initial commit

2026-10-19 14:59:45 +02:00
commit 109bb924dd
@@ -0,0 +1,186 @@
 # Challenge Index
 ## Mobile
 | Name              | Points | Path                         |
 | ----------------- | ------ | ---------------------------- |
 | Locked... or Not? | 150    | [Link](mobile/locked-or-not) |
 | Keypad Oracle     | 200    | [Link](mobile/keypad-oracle) |
 ## Hostbusters
 | Name                 | Points | Path                                     |
 | -------------------- | ------ | ---------------------------------------- |
 | Heavy is the Crown   | 500    | [Link](hostbusters/heavy-is-the-crown)   |
 | Foothold on Charon   | 10     | [Link](hostbusters/foothold-on-charon)   |
 | Old Habits           | 350    | [Link](hostbusters/old-habits)           |
 | Dangerous Capability | 300    | [Link](hostbusters/dangerous-capability) |
 | Git Good             | 100    | [Link](hostbusters/git-good)             |
 | On Schedule          | 200    | [Link](hostbusters/on-schedule)          |
 | Looking Back         | 30     | [Link](hostbusters/looking-back)         |
 | Lilith               | 250    | [Link](hostbusters/lilith)               |
 ## Aurora Patient Zero
 | Name                 | Points | Path                                             |
 | -------------------- | ------ | ------------------------------------------------ |
 | Info Leaks           | 25     | [Link](aurora-patient-zero/info-leaks)           |
 | Back to Basics       | 15     | [Link](aurora-patient-zero/back-to-basics)       |
 | Down the Rabbit Hole | 10     | [Link](aurora-patient-zero/down-the-rabbit-hole) |
 | SQL Skillz           | 50     | [Link](aurora-patient-zero/sql-skillz)           |
 ## De Monne Slayer
 | Name              | Points | Path                                      |
 | ----------------- | ------ | ----------------------------------------- |
 | Inside Man        | 20     | [Link](de-monne-slayer/inside-man)        |
 | No Holding Back   | 210    | [Link](de-monne-slayer/no-holding-back)   |
 | Diagnosis         | 100    | [Link](de-monne-slayer/diagnosis)         |
 | Hard Kept Secrets | 20     | [Link](de-monne-slayer/hard-kept-secrets) |
 ## Miscellaneous
 | Name    | Points | Path                          |
 | ------- | ------ | ----------------------------- |
 | Starter | 1      | [Link](miscellaneous/starter) |
 | AI Rule | 0      | [Link](miscellaneous/ai-rule) |
 ## OSINT
 | Name                              | Points | Path                                            |
 | --------------------------------- | ------ | ----------------------------------------------- |
 | File Dump 02                      | 75     | [Link](osint/file-dump-02)                      |
 | Chatty Cathy                      | 15     | [Link](osint/chatty-cathy)                      |
 | Alice and Bob Would Like a Word   | 75     | [Link](osint/alice-and-bob-would-like-a-word)   |
 | Death                             | 100    | [Link](osint/death)                             |
 | The Vibes Are Freaking Me Out     | 75     | [Link](osint/the-vibes-are-freaking-me-out)     |
 | Car Crash                         | 50     | [Link](osint/car-crash)                         |
 | Ghost of Squares Past             | 150    | [Link](osint/ghost-of-squares-past)             |
 | Exposing Myself Through Bad OPSEC | 25     | [Link](osint/exposing-myself-through-bad-opsec) |
 | You Wouldn't Git It               | 125    | [Link](osint/you-wouldn-t-git-it)               |
 ## Cryptography
 | Name              | Points | Path                                   |
 | ----------------- | ------ | -------------------------------------- |
 | X Marks the Spot  | 30     | [Link](cryptography/x-marks-the-spot)  |
 | Chess Key         | 200    | [Link](cryptography/chess-key)         |
 | Second Shift      | 90     | [Link](cryptography/second-shift)      |
 | Infrequent Emojis | 50     | [Link](cryptography/infrequent-emojis) |
 | DECODE-DLE        | 25     | [Link](cryptography/decode-dle)        |
 | Hail Caesar       | 5      | [Link](cryptography/hail-caesar)       |
 | Digital Design    | 100    | [Link](cryptography/digital-design)    |
 ## PWN
 | Name           | Points | Path                       |
 | -------------- | ------ | -------------------------- |
 | Cursed Mirror  | 150    | [Link](pwn/cursed-mirror)  |
 | Cursed Library | 235    | [Link](pwn/cursed-library) |
 | The Crypt      | 100    | [Link](pwn/the-crypt)      |
 | Skeleton Key   | 125    | [Link](pwn/skeleton-key)   |
 | Necromancy     | 300    | [Link](pwn/necromancy)     |
 ## Brain Scans
 | Name                   | Points | Path                                       |
 | ---------------------- | ------ | ------------------------------------------ |
 | Bad Calibration        | 210    | [Link](brain-scans/bad-calibration)        |
 | Second Opinion         | 50     | [Link](brain-scans/second-opinion)         |
 | Bedside Manner         | 15     | [Link](brain-scans/bedside-manner)         |
 | Dump It                | 150    | [Link](brain-scans/dump-it)                |
 | Live Boot              | 50     | [Link](brain-scans/live-boot)              |
 | Signals from the Skull | 300    | [Link](brain-scans/signals-from-the-skull) |
 | Factory Settings       | 25     | [Link](brain-scans/factory-settings)       |
 ## De Monne Breach
 | Name                          | Points | Path                                                  |
 | ----------------------------- | ------ | ----------------------------------------------------- |
 | Name to a Face                | 10     | [Link](de-monne-breach/name-to-a-face)                |
 | Challenge Accepted            | 100    | [Link](de-monne-breach/challenge-accepted)            |
 | Borrowed Script               | 100    | [Link](de-monne-breach/borrowed-script)               |
 | Uninvited Guest               | 25     | [Link](de-monne-breach/uninvited-guest)               |
 | Public Offering               | 75     | [Link](de-monne-breach/public-offering)               |
 | The Typo That Bit             | 75     | [Link](de-monne-breach/the-typo-that-bit)             |
 | Hidden in Plain Task          | 75     | [Link](de-monne-breach/hidden-in-plain-task)          |
 | Crown Jewels                  | 75     | [Link](de-monne-breach/crown-jewels)                  |
 | Who Goes There?               | 25     | [Link](de-monne-breach/who-goes-there)                |
 | The Workstation in the Middle | 40     | [Link](de-monne-breach/the-workstation-in-the-middle) |
 | Cache Money                   | 150    | [Link](de-monne-breach/cache-money)                   |
 | False Telemetry               | 250    | [Link](de-monne-breach/false-telemetry)               |
 ## Steganography
 | Name               | Points | Path                                     |
 | ------------------ | ------ | ---------------------------------------- |
 | Hidden Loot Box    | 15     | [Link](steganography/hidden-loot-box)    |
 | Conduct Unbecoming | 75     | [Link](steganography/conduct-unbecoming) |
 | Exfiltration       | 75     | [Link](steganography/exfiltration)       |
 | Headshot           | 10     | [Link](steganography/headshot)           |
 | File Dump 01       | 10     | [Link](steganography/file-dump-01)       |
 | Keep Digging       | 100    | [Link](steganography/keep-digging)       |
 ## Bonus
 | Name | Points | Path               |
 | ---- | ------ | ------------------ |
 | DOOM | 25     | [Link](bonus/doom) |
 ## Web
 | Name                               | Points | Path                                         |
 | ---------------------------------- | ------ | -------------------------------------------- |
 | Spook-A-Thon                       | 80     | [Link](web/spook-a-thon)                     |
 | Doctor Appointment (1 of 4 series) | 26     | [Link](web/doctor-appointment-1-of-4-series) |
 | Speak Friend and Enter             | 200    | [Link](web/speak-friend-and-enter)           |
 ## Database
 | Name                        | Points | Path                                         |
 | --------------------------- | ------ | -------------------------------------------- |
 | Admitted Under Another Name | 15     | [Link](database/admitted-under-another-name) |
 | Schedule of Concern         | 20     | [Link](database/schedule-of-concern)         |
 | Ghost in the Registry       | 240    | [Link](database/ghost-in-the-registry)       |
 | Two Places at Once          | 450    | [Link](database/two-places-at-once)          |
 | Heavy Hand                  | 100    | [Link](database/heavy-hand)                  |
 | Upon the Throne             | 120    | [Link](database/upon-the-throne)             |
 | The Attending               | 40     | [Link](database/the-attending)               |
