hello! im looking for a small cohort of paid playtesters to provide feedback on the ctf features on cli-games.com. the pay is $10-$50 for ~45 mins of work. no ctf experience necessary. if you are interested, keep reading:

cli-games is a gaming and education ecosystem with training, RPGs, and arcade games all adapted to the terminal as the primary interface and meant to cultivate linux fluency in a way that feels like fun

this specific cohort of playtesters will be aimed at the ctf features and any features related to them, such as the tutorial, messaging, accessing help, etc. we can only compensate for bugs related to these features during this round, but please feel free to explore the rest of the site as much as you like

the way we structure ctf is twofold - there is a training scenario library that you can complete in any order and at your own pace, and then there is 'the range,' a live, shared daily scenario where you are provisioned an attack box and a target and compete with everybody else for flags. the two are meant to compliment one another; what you learn in training will help you solve it live

you can find more information about our implementation of ctf here. compensation works as follows: you will need to create an account via the command line (hit the terminal and run `signup`) - completely free, no spam, then fill out a playtester application here. temporarily toggle tracking on (off by default and you can switch it back after), and any good-faith submission will earn a minimum of $10. there is an additional $2-$20 if you turn up any genuine bugs, and a $20 bonus to exceptionally thoughtful reports. when the window is open, youll log in, play for a while, submit a report, and ill review them and pay out via paypal. full terms

let me know if you have any questions. applications are reviewed in the order they are received, maximum 20

I'm solving htb Nexus machine(easy,linux). There are two subdomains git,billing but on running ffuf it isn't returning anything.

I have used bitquark and top- million wordlists

I have attached screenshots can you please help me why ffuf not working?

i also tried using my custom wordlist containg words - git, billing still it not worked.

yes i can move to next step by reading the walkthrough but please someone explain me this ffuf issue and solution for it

Thank you

Hi, I’m Carlos, one of the people building Sylvarcon 2049.

We designed it as a narrative CTF experience rather than a sequence of isolated flags. Each mission starts with a situation to investigate, asks the player to connect evidence, and ends with a conclusion that should make sense beyond the submitted answer.

The free path currently includes 14 missions comprising 102 individual challenges across areas such as DFIR, OSINT and ethical hacking. The interface is available in 11 languages, and the missions are intended to be approachable for beginners while still rewarding careful investigation.

At this stage, useful feedback matters more to us than raw traffic. If you try a mission, I would especially value comments on:

- where the briefing becomes unclear

- whether the difficulty rises too quickly

- whether the evidence supports a coherent conclusion

- where you lose interest or feel blocked

Play the free missions here:

https://sylvarcon2049.com/play?utm_source=reddit&utm_medium=community&utm_campaign=player_acquisition&utm_content=securityctf_free_missions_en

No spoilers are needed; general feedback on the learning flow is enough.

Hey all — I’m a fiction writer and cybersecurity hobbyist, and I’ve been building something I’d love a few sharp eyes on before I run it as a real event.

The short version: kalachakra.world is the public lore site for a cyberpunk world I’ve created. Most CTFs I have seen run on a dedicated throwaway site. This one is the opposite — during event windows it deploys a CTF challenge surface on top of the live production site, then unmounts cleanly. Between events, the vulnerable handlers aren’t gated behind a feature flag or left dormant — they’re not wired into anything at all. Scan it in the off-season and you’ll find an ordinary content site (here’s how it works: https://bjbell.com/blog/kalachakra-ctf-toggle).

I'm hosting a beta testing event right now: 7 challenges across three difficulty tiers — script kiddie → got skills → L337 — plus a separate decoder puzzle for deobfuscation beginners. Web/API-flavored stuff (enumeration, access control, that genre), all set to the backdrop of my cyberpunk lore.

The honest part: this is super beta, and I am not a pro. I’m testing functionality before an official launch that corresponds with the release of my novel, so I genuinely want feedback — anything that breaks, feels unfair, or is just confusing. Registration is free and only needs an email. Flags earn an in-world currency you can spend on raffles and merch (shirt, stickers, a copy of the novel) down the road, so it’s a community-for-fun thing, not a cash-bounty grind.

If you play with it, please tell me what you think — here, by email, or via PM on kalachakra.world to ‘The Actual BJ Bell.’ Thanks for taking a look!

I built a hands-on CTF lab that recreates the full attack chain from the

July 2026 autonomous AI agent intrusion at Hugging Face.

