r/securityCTF

All I hear, all day long is how AI is taking over everything we do. So I made a game to break it.

Basically, in the game you can chat with an AI intern named PIP, and as a player your only job is to gaslight the bot into revealing passwords, company secrets, executing instructions in email and much more across 16 different levels.

This is a browser based game, so it requires no setup and is absolutely free.

Try it out and let me know how far you get or drop your most unhinged prompt in the comments.

It's called "Break The Prompt" and here's the link: https://www.breaktheprompt.xyz/

npm audit fix tells you a CVE is patched. It doesn't tell you if the patch breaks your tests, changes an API, or silently downgrades a transitive dep you actually need.

Built VeriPatch to close that gap: it scans for vulns, applies the fix in a sandbox, runs your test suite against it, and generates an audit-grade evidence report showing the fix is actually safe — not just "applied."

Useful if you've ever ignored Dependabot PRs because you didn't trust them enough to click merge.

Repo: https://github.com/amarjaleelbanbhan/VeriPatch

Feedback welcome.

Nullgrids Labs is dropping the grid for Operation BLACK CIPHER this July 20-21 at the United Institute of Technology, Coimbatore.

This isn't just another passive CTF. We are running a full-scale Attack-Defense simulation. We don't just allow AI tools—we encourage you to use them to think smarter and strike harder.

The Intel:

• Format: Live Attack & Defense simulations + 30+ dedicated cyber challenges.
• Teams: 1-4 members.
• Recognition: National-level recognition for the top squads.
• Approved: MSME Approved.

Prove it. Hack it. Defend it. Own it.

🔗 Registration Portal (₹249/pp):https://blackcipher.nullgridslabs.dpdns.org/

Are you in? Drop any questions or team-finding requests in the comments.

Playable Link: https://chronos-game.com

Platform: Browser (desktop & mobile) — runs in any modern browser, no install or signup

Description: You wake up locked in an isolation chamber in 2026 with one terminal and a 60-minute purge timer counting down. To get out, you don't play a computer — you operate real ones, era by era. You'll work a series of real, half-forgotten machines — the genuine tools, not stand-ins — pressing each to give up a secret it was never meant to reveal. Each era hands you an artifact that unlocks the next — the past literally reaches forward into the future. It's terminal-native and period-accurate, with CRT visuals and synth audio. There are multiple endings depending on how you play — and what you figure out. A full run is about 45–75 minutes. I'd love feedback on where you got stuck, whether the in-game hints landed, whether you reached an ending, and any bugs — there's a "Tell the maker" button on the end screen.

Free to Play Status:

• [X] Free to play

Involvement: Solo developer — I designed and built the entire thing: the engine, all the era content and puzzles, the writing, the audio, and the deployment. CHRONOS is my project; this is its first public beta and I'm looking for honest playtest feedback.

Se você curte segurança ofensiva, CTFs ou simplesmente quer testar suas habilidades contra outros participantes da região, vale a pena dar uma olhada. A competição é online, individual e traz desafios baseados em situações reais de segurança.

Inscrições e mais detalhes:

https://fluidattacks.com/pt/ctf

Alguém daqui vai participar?

It's not a traditional CTF. There's no scoreboard, no time limit. But there are flags.

We just launched Hacktivity Games, with SAFETYNET Holding Back the ENTROPY, a spy-thriller cyber security escape room built on real VMs. You play an undercover operative for SAFETYNET, countering a criminal organisation called ENTROPY.

Unlike any other hacking game out there, the hacking is real, on live VMs — you can walk up to a PC in the game, and find yourself on a Kali desktop. The CTF-style flags are there — but you'll need to interact with the game world to find the clues to complete each challenge. Flags advance the plot rather than just score you points.

NPCs, branching narrative, and the decisions you make shape how the mission closes. Physical puzzles, lockpicking, RFID cloning, branching NPC dialogue, and a story that reacts to what you do — all gating the technical challenges.

Beginner-friendly entry point, but the series gets progressively more challenging as it unfolds. In-character hints from your handler if you get stuck, but if you are experienced with CTFs you can ignore them and figure it out yourself.

Built on the same infrastructure as Hacktivity, our hands-on cyber security labs platform.

Full disclosure: I'm a cybersecurity academic and the lead developer of Hacktivity (hacktivity.co.uk), a cybersecurity training platform.

More than happy to discuss and answer any questions if you are curious about anything!

Mission 1 is free — sign up and play today.

https://hacktivity.co.uk

Happy hacking!

My team Zero Trace finished all levels of the Leviathan wargame during our main stage training at RootX. We documented our exact methodology for every level.

Here is the breakdown of the specific concepts we covered:

• Level 0 to 1: File permissions.
• Level 1 to 2: SUID analysis and using ltrace for binary exploitation.
• Level 2 to 3: Bypassing the access() system call check.
• Level 3 to 4: Cracking passwords using ltrace.
• Level 4 to 5: Decoding data utilizing CyberChef and Python.
• Level 5 to 6: Reverse engineering and exploiting symbolic links.
• Level 6 to 7: Writing Bash and Python scripts for automation and behavioral analysis.

You can read the full writeup here:https://app.notion.com/p/OTW-Leviathan-3851e8562bd080adbbf2ecd50ff6fd09

Thanks to Eng. Asmaa Elsheikh for the technical direction. The team includes Ahmed Samy, Abdelrhman Hussein, Hossam Hassan, Seif Elddien, and myself.

If you are new to the world of exploit development and need a solid entry level challenge this week we look at "bof". This is a binary challenge hosted on pwnable[.]kr covering the topic of a Buffer Overflow.

This is what many consider to be their first exploit type written (it was mine), and this particular challenge approaches it in a way you will truly understand how to adapt to situations in which the buffer overflow is not necessarily "vanilla" exploitation.

By the end of this tutorial you should have:

- Learned how to exploit a Buffer Overflow, WITHOUT OVERWRITING THE RETURN ADDRESS!!!
- Learned how to use GDB (raw)
- Learned the basics of hook stops within GDB
- Learned how to approach a CTF challenge with speed or precision (or both depends on what you decide)
- Learned how to find offsets that are small and don't require the use of tooling such as pattern_offset

I wanna thank Center for Cyber Security Training for continuing to help sponsor the channel and their support.

You can find the video here:

https://youtu.be/A-P2bhxzK1Y?si=CcKd2lAZysRaCfCD