initial commit

forensics/art-heist-the-forgery/README.md

@@ -0,0 +1,27 @@
+# Art Heist: The Forgery
+
+**Category:** Forensics
+
+**Points:** 25
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/art_heist_the_forgery.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@syyntax\</code>\</sup>
+
+The Turla Museum recently welcomed back five paintings from its Cyber Impressionism collection following a loan to a neighboring gallery. But museum officials have received intelligence suggesting that DEADFACE infiltrated the gallery during the exhibition and secretly replaced one of the original paintings with a forgery.
+
+All five paintings were scanned and entered into the museum's digital archive upon their return. Although the artwork appears authentic, investigators suspect that the forger left behind traces of their work in the digital records.
+
+The museum has provided copies of all five images and needs your help identifying the compromised artwork.
+
+Can you determine which painting was forged and recover the flag left behind?
+
+Submit the flag as `deadface{flag-text}`.
+
+[Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/for11/CTF_Forgery_Paintings.zip)(9.35MB)\<br>
+\<sup>SHA256: `f4d4d1185b94639bfbcfadb81abbea667977760dd31834dfc52d4d65a846cb12`\</sup>
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)

forensics/hooked/README.md

@@ -0,0 +1,26 @@
+# Hooked
+
+**Category:** Forensics
+
+**Points:** 25
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/hooked.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@saran s\</code>\</sup>
+
+De Monne Financial has detected suspicious outbound traffic originating from workstation `DEMONNE-WS04`, assigned to employee Fletcher Kampeter in the Finance division. A credential submission was logged against an unknown external host at *10:23 AM on March 14, 2025* - during normal business hours. Browser artifacts have been imaged from the machine and packaged for analysis.
+
+DEADFACE is suspected of running a targeted spearphishing campaign against De Monne personnel. It's unclear how deep the access goes, but finding the entry point is the first step. Inspect the artifacts. Find the URL the employee clicked.
+
+Your task is to identify the suspicious URL from the phishing email that the employee clicked on. Recover it from the browser web artifacts and submit it as the flag.
+
+Example: deadface{http://suspicious-url.example.com/path?param=value}
+
+[Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/for01/CTF_Caches_Kampeter_1.zip)(~9KB)
+\<sup>SHA256: `https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/for01/CTF_Caches_Kampeter_1.zip`\</sup>
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
+- [http://suspicious-url.example.com](http://suspicious-url.example.com)