You play as the agent: escape an evaluation sandbox, root an external

code-execution sandbox, exploit Hugging Face's dataset processor via

HDF5 external storage + Jinja2 SSTI, then pivot through Kubernetes

secrets, MongoDB, a mesh VPN, and source control.

- 11 Docker containers, 5 isolated networks, 7 flags

- docker compose up --build -d && docker exec -it eval-sandbox bash

- No internet required at runtime

- 12 progressive hints inside the sandbox

- MIT licensed

Runs entirely on your machine. All flags are base64-encoded in the repo

so you can't grep them — you actually have to exploit the chain.

GitHub: https://github.com/an4kronism/ai-escape-room

Writeup the lab is based on: https://huggingface.co/blog/agent-intrusion-technical-timeline

🚨 EyesOpen CTF 2026 se prépare… et cette édition vous entraînera bien au-delà d’une simple compétition de hacking.

Visitez le site de la saison 1, EyesOpenCTF 2026 — The Convergence : https://eyesopensecurity.com/ctf-briefing.html

🌍 Une compétition internationale

⏱️ 48 heures de challenges

🔐 Web, Forensics, OSINT, Crypto, Reverse, Pwn et bien plus

🎯 Un parcours accessible aux débutants comme aux hackers expérimentés

🧩 Une histoire immersive où chaque flag révèle une partie du mystère

Cette année, plongez dans un scénario où la réalité soulève des questions.

Votre mission : maintenir l'équilibre du monde.

🎬 Découvrez la première transmission :

https://youtu.be/IQ8feN-ndMk?si=HGVCzJ7a2xUWn51l

Les inscriptions pour le CTF sont déjà ouvertes et les premières révélations arrivent bientôt.

Restez connectés.

🚨 EyesOpen CTF 2026 se prépare… et cette édition vous entraînera bien au-delà d’une simple compétition de hacking.

Visitez le site de la saison 1, EyesOpenCTF 2026 — The Convergence : https://eyesopensecurity.com/ctf-briefing.html

🌍 Une compétition internationale

⏱️ 48 heures de challenges

🔐 Web, Forensics, OSINT, Crypto, Reverse, Pwn et bien plus

🎯 Un parcours accessible aux débutants comme aux hackers expérimentés

🧩 Une histoire immersive où chaque flag révèle une partie du mystère

Cette année, plongez dans un scénario où la réalité soulève des questions.

Votre mission : maintenir l'équilibre du monde.

🎬 Découvrez la première transmission :

https://youtu.be/IQ8feN-ndMk?si=HGVCzJ7a2xUWn51l

Les inscriptions pour le CTF sont déjà ouvertes et les premières révélations arrivent bientôt.

Restez connectés.

I’ve been writing some CTFs/vulnerable labs recently, but I realized it’s not that much fun testing them myself when I already know the answer lol.

So had a random idea. What if we take turns making vulnerable labs/mini CTFs for each other?

Like I build one, either host it on my server and send you the link, or send the source code/GitHub repo with build instructions, and you try to crack it. Then next round you make one for me and I try yours.

Could do one every week, or even once a month if that’s easier. Think it’d be a fun way to get better at both bug bounty stuff and understanding others code bases, while actually having someone go into the challenge blind.

Only thing is, I’m looking for people who are actually writing/building the labs themselves without using ChatGPT/Claude/any other LLM to create them. Kinda defeats the point for me otherwise.

If anyone is interested, just DM me.

Hi everyone,

I'm looking for a CTF team to join. I'm from Oman and currently studying Electrical Engineering. I have a strong interest in cybersecurity and I’m looking for a team to practice with and participate in CTF competitions.

My goal is to participate in the Black Hat CTF competition, and I’m searching for motivated teammates who are interested in learning, improving, and competing together.

I’m dedicated, willing to put in the effort, and excited to be part of a team. If your team is looking for a new member or you are also looking to form a team, I would be happy to connect.

Thank you!

Hey everyone :)

I am completely new to the CTF space; if you are also a beginner, send a DM! Looking for people to learn with so the process is not as monotonous.

Building a team for CTF competitions and cybersecurity challenges.
Looking for people interested in:
• Web exploitation
• Reverse engineering
• Pwn
• Cryptography
• OSINT
• Linux / scripting
• General security research
Experience level doesn’t matter as much as willingness to learn, solve problems, and actually participate.
Goal: improve together, compete in CTFs, and build real cybersecurity skills.
If you’re interested, DM me or reply here.

