Dev-Access: yes

Proxied all traffic through Burp Suite, caught the

request, sent it to Repeater and added the header —

instantly bypassed the access restriction.

Classic example of why debug/dev headers should never

make it into production. Developers leave these in

during testing and forget to strip them before deploy.

Good beginner web exploitation technique to know for

CTFs and bug bounty. Happy to answer questions.

https://youtu.be/jhhXZDDFWpo

Hey everyone!

As AI gets better at solving CTF challenges, is there still room for humans? We believe there is.

IERAE CTF 2026: FINAL for Humans kicks off with Round 1, featuring a Web challenge that even a GPT-5.6-sol ultra-based AI agent couldn’t solve in our tests.

AI is welcome! Use it as a tool, or see if your autonomous agent can solve the challenge without human help.

Round 1 details:

• Date: October 10, 2026, 00:00–08:00 UTC
• Format: Individual, one Web challenge
• Prizes: $1,000 total ($600 / $300 / $100 for the top 3)

Register here:
https://alpacahack.com/ctfs/ierae-final-for-humans-1

Good luck!

Hey everyone, I'm trying to solve a CTF chllenge.
im not asking for a solution.
if anyone intrested to help me kindly reply.

🏹 PINAKA CTF 2026 — The Battle Begins.

We are excited to announce PINAKA CTF 2026, a national-level Capture The Flag competition organized by National Forensic Sciences University (NFSU), Chennai Campus.

Inspired by the precision, strategy, and determination of Pinaka, this CTF is designed to challenge cybersecurity enthusiasts to think beyond the obvious and solve problems with skill, creativity, and strategy.

🔐 Challenge Categories:

• Web Exploitation

• Digital Forensics

• OSINT

• Cryptography

• Reverse Engineering

• Binary Exploitation / Pwn

• Network Security

• Steganography

⚔️ Competition Structure:

🌐 Online Qualification Round

📅 31 October 2026

⏱️ 24 Hours

The best performers will advance to the offline grand finale.

🏆 Offline Grand Final

📅 28 November 2026

📍 NFSU Chennai Campus

⏱️ 12 Hours

The finalists will compete across multiple formats including:

• Jeopardy

• King of the Hill

• Case Study Scenarios

Whether you are a student, CTF player, cybersecurity enthusiast, researcher, or professional — PINAKA CTF is an opportunity to test your skills, compete with talented individuals, and experience cybersecurity beyond the classroom.

The challenge is waiting.

Are you ready to take the shot? 🎯

🔗 Register now:

https://pinakactf.com/

Organized by:

National Forensic Sciences University

Chennai Campus

#PINAKACTF #PINAKACTF2026 #CyberSecurity #CTF #CaptureTheFlag #NFSU #NFSUChennai #EthicalHacking #DigitalForensics #OSINT #CyberSecurityIndia #InfoSec #CybersecurityCommunity

We have made a discord server for beginners to start their journey into CTFs. This is a community aimed to interact with fellow learners and help each other long way. There will also be group discussions and challenges depending on participants.

Dont hesitate, join now and get the flags!

Hey everyone!

GeekHaven, IIIT Allahabad, in collaboration with KageX.ai, is hosting RIFT CTF 2026, an online CTF focused on AI Security.

If you're interested in LLM security, AI vulnerabilities, prompt injection, adversarial attacks, or just want to test your skills against some interesting challenges, this might be worth checking out.

🏆 Details

• Prize Pool: ₹50,000
• Team Size: 1–3 members
• Format: Online
• Dates: 31st October – 1st November 2026
• Theme: AI Security
• Eligibility: Participants from across India

You'll get the chance to solve AI-security-focused challenges, hunt for vulnerabilities, and compete with other CTF players.

Registration:
https://unstop.com/competitions/rift-ctf-2026-kagexai-x-geekhaven-iiita-indian-institute-of-information-technology-iiit-allahabad-1762770

Official Discord:
https://discord.gg/agtTU8aXt

WhatsApp Channel:
https://whatsapp.com/channel/0029VbEFXJk6buMHNeQy6R1j

If you're forming a team, feel free to find teammates in the comments.

Good luck and happy hacking! 🚩

This was a one-time CTF event and it has already ended, so there is no challenge link available

The challenge gives me:
$sntp-ms$d7fd5720afbb55c6a2e94da697327e86$1c0111e900000000000a084f4c4f434cec7e1f6f49c0addae1b8428bffbfcd0aec7e2a645db83997ec7e2a645db88bcd

Description:
Try Harder and harder without asking any help from angel because now it’s the time

I’m trying to understand how this challenge was solved and what the intended approach was. I tried using Hashcat but couldn’t get anywhere with it, and I noticed the sntp-ms part but I’m not sure what to make of it
Would appreciate an explanation

New "Advanced" vulnerable VM aka "Sieste" is now available at hackmyvm.eu :) Have fun!

Here is a made-up payload to illustrate a useful distinction:

eyJyb2xlIjoiZGVtbyJ9

Decoding it gives {"role":"demo"}. That tells you what the bytes say, not whether anyone is entitled to that role. For a JWT, reading the header or payload does not verify the signature, expiry, issuer or audience. Don't treat readable claims as proof.

I made Pocket Decoder as a small local Android utility for this sort of scratch work: Base64, URL and hex decoding, JWT payload inspection, JSON formatting and ROT transforms. It is completely free, with no ads or required account. This sample is my own, not a challenge from an active CTF.

Play: https://play.google.com/store/apps/details?id=com.superevilrobots.pocketdecoder

There is a free browser version too: https://superevilrobots.com/tools/text-decoder/

It is a pocket decoding aid, not a full CyberChef replacement or JWT verifier. Disclosure: I'm the developer and used AI assistance while building it.