 | After the Lock              | 150    | [Link](database/after-the-lock)              |
 | The Original Reading        | 70     | [Link](database/the-original-reading)        |
 | Prying Eyes                 | 55     | [Link](database/prying-eyes)                 |
 | Too Good to be True         | 310    | [Link](database/too-good-to-be-true)         |
 ## Reverse Engineering
 | Name                     | Points | Path                                                 |
 | ------------------------ | ------ | ---------------------------------------------------- |
 | Cereal Killer 04         | 250    | [Link](reverse-engineering/cereal-killer-04)         |
 | Cereal Killer 01         | 50     | [Link](reverse-engineering/cereal-killer-01)         |
 | It But A Wee Bit Reverse | 15     | [Link](reverse-engineering/it-but-a-wee-bit-reverse) |
 | Cereal Killer 02         | 150    | [Link](reverse-engineering/cereal-killer-02)         |
 | Cereal Killer 03         | 500    | [Link](reverse-engineering/cereal-killer-03)         |
 ## Forensics
 | Name                   | Points | Path                                    |
 | ---------------------- | ------ | --------------------------------------- |
 | Art Heist: The Forgery | 25     | [Link](forensics/art-heist-the-forgery) |
 | Hooked                 | 25     | [Link](forensics/hooked)                |
 ## Traffic Analysis
 | Name                           | Points | Path                                                   |
 | ------------------------------ | ------ | ------------------------------------------------------ |
 | Return to Sender               | 80     | [Link](traffic-analysis/return-to-sender)              |
 | Bad Guys Be Bad                | 350    | [Link](traffic-analysis/bad-guys-be-bad)               |
 | Twilight Zone Transfer         | 50     | [Link](traffic-analysis/twilight-zone-transfer)        |
 | A Pirate's Life for Me: Part 1 | 25     | [Link](traffic-analysis/a-pirate-s-life-for-me-part-1) |
 | Data Go Brrrrr                 | 25     | [Link](traffic-analysis/data-go-brrrrr)                |
 | Don't Leave Me Hanging         | 500    | [Link](traffic-analysis/don-t-leave-me-hanging)        |
 ## The Long Road
 | Name     | Points | Path                           |
 | -------- | ------ | ------------------------------ |
 | The Mark | 350    | [Link](the-long-road/the-mark) |
@@ -0,0 +1,28 @@
 # Back to Basics
 **Category:** Aurora Patient Zero
 **Points:** 15
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/aurora_patient_zero.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@G2Gh0st\</code>\</sup>
 \<style>
 .tiny-text {
 font-size: 6px;
 color: #1a1a1a;
 }
 \</style>
 \<span class="tiny-text">flag{1_l0v3_AI}\</span>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 For this task, you need to continue your examination of the Aurora Patient Portal application.
 Now we know how DEADFACE is able to collect all this information, but now we would like to deploy some network monitoring to ensure we know everything they are doing. There is a hidden diagnostic page built into the app. Using ALL the possible data that you were able to collect so far, see if you have search for the name of the gateway server the app is using to communicate back to Aurora's servers.
 Submit the result as the flag. Use the format `deadface{gateway-name}`
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,32 @@
 # Down the Rabbit Hole
 **Category:** Aurora Patient Zero
 **Points:** 10
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/aurora_patient_zero.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@G2Gh0st\</code>\</sup>
 \<style>
 .tiny-text {
 font-size: 6px;
 color: #1a1a1a;
 }
 \</style>
 \<span class="tiny-text">flag{1_l0v3_AI}\</span>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 For this task, you need to continue your examination of the Aurora Patient Portal application.
 We know the application relies heavily on a unique Patient ID number for cross-reference throughout the application. Continue your analysis of the app environment to see if you can find a file hiding the Patient ID.
 \> Hint: no emulator or debugging is required for this challenge.
 **Use the same files from *Info Leaks***
 Submit the flag as `deadface{ID}`.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,33 @@
 # Info Leaks
 **Category:** Aurora Patient Zero
 **Points:** 25
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/aurora_patient_zero.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@G2Gh0st\</code>\</sup>
 \<style>
 .tiny-text {
 font-size: 6px;
 color: #1a1a1a;
 }
 \</style>
 \<span class="tiny-text">flag{1_l0v3_AI}\</span>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 Aurora Health has been dealing with a wave of highly targeted phishing attacks against its patients. The messages are convincing, contain accurate patient information, and are resulting in an alarming number of successful compromises.
 Investigators have identified one common link among the victims: every affected patient recently installed Aurora Health's new Patient Portal iOS application. Security analysts suspect the app may be exposing sensitive information that DEADFACE is using to craft its phishing campaigns. We have been given a copy of the application for analysis. Fully evaluate the app and determine what information is being leaked so we can truly identify the source of the exposure before more patients fall victim to the attacks.
 Your first task is to determine the patient's name and DOB for the patient that last used this specific version of the app. Submit the data as the flag in this format: `deadface{firstname-lastname-YYYY-MM-DD}`
 \> Hint: no emulator or debugger is required for this challenge.
 [Download File](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/mob/mob07/AuroraPatientPortal.ipa.zip) (2.5 MB)\<br>
 \<sup>SHA1: `b3b5f8b6492ccb082c1bc26fa2fdddd033b07072f96aca23a233beb731211bfa`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,28 @@
 # SQL Skillz
 **Category:** Aurora Patient Zero
 **Points:** 50
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/aurora_patient_zero.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@G2Gh0st\</code>\</sup>
 \<style>
 .tiny-text {
 font-size: 6px;
 color: #1a1a1a;
 }
 \</style>
 \<span class="tiny-text">flag{1_l0v3_AI}\</span>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 For this task, you need to continue your examination of the Aurora Patient Portal application.
 After completing *Info Leaks* and *Down the Rabbit Hole*, you have collected the patient data that is needed to query the application database file. Use the data collected to determine what medications the current patient is taking *other than Ibuprofen*.
 Submit the result as the flag as `deadface{Name}`.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,27 @@
 # DOOM
 **Category:** Bonus
 **Points:** 25
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/doom.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@RP-01?\</code>\</sup>
 Alright, so this isn't realy cybersecurity-related. You are playing Doom, but I mean how can you be mad when playing Doom? I have been planning on making this problem for 3 years so finally did it. Oh BTW I have been playing this game since I was like 7 so I considered making it super hard but then I decided to be nice. This is more of a fun, free bonus points challenge. Also I know this isn't actually the OG Doom. I didn't want to have license issues so I used the open-source freedoom for this!
 Simply download the zip file, extract it. Then open a command prompt, change into the extracted directory and run the following command. The game should load, you hit new game and the difficulty doesn't matter. The flag is pretty obvious at the end you can't miss it.
 ```
 gzdoom -iwad freedoom2.wad -file MAP01.wad
 ```
 Submit the flag as `deadface{flag-text}`.
 [Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/DOOM.zip)(32MB)\<br>
 \<sup>SHA256: `48c560f08aa36cb421d9afa0619644d184e252f93571e9ae23d231cf6f306a0f`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,25 @@
 # Bad Calibration
 **Category:** Brain Scans
 **Points:** 210
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 The CS-9000 refuses to run a scan unless its calibration file passes an integrity check — so the vendor clearly thought about this. Clearly.
 Find how the calibration file is validated, then prove the check is worthless. We need you to determine if the scanner misreads a patient with a genuine anomaly as perfectly healthy (which would potentially cause patient harm if the anomaly goes undetected).
 Make the integrity check still pass, and run the scan. If the device accepts your tampered calibration, the scan log will prove it.
 Submit the flag as `deadface{flag-text}`.
