initial commit

de-monne-slayer/diagnosis/README.md

@@ -0,0 +1,20 @@
+# Diagnosis
+
+**Category:** De Monne Slayer
+
+**Points:** 100
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonneslayer.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+One of De Monne's developers suspects there is hidden activity occurring in the app, possibly due to manifest misconfigurations.
+
+Submit the flag as `deadface{flag_text}`
+
+\> Use the ZIP from **Hard Kept Secrets**
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)

de-monne-slayer/hard-kept-secrets/README.md

@@ -0,0 +1,21 @@
+# Hard Kept Secrets
+
+**Category:** De Monne Slayer
+
+**Points:** 20
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonneslayer.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+De Monne Financial has had several security incidents revolving around the latest version of their Android mobile application. Sensitive user data is being compromised left and right. De Monne is unsure how DEADFACE has access to their API. It's too early to tell if they compromised a password - let's first check if there are any hardcoded secrets in the app.
+
+Your task is to recover the internal API token from the APK. Submit the token as the flag. Example: `deadface{2GFEwQvPVIMLJmjGYHgKFWkmpuhrjEnSewMrFRyVMEQ=}`
+
+[Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/demonneslayer/app-release.zip)\<br>
+\<sup>SHA256:`5530926b2e564615285d15674ddb21c316f673d7d240f9fcfa36c6afb99f5c0c`\</sup>
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)

de-monne-slayer/inside-man/README.md

@@ -0,0 +1,20 @@
+# Inside Man
+
+**Category:** De Monne Slayer
+
+**Points:** 20
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonneslayer.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+Leaks indicate that DEADFACE obtained data that normal customers don't have access to on the app. Logging was turned off on the backend, so De Monne isn't sure which account was used. DEADFACE either compromised a developer account, or something is hardcoded in the app that gave them easy access.
+
+Submit the flag as `deadface{flag_text}`
+
+\> Use the ZIP from **Hard Kept Secrets**
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)

de-monne-slayer/no-holding-back/README.md

@@ -0,0 +1,20 @@
+# No Holding Back
+
+**Category:** De Monne Slayer
+
+**Points:** 210
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonneslayer.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+DEADFACE was able to extract bank data from several of De Monne's customers. Something in the app's logic allows DEADFACE to gather details from pretty much any user they want. DEADFACE claims they left a flag behind as proof that they have access to De Monne's customer data. The problem is, we don't know who the user is (or their password).
+
+Submit the flag as `deadface{flag_text}`
+
+\> Use the ZIP from **Hard Kept Secrets**
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)