initial commit

forensics/hooked/README.md

@@ -0,0 +1,26 @@
+# Hooked
+
+**Category:** Forensics
+
+**Points:** 25
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/hooked.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@saran s\</code>\</sup>
+
+De Monne Financial has detected suspicious outbound traffic originating from workstation `DEMONNE-WS04`, assigned to employee Fletcher Kampeter in the Finance division. A credential submission was logged against an unknown external host at *10:23 AM on March 14, 2025* - during normal business hours. Browser artifacts have been imaged from the machine and packaged for analysis.
+
+DEADFACE is suspected of running a targeted spearphishing campaign against De Monne personnel. It's unclear how deep the access goes, but finding the entry point is the first step. Inspect the artifacts. Find the URL the employee clicked.
+
+Your task is to identify the suspicious URL from the phishing email that the employee clicked on. Recover it from the browser web artifacts and submit it as the flag.
+
+Example: deadface{http://suspicious-url.example.com/path?param=value}
+
+[Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/for01/CTF_Caches_Kampeter_1.zip)(~9KB)
+\<sup>SHA256: `https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/for01/CTF_Caches_Kampeter_1.zip`\</sup>
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
+- [http://suspicious-url.example.com](http://suspicious-url.example.com)