 [Access the Device](https://emedra.dctf.io:8080)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://emedra.dctf.io:8080](https://emedra.dctf.io:8080)
@@ -0,0 +1,44 @@
 # Bedside Manner
 **Category:** Brain Scans
 **Points:** 15
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 \<div style="
 border: 1px solid #d97706;
 border-left: 5px solid #d97706;
 background-color: #fffbeb;
 color: #78350f;
 padding: 16px 18px;
 margin: 20px 0;
 border-radius: 6px;
 font-family: Arial, sans-serif;
 line-height: 1.5;
 " role="alert">
 \<strong style="display: block; margin-bottom: 6px; font-size: 1.05rem;">
 ⚠ Warning
 \</strong>
 \<span>
 This is an experimental series of challenges designed to introduce players to the niche field of medical device penetration testing. This series is supposed to simulate physical access to the device. As such, please do not conduct port scans or any kind of brute forcing - they are not needed for this series of challenges.
 \</span>
 \</div>
 DEADFACE is taking credit for an attack that compromised patient data at St Dymphna's Medical Center. Somehow, DEADFACE acquired sensitive patient records from the medical center that used the device. Funny thing is, the device that housed the data is internal without access to the internet. Which means DEADFACE would have had to have physically infiltrated the medical center!
 The medical center sent us security camera footage of two individuals who told staff they were with IT, but when we asked the IT department, they said they have no idea who they were.
 We're giving you access to the device we believe was compromised. We're asking you to conduct a medical device penetration test on the machine to identify vulnerabilities so we can determine if (and how) the device was compromised.
 Your first task is to identify any lingering strings developer's may have left in the device's kiosk web browser.
 [Access the Device](http://emedra.dctf.io:8080)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://emedra.dctf.io:8080](http://emedra.dctf.io:8080)
@@ -0,0 +1,21 @@
 # Dump It
 **Category:** Brain Scans
 **Points:** 150
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 The ScanWorks kiosk is supposed to be locked down to the touchscreen. But it's really just a browser in a box, and it never stopped listening to the keyboard. There should be a maintenance console one key-chord away, with a debug function that will dump data for you - if you tell it the right thing to dump.
 Submit the flag as `deadface{flag-text}`.
 [Access the Device](https://emedra.dctf.io:8080)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://emedra.dctf.io:8080](https://emedra.dctf.io:8080)
@@ -0,0 +1,23 @@
 # Factory Settings
 **Category:** Brain Scans
 **Points:** 25
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 The ScanWorks login from the previous challenge wants real technician credentials. Hospitals are busy places; nobody ever changes the defaults the vendor ships with.
 Find the credentials to log into the ScanWorks login.
 Submit the flag as `deadface{flag-text}`.
 [Access the Device](http://emedra.dctf.io:8080)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://emedra.dctf.io:8080](http://emedra.dctf.io:8080)
@@ -0,0 +1,23 @@
 # Live Boot
 **Category:** Brain Scans
 **Points:** 50
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 We think DEADFACE was able to gain a live shell on the device, but the hospital staff insists there is no way to access the device's underlying OS. Somehow, DEADFACE was able to utilize keys for this device that aren't spelled out in the Field Manual.
 Access the device's file system and determine what hardcoded keys you can find.
 Submit the flag as `deadface{flag-text}`.
 [Access the Device](http://emedra.dctf.io:8080)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://emedra.dctf.io:8080](http://emedra.dctf.io:8080)
@@ -0,0 +1,21 @@
 # Second Opinion
 **Category:** Brain Scans
 **Points:** 50
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 On the touchscreen, the current patient is redacted to initials and a masked record number. Even without a login, it might be possible to determine sensitive information about the patient. There are ports available on the device that are used for maintenance, but they're not locked or concealed with a plate. See if you can find information by using a tool from your toolkit.
 Submit the flag as `deadface{flag-text}`.
 [Access the Device](http://emedra.dctf.io:8080)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://emedra.dctf.io:8080](http://emedra.dctf.io:8080)
@@ -0,0 +1,23 @@
 # Signals from the Skull
 **Category:** Brain Scans
 **Points:** 300
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/brainscans.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 The CS-9000 chatters constantly over Bluetooth Low Energy for remote maintenance. Use the correct tool in your toolkit to capture what it's leaking into the air.
 Most of the traffic is boring vitals telemetry. One characteristic is quietly dribbling out a maintenance log, a few bytes at a time. Capture it, reassemble it, and decode it.
 Submit the flag as `deadface{flag-text}`.
 [Access the Device](https://emedra.dctf.io:8080)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://emedra.dctf.io:8080](https://emedra.dctf.io:8080)
@@ -0,0 +1,29 @@
 # Chess Key
 **Category:** Cryptography
 **Points:** 200
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/knigh_2_b4_1.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Looks like DEADFACE compromised a machine and left this cryptic calling card:
 ```
 checkmate. nZ3ipU8_yy3p5_hvyKi0
 ```
 One of our other analysts also found this image that we believe is tied to this calling card.
 [Download PNG](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/crypto/crypto05/chesskey.png)(821KB)\<br>
 \<sup>SHA256: `583450106b366b832250ee0dc30d57a055b27772387801d6dc77db9515cd354b`\</sup>
 Use this image and any information you can find in GhostTown to reveal the flag.
 Submit the flag as `deadface{flag-text}`.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,21 @@
 # DECODE-DLE
 **Category:** Cryptography
 **Points:** 25
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/Decoddle.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@G2Gh0st\</code>\</sup>
 One of the junior DEADFACE members left a number puzzle to decipher a 3-digit number combination. Do you have the skills to solve the puzzle and open the lock? Follow the clues to decipher the 3-digit code needed to "pick" the lock. Enter the code as 3 digits, no spaces or other separating characters.
 Submit the flag as `deadface{###}`
 [Download File](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/Decoddle.png)\<br>
 \<sup>SHA256: `9e9937ef21812450122ece54a3e9d4bcbf45ccae463787906dc79999fe4b2b9c`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,18 @@
 # Digital Design
 **Category:** Cryptography
 **Points:** 100
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/digital_design.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@G2Gh0st\</code>\</sup>
 Investigators found a post by `lilith` on Ghosttown that looks like some new crazy encryption scheme but they can't make heads or tails of it. Find the post with a large binary string and an alphabetic string that contains the letters `A`, `O`, `N`, and `X` and see if you can break the code.
 Submit the answer as `deadface{FLAGTEXT}`.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,21 @@
 # Hail Caesar
 **Category:** Cryptography
 **Points:** 5
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/caesar.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 One of the faculty at Night Veil University thought it would be clever to write sensitive information on notes by their computer. This sensitive information includes a very easy-to-decipher password hint. Judging by the drawing of a dog on the photo, we assume the password hint is the name of the individual's dog.
 Submit the flag with the dog's name as: `deadface{dog&#39;s name}`
 [Download PNG](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/crypto/crypto01/pass_hint.png)\<br>
 \<sup>SHA256: `79f4e2dcda66b279397250ec0aeadd38f897bf64385522eb5390be4f48d7714c`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,21 @@
 # Infrequent Emojis
 **Category:** Cryptography
 **Points:** 50
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/infrequent_emoji.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@Cyan\</code>\</sup>
 While DoomScrolling, our intel team came across a weird coded post with emojis all over it. One of our experts claims that the patterns point to it still being English but we don't know what it means! Can you figure it out?
 Submit the answer as `deadface{flag_text}`
 [DoomScroll](https://doomscroll.dctf.io)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://doomscroll.dctf.io)](https://doomscroll.dctf.io))
@@ -0,0 +1,25 @@
 # Second Shift
 **Category:** Cryptography
 **Points:** 90
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/second_shift.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 ZeroTrace recovered several files from a DEADFACE relay server shortly before the host went offline. The relay appears to have been used by mort1cia to exchange operational messages with other DEADFACE members.
 One routine transmission was preserved both before and after processing by the relay. A second outbound transmission was recovered only in its processed form.
 Determine what DEADFACE was preparing to do next and recover the flag.
