Standalone CTF Challenges

Welcome to your first Capture The Flag (CTF) challenge! This practice challenge will help you understand how Cyfotok Labs works. Download the attached file, inspect its contents, find the flag in the format CYFOTOK{...}, and submit it in the flag box. Once you submit the correct flag, you'll earn your first points and be ready to tackle real cybersecurity challenges. Good luck, and welcome to your cybersecurity journey! 🚀

During a routine investigation, your team intercepted a short digital radio transmission sent between two unknown systems. The message wasn't encrypted using any advanced algorithm—it was simply converted into binary before transmission. Your task is to analyze the intercepted data, determine the encoding method, and recover the hidden flag.

The final transmission from the Mars rover was received just before communication was lost. Unfortunately, the message appears scrambled. Mission engineers believe the rover's communication system used a very old encoding method where every letter was shifted by the same amount before transmission. Can you recover the original message and retrieve the flag? Every letter moved just a little to the left.

A system administrator stored an internal access note using a simple substitution cipher. During a security assessment, you recovered the encrypted message, but the key used for encryption was not included. The administrator relied on a Caesar Cipher, assuming that shifting each letter by a few positions would be enough to protect the information. Analyze the encrypted text, determine the correct shift value, and recover the hidden flag.

A backup server from a compromised bank contained a strange internal note. The note doesn't look encrypted. It just looks... different. It's still just letters — there are just a few more of them, and some equal signs at the end. Can you recover what the vault was hiding?

A missing employee left behind one strange file on an abandoned workstation. Investigators recovered a small program that asks for a four-digit case code. The correct code supposedly unlocks the employee's final note. "Some locks aren't meant to be picked. They're meant to be tried, over and over, fast."

A declassified diagnostic utility from an abandoned military archive accepts a message and prints it back to the operator. The program appears harmless. Some functions repeat back more than you gave them.

A cached thread from an underground city forum was recovered after the network went offline. Most of it is completely uninteresting — users arguing about food prices, power cuts, and broken vending machines. But the archive is slightly larger than it should be. Something is hidden in plain sight, but you'll never see it.

A drone enthusiast uploaded an aerial photograph while bragging about discovering an incredible "secret" flying spot. The post never mentions where the photograph was taken. But the image contains something the pilot probably forgot about. The sky may hide the pilot. The ground gives away the location.

A smart home company abruptly recalled its companion Android app after customers reported "unexpected behavior." The official explanation blamed a firmware issue. Security researchers weren't convinced. Someone managed to save the last APK before it disappeared from the app store. Can you discover what the developers forgot to remove? Hint: Decompiled code still remembers what it used to say.

A decommissioned server sat untouched in storage for nearly a decade before investigators created a forensic image of its desktop. Most of the files are routine maintenance documents. One encrypted archive, however, appears to contain the only remaining backup of an internal project. The archive is password protected. Investigators believe the system administrator wasn't particularly creative when choosing passwords. The key to the box was never far from the box.

Digital archivists recovered only part of a technology forum that disappeared in 2006. One discussion mentions Project Oracle, a mysterious internal project that supposedly never existed. The thread looks ordinary...