initial commit
This commit is contained in:
antton committed
commit
109bb924dd
135 files changed
+2538
No files matched your search
@@ -0,0 +1,21 @@
|
||||
# A Pirate's Life for Me: Part 1
|
||||
|
||||
**Category:** Traffic Analysis
|
||||
|
||||
**Points:** 25
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/pirates_life.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@Cyb0rgSw0rd\</code>\</sup>
|
||||
|
||||
We received this packet capture from the university cafe immediately following a few big breaches - from the university itself to some random government website. Even the hospital got hit by DEADFACE. The barista reported someone using a browser they've never seen before... but it could just be that they had light mode on, so maybe it was nothing. Still worth a look though.
|
||||
|
||||
Submit the flag as `deadface{flag-text}`.
|
||||
|
||||
[Download PCAP 7z](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/pcap/pcap06/pirateslife.7z)(514MB)\<br>
|
||||
\<sup>SHA256: `7bcebd81928b2d01718f2f853c507ea313a44e2b19037f4b7d0cc1c638affe93`\</sup>
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
Binary file not shown.
@@ -0,0 +1,22 @@
|
||||
# Bad Guys Be Bad
|
||||
|
||||
**Category:** Traffic Analysis
|
||||
|
||||
**Points:** 350
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/bad_guys_be_bad.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@RP-01?\</code>\</sup>
|
||||
|
||||
Now that we know the who, what, when of it all, we want to embarrass the DEADFACE member responsible for this whole thing. Think you can do some digging and find their deepest darkest secret? I am pretty sure it is hidden on some external file location, but we don't know where!
|
||||
|
||||
Submit the flag as `deadface{flag_text}`.
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
|
||||
## Attachments
|
||||
|
||||
- [deadface_pcap02.pcap](files/deadface_pcap02.pcap)
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,20 @@
|
||||
# Data Go Brrrrr
|
||||
|
||||
**Category:** Traffic Analysis
|
||||
|
||||
**Points:** 25
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/data_go_brrrrr.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@RP-01?\</code>\</sup>
|
||||
|
||||
Our client wants to know what is happening on their network. Data is leaving the network and they have limited it down to a small segment of traffic. Can you find the flag associated with the data being exfiltrated?
|
||||
|
||||
Submit the flag as `deadface{flag_text}`.
|
||||
|
||||
[Download PCAP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/pcap/pcap01/PCAP01.pcap)
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
Binary file not shown.
@@ -0,0 +1,21 @@
|
||||
# Don't Leave Me Hanging
|
||||
|
||||
**Category:** Traffic Analysis
|
||||
|
||||
**Points:** 500
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/dont_leave_me_hanging.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@Cyb0rgSw0rd\</code>\</sup>
|
||||
|
||||
Sounds like Deadface are trying to sneak some data out of Aurora Health... but the security is pretty locked down. We suspect that they might be trying to work it from the inside out. The head of security noticed that the traffic for the help desk subnet was flagging for anomalous activity and set the packet capture to us for a set of fresh eyes on the situation.
|
||||
|
||||
Submit the answer as `deadface{deadface alias}`
|
||||
|
||||
[Download PCAP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/pcap/DontLeaveMeHanging.pcap)(80MB)\<br>
|
||||
\<sup>SHA256: `93bf96711676fa3675d0bd8729ccdf00ffc80ef4ddcc4e1892dfa1a45f11e6f2`\</sup>
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
@@ -0,0 +1,22 @@
|
||||
# Return to Sender
|
||||
|
||||
**Category:** Traffic Analysis
|
||||
|
||||
**Points:** 80
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/return_to_sender.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@RP-01?\</code>\</sup>
|
||||
|
||||
Something on this network is stealing data and sneaking it out disguised as ordinary web traffic. You've been handed a packet capture from the affected machine. Buried, a compromised host is quietly shipping stolen data out to a server it shouldn't be talking to. Find the traffic that doesn't belong, figure out what's being smuggled, and piece it back together.
|
||||
|
||||
Submit the flag as `deadface{flag_text}`.
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
|
||||
## Attachments
|
||||
|
||||
- [PCAP03.pcap](files/PCAP03.pcap)
|
||||
Binary file not shown.
@@ -0,0 +1,22 @@
|
||||
# Twilight Zone Transfer
|
||||
|
||||
**Category:** Traffic Analysis
|
||||
|
||||
**Points:** 50
|
||||
|
||||
## Description
|
||||
|
||||
\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/twilight_zone_transfer.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
|
||||
\<sup>Created By: \<code>@RP-01?\</code>\</sup>
|
||||
|
||||
A misconfigured DNS server allowed an unauthorized zone transfer (AXFR). The attacker enumerated hostnames, then pulled the ENTIRE zone in one request. The capture already contains that transfer, find it and read the records.
|
||||
|
||||
Submit the flag with the dog's name as: `deadface{flag-text}`
|
||||
|
||||
## Services
|
||||
|
||||
- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
|
||||
|
||||
## Attachments
|
||||
|
||||
- [PCAP04.pcap](files/PCAP04.pcap)
|
||||
Binary file not shown.
Reference in new issue
Block a user