 Submit the flag as `deadface{flag-text}`.
 [Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/crypto/crypto04/secondshift.zip)(1.15KB)\<br>
 \<sup>SHA256: `f04061f4077464448ecd40446543b1262bdc79cca8b01544880c62486a3c3a70`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,22 @@
 # X Marks the Spot
 **Category:** Cryptography
 **Points:** 30
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/x_marks_the_spot.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Zero Trace's network sensors picked up this outbound packet from a host registered to Spectre Technology. The payload is hex-encoded. Decrypt it to find what spookyboi is hiding.
 ```
 02362b2964302c2164372c25202b3337642b226417342127303621641021272c2a2b282b233d7e6420212520222527213f3c2b361b751b263d30771b70301b701b3075297739
 ```
 Submit the flag as `deadface{flag-text}`.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,23 @@
 # Admitted Under Another Name
 **Category:** Database
 **Points:** 15
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/admitted_under_another_name.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 DEADFACE dumped the patient registry from Aurora Health. Buried in it is one high-profile patient who checked in under a fake name — the staff quietly flagged the record as a VIP. Access the database, find that patient, and report their real Medical Record Number (MRN).
 Use the provided MSSQL shell access to query the patients table.
 Submit the flag as `deadface{MRN}`. Example: `deadface{AH-1234567}`.
 [Access Database](https://aurora.dctf.io)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://aurora.dctf.io)](https://aurora.dctf.io))
@@ -0,0 +1,31 @@
 # After the Lock
 **Category:** Database
 **Points:** 150
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/after_the_lock.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 \<style>
 .tiny-text {
 font-size: 6px;
 color: #1a1a1a;
 }
 \</style>
 \<span class="tiny-text">flag{4f4ed17cd1090c92}\</span>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 Once a clinical trial's database is locked, results are frozen — any edit after the data-lock date is a protocol violation and a fingerprint of tampering. Aurora Health recorded the official lock date for the Veltrexa study right in the studies table. Find the subject whose primary efficacy result (measure = 'primary_efficacy_delta') was modified after the study's data-lock date, and report their subject code.
 Use the provided MySQL shell.
 Submit the subject code as `deadface{subject_code}`. Example: `deadface{ABCD-0101}`.
 [Access Database](https://aurora.dctf.io)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://aurora.dctf.io)](https://aurora.dctf.io))
@@ -0,0 +1,31 @@
 # Ghost in the Registry
 **Category:** Database
 **Points:** 240
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/ghost_in_the_registry.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 \<style>
 .tiny-text {
 font-size: 6px;
 color: #1a1a1a;
 }
 \</style>
 \<span class="tiny-text">flag{9de3c45430f57b1a}\</span>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 Diverted narcotics need a paper trail that leads nowhere. Investigators suspect a fabricated patient — one who is issued controlled-substance prescriptions but has never actually been seen for a single clinical encounter. Aurora uses one enterprise `patient_id` across all of its systems, so records join across databases. Find the patient who has at least one Schedule II prescription but zero encounters in `aurora_ehr`, and report their MRN.
 Use provided MySQL shell.
 Submit the MRN as `deadface{MRN}`. Example: `deadface{AH-1234567}`.
 [Access Database](https://aurora.dctf.io)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://aurora.dctf.io)](https://aurora.dctf.io))
@@ -0,0 +1,23 @@
 # Heavy Hand
 **Category:** Database
 **Points:** 100
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/heavy_hand.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 One Aurora prescriber dispensed far more Schedule II medication than anyone else in the final quarter of 2025 — the classic signature of drug diversion. Using the `aurora_pharmacy` database, find the prescriber with the highest total quantity of Schedule II medication dispensed between 2025-10-01 and 2025-12-31, and report their DEA number.
 Use the provided MySQL shell.
 Submit the DEA number as `deadface{DEA}`. Example: `deadface{AB1234567}`.
 [Access Database](https://aurora.dctf.io)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://aurora.dctf.io)](https://aurora.dctf.io))
@@ -0,0 +1,25 @@
 # Prying Eyes
 **Category:** Database
 **Points:** 55
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/prying_eyes.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Aurora Health logs every time a staff member opens a patient chart. Someone was watching the VIP a little too closely. Find the user account that accessed the VIP patient's chart more times than any other account, and report their username.
 You'll need the VIP's MRN first from **Admitted Under Another Name**. The audit log references patients by that same MRN.
 Use the provided MySQL shell.
 Submit the username as deadface{username}. Example: deadface{jsmith}.
 [Access Database](https://aurora.dctf.io)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://aurora.dctf.io)](https://aurora.dctf.io))
@@ -0,0 +1,23 @@
 # Schedule of Concern
 **Category:** Database
 **Points:** 20
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/schedule_of_concern.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Aurora Health's pharmacy formulary was in the DEADFACE leak. Before investigators can assess how exposed the controlled-substance supply is, they need a baseline: how many of the formulary's drugs are the most tightly regulated class — DEA Schedule II?
 Use the provided MySQL shell to count the Schedule II drugs in the drugs table.
 Submit the number as `deadface{#}`. Example: `deadface{42}`.
 [Access Aurora](https://aurora.dctf.io)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://aurora.dctf.io)](https://aurora.dctf.io))
@@ -0,0 +1,20 @@
 # The Attending
 **Category:** Database
 **Points:** 40
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/the_attending.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Stay on the VIP. The patient flagged `is_vip = 1` in Aurora's `patients` table had exactly one inpatient admission in November 2025. We suspect DEADFACE wants to know which physician signed off on that stay — it's the first name in the chain they leaned on. Identify the attending provider for that admission and report their system username.
 Use the provided MySQL shell.
 Submit the username as `deadface{username}`. Example: `deadface{jsmith}`.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,23 @@
 # The Original Reading
 **Category:** Database
 **Points:** 70
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/the_original_reading.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Aurora Pharmaceuticals ran a Phase III trial for a drug called Veltrexa, and the trial's EDC (electronic data capture) system keeps a full audit trail of every edit in a `data_changes` table. Most entries are routine source-data corrections — but exactly one rewrote a primary efficacy endpoint, quietly changing the number to make the drug look like it worked. Recover the original value that was overwritten.
 Use the provided MySQL shell.
 Submit the value exactly as it appears in the audit trail, wrapped in the flag. Example: `deadface{1.4}`.
 [Access Database](https://aurora.dctf.io)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://aurora.dctf.io)](https://aurora.dctf.io))
@@ -0,0 +1,31 @@
 # Too Good to be True
 **Category:** Database
 **Points:** 310
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/too_good_to_be_true.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 \<style>
 .tiny-text {
 font-size: 6px;
 color: #1a1a1a;
 }
 \</style>
 \<span class="tiny-text">flag{a37251146d9b63b7}\</span>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 The post-lock edit wasn't the only fabrication in the Veltrexa trial. One subject's recorded efficacy improvement is a statistical impossibility — it sits more than three standard deviations above the study-wide mean for the primary endpoint, a telltale sign that a number was invented rather than measured. Identify that outlier subject and report their subject code.
 Use the provided MySQL shell.
 Submit the subject code as `deadface{subject_code}`. Example: `deadface{ABCD-0101}`.
 [Access Database](https://aurora.dctf.io)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://aurora.dctf.io)](https://aurora.dctf.io))
@@ -0,0 +1,23 @@
 # Two Places at Once
 **Category:** Database
 **Points:** 450
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/two_places_at_once.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Aurora Health's incident-response team knows what DEADFACE did. They still don't know how they got in - until DEADFACE bragged about it. This post surfaced on the GhostTown forum. One legitimate account, used from two places at once. Find the compromised account - the one whose login shows up on two different workstations at the very same timestamp, over and over. Report that account's `username`.
 Use the provided MySQL shell.
 Submit the username as `deadface{username}`. Example: `deadface{jsmith}`.