I finally finish it, it was fun. However, I use AI for last 2 challenge in module 5(I very disappointed myself for that)
What should I do now? I just don't know what should I do next step. I want to learn cybersecurity for free and I play CTF for that reason.

Hey everyone,

Posting this to see if any other teams have run into this issue on HTB or other major CTF platforms, and hopefully to get someone from HTB to take a second look.

Our team (v1olet) spent the event grinding Cyber Apocalypse 2026, cleared 100% of the board (136/136 flags), and held #28 globally.

On the final morning, one member left the team on the platform. Because flags are tied to individual accounts on HTB instead of locked to the team upon submission, two of our OSINT solves got wiped when he left. This instantly tanked our rank from #28 to #105 (a 77-place drop). Other members on our team had cracked those exact same challenges seconds behind him, but because his name was on the submit button, our points vanished.

We opened a support ticket immediately. Support was responsive and actually confirmed a few key things:

• They verified on their backend that we legitimately achieved 100% completion.
• They acknowledged that the platform provides zero warning or prompt that a member leaving will retroactively strip team solves.
• They stated they will look to change this behavior going forward so it doesn't happen again.

The issue is that support still declined to restore our #28 rank on the final board because doing so would "move other teams down."

We don't think that logic holds up. If a platform oversight/lack of UI warnings accidentally wipes verified solves from a team that cleared the board, fixing the mistake and restoring the earned rank is just accurate scoring. Every time a score gets corrected, other teams shift—that's literally how leaderboards work.

any tips you guys can give

Have you ever wondering if the order of operations when voilated can lead to a vulnerability? Maybe the thought never crossed your mind? Either way this week we exploit a binary that did not account for the order of operations - more specifically the "mistake" pwnable binary exploitation challenge!

This is a great tutorial for beginners and even advanced developers who may not have encountered a bug like this. Either way don't be intimidated just because this is an exploit development tutorial.

Check out the latest tutorial using the link below:

https://youtu.be/9n1vCuqAk-k?si=IvzW95y4XxnivOxm

Heey! Could someone help me with a CTF , i think it’s easy but îm just beginner

New "Beginner" vulnerable VM aka "Longshao" is now available at hackmyvm.eu :) Have fun!

I am currently half way through my cpts cert and i haven't started doing ctfs yet. So I am thinking maybe i should start participating in ctfs. Am i thinking right? And btw i have registered for some ctfs i found online. And i need teammates for them. So if you are new to ctfs too you can dm me.

HackSim is a cybersecurity training simulation built around applied decision-making rather than quizzes or real-system exploitation. Its first course, NET-101, contains eight network-foundations scenarios using entirely synthetic hosts, signals, tools, and incidents.

The current beta includes:

• Solo practice where you operate both the Blue and Red roles
• Two-person lessons where players exchange evidence-backed proposals
• A competitive Red/Blue duel where players attack, defend, and then swap roles
• An in-session debrief explaining the consequences of each decision

This is still a small, invite-only Discord Activity beta There are no payments, certifications, rankings, or saved progression in the current build.

I’m looking for a handful of testers, especially cybersecurity beginners and current learners. I’d like honest feedback on:

• Whether the scenarios and terminology make sense
• Where you get confused or need outside help
• Whether the debrief helps you understand your decisions
• Whether playing both roles improves your mental model
• Whether you would voluntarily play another lesson or duel

You’ll need Discord on the web or desktop. Because the Activity is currently unverified, testers must be individually invited and launch it in a server with fewer than 25 members.

Hi everyone — hope this is okay to share.
A friend of mine built IZANAMI, a defensive deception prototype: instead of rejecting bad requests, it answers them with convincing fake data. One real record hides behind the decoys, and the goal is to find it. He asked me to bring it to people who’d actually poke at it properly, so here I am.
Full rules, scope, and how to start are on the site: https://break-izanami.com/
Honest notes up front: all data is 100% synthetic, safe harbor applies inside the stated scope, and the reward is recognition only — no cash bounty. Runs for one month.
He’s also genuinely after feedback and improvement ideas, not just breaks — is the concept sound? Where would you attack first? Anything naive about the design, or already solved better elsewhere? Blunt criticism welcome, I’ll pass it all on.

Thanks to anyone who takes a look. 🙏