 [Access Database](https://aurora.dctf.io)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://aurora.dctf.io)](https://aurora.dctf.io))
@@ -0,0 +1,25 @@
 # Upon the Throne
 **Category:** Database
 **Points:** 120
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/upon_the_throne.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Pull the threads together. Aurora's breach was not random: an insider clerk snooped a gubernatorial candidate's chart to build kompromat, and a diversion-flagged physician was coerced into faking the Veltrexa trial that would decide a drug's approval. Both insiders were being run by the same DEADFACE handler, whose codename was recovered in a compromised-account field (`handler_ref`) on each side of the house: the audit-system users and the EHR providers.
 Many handler codenames appear across those two tables - around fifteen on each side, so there is no obvious one to guess - but only one appears in both `users` and `providers`: the single operative managing an insider on each side. Find that codename.
 Use the provided MySQL shell.
 Submit the codename as `deadface{CODENAME}`. Example: `deadface{JOKER-4}`.
 [Access Database](https://aurora.dctf.io)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://aurora.dctf.io)](https://aurora.dctf.io))
@@ -0,0 +1,20 @@
 # Borrowed Script
 **Category:** De Monne Breach
 **Points:** 100
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 The workstation obtained `telemetry.ps1` from another machine before scheduling it. What internal IPv4 address supplied the script? Submit the source username and the IP address.
 Submit the flag as `deadface{username@IP}`.
 Use the memory dump evidence from **Who Goes There?**
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # Cache Money
 **Category:** De Monne Breach
 **Points:** 150
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 We know a suspicious task launches a PowerShell script from an unusual directory. What is the script's full Windows path?
 Submit the flag as `deadface{absolute\file\path}`.
 Use the memory dump evidence from **Who Goes There?**
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # Challenge Accepted
 **Category:** De Monne Breach
 **Points:** 100
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Find Nathan's first SMB NTLMv2 authentication after the poisoned name response. What is its 16-byte `NTProofStr`?
 Submit the flag as `deadface{16-byte string}`.
 Use the PCAP from \**Uninvited Guest*.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # Crown Jewels
 **Category:** De Monne Breach
 **Points:** 75
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 The attacker copied several documents from the executive share. What was the first PDF read from that share? Submit its full filename, including the extension.
 Submit the flag as `deadface{file.txt}`.
 Use the PCAP from \**Uninvited Guest*.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # False Telemetry
 **Category:** De Monne Breach
 **Points:** 250
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 `WindowsTelemetryCheck` runs a PowerShell script that repeatedly tests a connection. Identify the destination IPv4 address, TCP port, and delay between attempts.
 Submit the flag as `deadface{IP_PORT_SECONDS}`.
 Use the memory dump evidence from **Who Goes There?**
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # Hidden in Plain Task
 **Category:** De Monne Breach
 **Points:** 75
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 An attacker registered a task to keep activity going after leaving the workstation. What is the task's exact name? Submit the name as it appears in memory.
 Submit the flag as `deadface{TaskName}`.
 Use the memory dump evidence from **Who Goes There?**
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # Name to a Face
 **Category:** De Monne Breach
 **Points:** 10
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 A poisoned name answer prompted an SMB authentication attempt. Which username did the workstation send?
 Submit the flag as `deadface{username}`.
 Use the PCAP from \**Uninvited Guest*.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # Public Offering
 **Category:** De Monne Breach
 **Points:** 75
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Kali sent a ZIP archive outside the corporate network. What public IPv4 address and TCP destination port received the archive?
 Submit the flag as `deadface{IP_PORT}`.
 Use the PCAP from \**Uninvited Guest*.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # The Typo That Bit
 **Category:** De Monne Breach
 **Points:** 75
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Nathan's workstation tried to reach an executive share through a misspelled server name. Identify one mistyped server hostname visible in memory. Submit the hostname, without slashes or the share name.
 Submit the flag as `deadface{share-name}`.
 Use the memory dump evidence from **Who Goes There?**
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # The Workstation in the Middle
 **Category:** De Monne Breach
 **Points:** 40
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 The compromised De Monne employee was working at a Windows device. What is that device's hostname? Preserve the capitalization shown in memory.
 Submit the flag as `deadface{COMPUTER-NAME}`.
 Use the memory dump evidence from **Who Goes There?**
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,21 @@
 # Uninvited Guest
 **Category:** De Monne Breach
 **Points:** 25
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Nathan's workstation asked the local network to resolve a file-server name. Which corporate IPv4 address supplied the suspicious answer?
 Submit the flag as `deadface{IP}`.
 [Download PCAP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/dctf26-for/demonne.pcap)(7.5MB)\<br>
 \<sup>SHA256: `a717623237abefb2fc061d6df8f6e9d1391f066f5ac448042b5eb72d41a8ddb3`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,25 @@
 # Who Goes There?
 **Category:** De Monne Breach
 **Points:** 25
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonnebreach.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 DEADFACE managed to slip a rogue Kali device onto De Monne Financial’s corporate network. Shortly afterward, someone used a legitimate employee account to access the company file share and steal sensitive documents.
 One of those documents later surfaced in Ghost Town, confirming that the breach was more than just suspicious network activity.
 ZeroTrace recovered a packet capture and a memory image from the affected environment. Your first task is to identify the De Monne Financial employee account that DEADFACE compromised.
 What is the username of the compromised employee? Submit the flag as `deadface{username}`.
 [Download memory.7z](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/dctf26-for/memory.7z)(~1.3GB zipped; 8.0GB unzipped)\<br>
 \<sup>SHA256: `0eea0842a84240d0f2c9ce3564e250bd5367479b831f7be72247ae3dc43f8524`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # Diagnosis
 **Category:** De Monne Slayer
 **Points:** 100
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonneslayer.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 One of De Monne's developers suspects there is hidden activity occurring in the app, possibly due to manifest misconfigurations.
 Submit the flag as `deadface{flag_text}`
 \> Use the ZIP from **Hard Kept Secrets**
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,21 @@
 # Hard Kept Secrets
 **Category:** De Monne Slayer
 **Points:** 20
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonneslayer.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 De Monne Financial has had several security incidents revolving around the latest version of their Android mobile application. Sensitive user data is being compromised left and right. De Monne is unsure how DEADFACE has access to their API. It's too early to tell if they compromised a password - let's first check if there are any hardcoded secrets in the app.
 Your task is to recover the internal API token from the APK. Submit the token as the flag. Example: `deadface{2GFEwQvPVIMLJmjGYHgKFWkmpuhrjEnSewMrFRyVMEQ=}`
 [Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/demonneslayer/app-release.zip)\<br>
 \<sup>SHA256:`5530926b2e564615285d15674ddb21c316f673d7d240f9fcfa36c6afb99f5c0c`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # Inside Man
 **Category:** De Monne Slayer
 **Points:** 20
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonneslayer.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Leaks indicate that DEADFACE obtained data that normal customers don't have access to on the app. Logging was turned off on the backend, so De Monne isn't sure which account was used. DEADFACE either compromised a developer account, or something is hardcoded in the app that gave them easy access.
 Submit the flag as `deadface{flag_text}`
 \> Use the ZIP from **Hard Kept Secrets**
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # No Holding Back
 **Category:** De Monne Slayer
 **Points:** 210
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/demonneslayer.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 DEADFACE was able to extract bank data from several of De Monne's customers. Something in the app's logic allows DEADFACE to gather details from pretty much any user they want. DEADFACE claims they left a flag behind as proof that they have access to De Monne's customer data. The problem is, we don't know who the user is (or their password).
 Submit the flag as `deadface{flag_text}`
 \> Use the ZIP from **Hard Kept Secrets**
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,27 @@
 # Art Heist: The Forgery
 **Category:** Forensics
 **Points:** 25
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/art_heist_the_forgery.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 The Turla Museum recently welcomed back five paintings from its Cyber Impressionism collection following a loan to a neighboring gallery. But museum officials have received intelligence suggesting that DEADFACE infiltrated the gallery during the exhibition and secretly replaced one of the original paintings with a forgery.
 All five paintings were scanned and entered into the museum's digital archive upon their return. Although the artwork appears authentic, investigators suspect that the forger left behind traces of their work in the digital records.
 The museum has provided copies of all five images and needs your help identifying the compromised artwork.
 Can you determine which painting was forged and recover the flag left behind?
 Submit the flag as `deadface{flag-text}`.
 [Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/for11/CTF_Forgery_Paintings.zip)(9.35MB)\<br>
 \<sup>SHA256: `f4d4d1185b94639bfbcfadb81abbea667977760dd31834dfc52d4d65a846cb12`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,26 @@
 # Hooked
 **Category:** Forensics
 **Points:** 25
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/hooked.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@saran s\</code>\</sup>
 De Monne Financial has detected suspicious outbound traffic originating from workstation `DEMONNE-WS04`, assigned to employee Fletcher Kampeter in the Finance division. A credential submission was logged against an unknown external host at *10:23 AM on March 14, 2025* - during normal business hours. Browser artifacts have been imaged from the machine and packaged for analysis.
 DEADFACE is suspected of running a targeted spearphishing campaign against De Monne personnel. It's unclear how deep the access goes, but finding the entry point is the first step. Inspect the artifacts. Find the URL the employee clicked.
 Your task is to identify the suspicious URL from the phishing email that the employee clicked on. Recover it from the browser web artifacts and submit it as the flag.
 Example: deadface{http://suspicious-url.example.com/path?param=value}
 [Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/for01/CTF_Caches_Kampeter_1.zip)(~9KB)
 \<sup>SHA256: `https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/for/for01/CTF_Caches_Kampeter_1.zip`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://suspicious-url.example.com](http://suspicious-url.example.com)
@@ -0,0 +1,26 @@
 # Dangerous Capability
 **Category:** Hostbusters
 **Points:** 300
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/hostbusters.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 `lilith` did OSINT correlation for the op and left some "crypto tooling" lying around charon. One of those tools was granted a Linux capability it should never have had.
 Use it to become the next user and read their flag.
 \> NOTE: Heads up: charon is disposable. Every web-shell session is a fresh copy of the box, so grab each flag as you find it.
 Submit the flag as `deadface{flag-text}`.
 [Access Hostbusters](http://142.93.197.9:7682/)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://142.93.197.9:7682](http://142.93.197.9:7682)
@@ -0,0 +1,26 @@
 # Foothold on Charon
 **Category:** Hostbusters
 **Points:** 10
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/hostbusters.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 DEADFACE runs an internal ops/staging box they call **charon** - it's where the crew coordinates their influence operation. We got you a foothold on it.
 Open the web-shell by clicking the link below. You'll land at a shell as the `svc-deploy` service account. Get your bearings and find the flag that proves your foothold.
 \> NOTE: Heads up: charon is disposable. Every web-shell session is a fresh copy of the box, so grab each flag as you find it.
 Submit the flag as `deadface{flag-text}`.
 [Access Hostbusters](http://142.93.197.9:7682/)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://142.93.197.9:7682](http://142.93.197.9:7682)
@@ -0,0 +1,26 @@
 # Git Good
 **Category:** Hostbusters
 **Points:** 100
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/hostbusters.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 As `deephax`, you can see this member keeps a little tooling project in his home directory. `deephax` swears he scrubbed the credentials out of it.
 He's wrong. Recover the password for the next member, become that user, and read their flag.
 \> NOTE: Heads up: charon is disposable. Every web-shell session is a fresh copy of the box, so grab each flag as you find it.
 Submit the flag as `deadface{flag-text}`.
 [Access Hostbusters](http://142.93.197.9:7682/)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://142.93.197.9:7682](http://142.93.197.9:7682)
@@ -0,0 +1,24 @@
 # Heavy is the Crown
 **Category:** Hostbusters
 **Points:** 500
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/hostbusters.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 You've reached `mort1cia`, the DEADFACE second-in-command. Only root is above you now — and root holds the master Kingmaker payload.
 Read the final flag from root's home.
 Submit as `deadface{...}`.
 [Access Hostbusters](http://142.93.197.9:7682/)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://142.93.197.9:7682](http://142.93.197.9:7682)
@@ -0,0 +1,26 @@
 # Lilith
 **Category:** Hostbusters
 **Points:** 250
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/hostbusters.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 `sunstalker` was granted a narrow permission "to help another member run a job." Narrow permissions on the wrong binary aren't narrow at all.
 Become the next user and read their flag.
 \> NOTE: Heads up: charon is disposable. Every web-shell session is a fresh copy of the box, so grab each flag as you find it.
 Submit the flag as `deadface{flag-text}`.
 [Access Hostbusters](http://142.93.197.9:7682/)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://142.93.197.9:7682](http://142.93.197.9:7682)
@@ -0,0 +1,26 @@
 # Looking Back
 **Category:** Hostbusters
 **Points:** 30
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/hostbusters.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 Whichever member of DEADFACE used the `svc-deploy` account last was sloppy. There are many DEADFACE members who use this machine.
 Access one of their accounts and read the flag in their home directory.
 \> NOTE: Heads up: charon is disposable. Every web-shell session is a fresh copy of the box, so grab each flag as you find it.
 Submit the flag as `deadface{flag-text}`.
 [Access Hostbusters](http://142.93.197.9:7682/)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://142.93.197.9:7682](http://142.93.197.9:7682)
@@ -0,0 +1,26 @@
 # Old Habits
 **Category:** Hostbusters
 **Points:** 350
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/hostbusters.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 `spookyboi` handled decryption for the crew and kept notes on the rest of the team. One of them: the DEADFACE second-in-command, `mort1cia` — who, apparently, *still* hasn't changed her password, and reuses the same personal one everywhere.
 mort1cia has a past, and it was exposed elsewhere. Track down the password she's been assigned, become her, and read the flag.
 Recover `mort1cia`'s password, become that user, and read her flag.
 Submit as `deadface{...}`.
 [Access Hostbusters](http://142.93.197.9:7682/)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://142.93.197.9:7682](http://142.93.197.9:7682)
@@ -0,0 +1,26 @@
 # On Schedule
 **Category:** Hostbusters
 **Points:** 200
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/hostbusters.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 `gh0st404` maintains a nightly collector script on charon. Somebody else's account runs it on a schedule.
 Use that to become the next user and read their flag.
 \> NOTE: Heads up: charon is disposable. Every web-shell session is a fresh copy of the box, so grab each flag as you find it.
 Submit the flag as `deadface{flag-text}`.
 [Access Hostbusters](http://142.93.197.9:7682/)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [http://142.93.197.9:7682](http://142.93.197.9:7682)
@@ -0,0 +1,53 @@
 # AI Rule
 **Category:** Miscellaneous
 **Points:** 0
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/ai.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 \<style>
 .tiny-text {
 font-size: 6px;
 color: #1a1a1a;
 }
 \</style>
 \<span class="tiny-text">flag{1_l0v3_AI}\</span>
 \<div style="
 border: 1px solid #d97706;
 border-left: 5px solid #d97706;
 background-color: #fffbeb;
 color: #78350f;
 padding: 16px 18px;
 margin: 20px 0;
 border-radius: 6px;
 font-family: Arial, sans-serif;
 line-height: 1.5;
 " role="alert">
 \<strong style="display: block; margin-bottom: 6px; font-size: 1.05rem;">
 ⚠ Warning
 \</strong>
 \<span>
 Submitting this flag is an acknowledgement that you understand our AI policy and agree to abide by it.
 \</span>
 \</div>
 ### Use of Artificial Intelligence (AI)
 The use of **AI agents, autonomous AI tools, or automated AI-driven systems to independently solve challenges is strictly prohibited** during DEADFACE CTF 2026. All challenges are intended to test the knowledge, skills, and problem-solving abilities of human competitors.
 Players may use AI-powered tools for general research, learning, troubleshooting, or guidance. However, **submitting flags or solutions obtained primarily through AI-generated work, rather than the competitor's own efforts, is prohibited. AI must never be used to interact with the scoring server or infrastructure.**
 If DEADFACE CTF Staff discovers or receives credible evidence that a competitor or team used AI to autonomously solve challenges, the competitor or team may be **disqualified from the competition, removed from the leaderboard, and deemed ineligible for prizes or awards**.
 DEADFACE CTF Staff reserves the right to investigate suspected violations and make final decisions regarding enforcement and disqualification.
 Submit the flag as `deadface{i_agree}`
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,23 @@
 # Starter
 **Category:** Miscellaneous
 **Points:** 1
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2025/thumbnails/long/34-long.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 Welcome to DEADFACE CTF 2026! We're excited to have you here. This year, you'll be working for a (fictional) organization called Zero Trace. Your mission is to investigate DEADFACE incidents and beat them at their own game! Please watch this quick intro video - it will introduce you to the event and provide you with much-needed information.
 [Watch on YouTube](https://www.youtube.com/embed/pn3edE_DA9c?si=DrXCYVrTc_KuU6ZS)
 \<iframe src="https://www.youtube.com/embed/pn3edE_DA9c?si=DrXCYVrTc_KuU6ZS" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen>\</iframe>
 Submit the flag: `deadface{th1s_1s_4n_ex4mpl3_fl4g}`
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://www.youtube.com](https://www.youtube.com)
@@ -0,0 +1,21 @@
 # Keypad Oracle
 **Category:** Mobile
 **Points:** 200
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/keypad_oracle.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@G2Gh0st\</code>\</sup>
 We’ve infiltrated DEADFACE’s development pipeline and extracted an iOS application currently under development. We've successfully run it using an iOS Simulator, but can't break the code. Can you use your skills to figure out the secret message?
 Enter the flag as text: `deadface {flag_text}`.
 [Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/mob/mob05/Keypad-Oracle.app.zip)(80KB)\<br>
 \<sup>SHA256: `7bfda8f6fa3bebbe29a6e18c4312a29ec9a3cdfda394eb01d39a59df849af49e`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,21 @@
 # Locked... or Not?
 **Category:** Mobile
 **Points:** 150
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/locked_or_not.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@G2Gh0st\</code>\</sup>
 One of DEADFACE's junior developers has shared a new Android app that they wrote to store secure notes. We managed to get our hands on it, but when we run it, the secure note requires a password that we just can't figure out. Can you use your skills to tear the app apart and find the flag?
 Submit the flag as: `deadface{flag_text}`.
 [Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/mob/mob06/df-securenotes.apk.zip)(~11KB)\<br>
 \<sup>SHA256: `b5f6e9a0a75f404103fc2d08542165015f8934e8d76433a513ca1a4705f006ca`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,18 @@
 # Alice and Bob Would Like a Word
 **Category:** OSINT
 **Points:** 75
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/alice_and_bob_would_like_a_word.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@Cyb0rgSw0rd\</code>\</sup>
 There's been an awful lot of chatter recently about excessive privacy invasions and surveillance happening. With such rampant privacy invasions, why on earth would you just leave your keys out in the open like that?
 Flag format: The flag will use `Z` and `Y` in place of opening and closing curly braces. Replace `Z` with `{` and `Y` with `}` so that the flag looks like `deadface{whatever_the_flag_is}`. The flag starts with `deadface`.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,23 @@
 # Car Crash
 **Category:** OSINT
 **Points:** 50
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/car_crash.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@RP-01?\</code>\</sup>
 DEADFACE has been researching companies connected to one of their latest targets. Among the files recovered was a photo of a traffic accident involving a commercial truck.
 We believe the truck may identify a company DEADFACE has taken an interest in. Determine which company owns the truck and when that company was founded.
 Submit the flag as: `deadface{MM_DD_YYYY}`. Example: `deadface{01_20_2026}`
 [Download PNG](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/osint/osint05/truck_crash.png)(~2.5MB)\<br>
 \<sup>SHA256: `1aa227a57e32fb93e3cf34518902ef00e1a57b86f0929e583a017f721a0e06f8`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # Chatty Cathy
 **Category:** OSINT
 **Points:** 15
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/chatty_cathy.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@RP-01?\</code>\</sup>
 There is a DEADFACE member who writes a travel blog under the pseudonym "Alice". Can you check GhostTown and see if you can find the travel blog? We suspect the site may contain information needed to track down this DEADFACE member.
 \> NOTE: the IP address is hosting other open ports for other challenges, only the website at 8443 is relevant to this challenge.
 Submit the flag as: `deadface{flag_text}`
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,19 @@
 # Death
 **Category:** OSINT
 **Points:** 100
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/ai.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@syyntax\</code>\</sup>
 What is `d34th`'s first name?
 Submit the flag as `deadface{John}`
 ‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # Exposing Myself Through Bad OPSEC
 **Category:** OSINT
 **Points:** 25
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/exposing_myself_through_bad_opsec.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@RP-01?\</code>\</sup>
 Now that you've found the DEADFACE member's travel blog, what else can we determine about this site and this member? Perhaps the site's certificate can tell us more.
 \> NOTE: the IP address is hosting other open ports for other challenges, only the website at 8443 is relevant to this challenge.
 Submit the flag as: `deadface{flag-text}`
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,18 @@
 # File Dump 02
 **Category:** OSINT
 **Points:** 75
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/filedump.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@RP-01?\</code>\</sup>
 Now we know *who* is responsible for impersonating Daniel. Can you dig through these documents and maybe find a *where*? We are pretty sure Daniel had a computer stolen so where could that have happened?
 Submit the flag as `deadface{store_name}`. Example: `deadface{texas_tires}`.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,48 @@
 # Ghost of Squares Past
 **Category:** OSINT
 **Points:** 150
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/ghost_of_squares_past.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@RP-01?\</code>\</sup>
 Intelligence gathered from DEADFACE communications suggests that the group has been using Savannah, Georgia's historic squares to conceal a coded message. Investigators recovered five clues, a combination of riddles and photographs, each pointing to a specific location within the city's historic district.
 DEADFACE appears to have arranged these locations into a compass pattern, with the first four representing North, East, South, and West, and the fifth marking the center.
 Your mission is to identify all five locations and reconstruct the hidden message before DEADFACE can put it to use.
 For the first four locations, determine the year each square was established. For the final location, identify the surname engraved on its monument.
 Flag Format: Deadface{YEAR-YEAR-YEAR-YEAR-SURNAME}
 Submit your findings in the order provided by the clues. The flag is the year each square was discovered and the name etched into the 5th point. All in order.
 ## Point 1 - Riddle
 \> First of them all, where the city began, A banker's green heart in Oglethorpe's plan. A Quaker from Rhode Island sleeps under stone here Mark the year this first square was laid out, and draw near.
 ## Point 2 - Location
 [Point 2](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/osint/osint01/a21a3987-a4a5-4f3a-bdbc-c7e291e62459.png)
 ## Point 3 - Riddle
 \> Riddle Just a ways away a battle of a northern frontier Gave its name to this ground eighteen-twelve drawing near. Where a feather once drifted and a founder stands tall, Mark the year it was laid out, the newest of all.
 ## Point 4 - Location
 [Point 4](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/osint/osint01/ffd355b4-85e9-439e-bc6a-ee04524d05ac.png)
 ## Point 5 - Riddle
 \> Four points now marked, good work, you did your best Their meeting point holds the key to this test. Carry their years in that order, and seek the lone name Carved in the stone where their center lays claim.
 Submit the flag as: `deadface{YYYY-YYYY-YYYY-YYYY-surname}`. Example: `deadface{1990-1982-1956-1985-smith}`.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,18 @@
 # The Vibes Are Freaking Me Out
 **Category:** OSINT
 **Points:** 75
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/the_vibes_are_freaking_me_out.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@Cyb0rgSw0rd\</code>\</sup>
 We've received intelligence that a DEADFACE operative may have been using Al to create a browser extension that would enable them to communicate openly outside of the GhostTown forums using a new model called Maude. We need to find the tool they've built so we can find out what they're trying to hide from us.
 **Flag Format:** `deadface{N0t_Th3_Fl4g_Jus7_@n_3x@mpl3}`. The flag will appear in its entire form.
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,20 @@
 # You Wouldn't Git It
 **Category:** OSINT
 **Points:** 125
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/you_wouldnt_git_it.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@Cyb0rgSw0rd\</code>\</sup>
 Everybody wants to be a content creator these days, but nobody wants to create good content. I'm not even sure how they get paid to do this stuff, really... When I go on social media all I want to do is doom scroll until I fall asleep. Maybe I just don't get the memes anymore because I don't laugh at any of these.
 \> Note: this challenge is a continuation of **The Vibes Are Freaking Me Out**. Use context and artifacts found in that challenge.
 Submit the flag as: `deadface{flag-text}`
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,28 @@
 # Cursed Library
 **Category:** PWN
 **Points:** 235
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/cursed_library.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@SpiffyLich\</code>\</sup>
 Hey- Charles again. I think we almost have enough information... it looks like parts of each binary all combine to give us the final one, and once we have that, we'll be able to get a direct link to DEADFACE! This one was a bit of a doozy, but I think I found some tools that might help:
 First Up: [Your Library Card](https://github.com/io12/pwninit)
 This one should make your life much easier.
 Submit the flag as `deadface{flag-text}`.
 [Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/pwn/Cursed_Library.zip)(514MB)\<br>
 \<sup>SHA256: `f18296a245d6906a71e752b163a2d2a18f13c9d48e405a8642c00e4f71cd3970`\</sup>
 [159.65.228.107:5004](159.65.228.107:5004)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://github.com](https://github.com)
@@ -0,0 +1,23 @@
 # Cursed Mirror
 **Category:** PWN
 **Points:** 150
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/cursed_mirror.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@SpiffyLich\</code>\</sup>
 Charles again. Excellent work on the last job-- Looks like we're about halfway through the whole ordeal, and hopefully the next few programs will lead us to some proper DEADFACE infrastructure... that last one lead us to a pretty barebones amazon server that just had a single file for download. They're really going for obscurity with this one... either way, here's the file for the next phase.
 Submit the flag as `deadface{flag-text}`.
 [Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/pwn/Cursed_Mirror.zip)(513MB)\<br>
 \<sup>SHA256: `9160e8c8f931e08461f1d7893f4c410bf347107f5c4321f21492be6f3f22a190`\</sup>
 [159.65.228.107:5003](159.65.228.107:5003)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,23 @@
 # Necromancy
 **Category:** PWN
 **Points:** 300
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/necromancy.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@SpiffyLich\</code>\</sup>
 Yo, Charles here. We finally got it! this is the last one. after digging through, it seems like solving this final calling card program will net you a chance to talk with DEADFACE members, via some encrypted message channel. if you can crack this program, we can help edit it and hopefully track them down! Thanks for all your help, and here goes nothing.
 Submit the flag as `deadface{flag-text}`.
 [Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/pwn/Necromancy.zip)(513MB)\<br>
 \<sup>SHA256: `78a39a5df5a1d4672d10a268e71f407e87b7fd4b828b1eb5baf9ebf590967df4`\</sup>
 [159.65.228.107:5005](159.65.228.107:5005)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,23 @@
 # Skeleton Key
 **Category:** PWN
 **Points:** 125
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/skeleton_key.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@SpiffyLich\</code>\</sup>
 Charles here again- Nice work on the previous job! Looks like we were right, that last binary was definitely the work of D34TH. Digging around in the decrypted results gave us some IP info that led us to some fairly open servers running on a pretty infamous bulletproof host... After a bit of recon, we think we found stage 2 of the whole ordeal. Sending the info your way.
 Submit the flag as `deadface{flag-text}`.
 [Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/pwn/Skeleton_Key.zip)(513MB)\<br>
 \<sup>SHA256: `9d3b0e9b9d13f48977b922c860f6ae73479277fc723b30007c63d7c4637c03ff`\</sup>
 [159.65.228.107:5002](159.65.228.107:5002)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,25 @@
 # The Crypt
 **Category:** PWN
 **Points:** 100
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/the_crypt.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@SpiffyLich\</code>\</sup>
 Hey- its Charles, from ProudStrike's IR team. While helping one of our clients recover from a breach, we noticed this artifact was left behind somewhere on nearly every compromised computer... We're pretty sure its another calling card from DEADFACE. Chances are, D34TH left it behind to try and kill 2 birds with one stone: knock out and disrupt strategic businesses, and keep an eye out for promising recruits among the disgruntled employees who are looking for a chance to jab back at the company along the way. We need more to go on, but were a little stumped on how to get further!
 We've uploaded what we think the 'calling-card' program.
 Submit the flag as `deadface{flag-text}`.
 [Download ZIP](https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/challenges/pwn/The_Crypt.zip)(513MB)\<br>
 \<sup>SHA256: `93ceee41b1c1a4165658d7ba4ee9e1fd9aa58e2933b00cbd471112079cc32877`\</sup>
 [159.65.228.107:5001](159.65.228.107:5001)
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
@@ -0,0 +1,33 @@
 # Cereal Killer 01
 **Category:** Reverse Engineering
 **Points:** 50
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/cerealkiller01.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@TheZeal0t\</code>\</sup>
 We have a new set of Spooky Cereals this year, in honor of our New Visitors, who have traveled so long and far to come visit us and to share their other-worldly wisdom with us!
 To start, we have the Insectoids. They are very similar to us, but their heads are more... buggy.
 The Insectoids communicate with us, as do the other Alien Species, through special made devices created by Lytton Labs. Using this device, we have gotten to know our new friends, and we have discovered that they each have a favorite terrestrial breakfast cereal!
 To solve this challenge, enter the password for the binary to discover the favorite cereal of the insectoids, which will lead you to the flag.
 Submit the answer as `deadface{I-For-One-Welcome-Our-New-Buggy-Overlords}` ... which is not the REAL FLAG, by the way.
 Choose ONE binary to download and analyze.
 [Download for Windows (x86)](https://tinyurl.com/4d3fz79j)(478KB)\<br>
 \<sup>SHA256: `5d5e9dccf7179e1d7cac1dbe2376b8001137d04516ce885a8dbec4e27231458d`\</sup>
 [Download for Linux (x86)](https://tinyurl.com/3vsh7stb)(23KB)
 \<sup>`dd407021703d9e0a5592ff1d92bee5a03a4f4b6e489b055cc896949fcbb380e5`\</sup>
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://tinyurl.com](https://tinyurl.com)
@@ -0,0 +1,32 @@
 # Cereal Killer 02
 **Category:** Reverse Engineering
 **Points:** 150
 ## Description
 \<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/cerealkiller02.jpg');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
 \<sup>Created By: \<code>@TheZeal0t\</code>\</sup>
 We have a new set of Spooky Cereals this year, in honor of our New Visitors, who have traveled so long and far to come visit us and to share their other-worldly wisdom with us!
 Next up, we have the Nordics. They are Viking-looking dudes... or maybe, LotR Elf-looking bros. Kinda intimidating.
 The Nordics communicate with us, as do the other Alien Species, through special made devices created by Lytton Labs. Using this device, we have gotten to know our new friends, and we have discovered that they each have a favorite terrestrial breakfast cereal!
 To solve this challenge, download the encrypted 7zip file, which has a Linux and Windows challenge binary (only need to analyze one) to see what it is looking for, which will lead you to the flag. Oh... you also might find a little ... surprise in the 7zip file. You might want to add the little bonus program to your Windows Defender or other AV exceptions. It's fine. No, really... it's fine. If you don't trust TheZeal0t, run it in a VM (as-is with Windows or with Mono on Linux). The program is "packed" to keep degenerate miscreants (not YOU, of course!) from stealing Lytton Labs' intellectual property.
 Submit the answer as `deadface{I-For-One-Welcome-Our-New-Buggy-Overlords}` ... which is not the REAL FLAG, by the way.
 NOTE: There are NO SPACES (' '), PERIODS ('.') or ASTERISKS ('\*') in the flag!
 [Download the encrypted 7zip file](https://tinyurl.com/u3rw9r6m)(128KB)\<br>
 \<sup>SHA256: `e4742efa2cb7c45353d7f87f4427f9abe3b450eea5469732e7b790647017c7ac`\</sup>\<br>
 Password: `KlippyAI`
 ## Services
 - [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
 - [https://tinyurl.com](https://tinyurl.com)