Warm-up
Everything starts somewhere. Decode this string.
⚠ Rules — honor code, strictly enforced
- No AI. No ChatGPT, Claude, Copilot, Gemini or any model to find, decode, explain or hint a flag. That defeats the entire point.
- No shortcuts. Don't look up, share, or ask anyone for flags or write-ups. Solve it yourself.
- Tools, not answers. Use the toolbox below and your own analysis —
strings,python3, a hex editor, your brain. - Flags are case-sensitive, format
KBS{…}. The certificate at the end certifies that you captured them, unaided.
Hex Dump
Two characters per byte. Turn the hex back into text.
Thirty-Two
Like Base64, but upper-case and chunkier.
Ones & Zeros
Eight bits make a byte. Read the machine.
man hint
Groups of eight 1s and 0s = binary ASCII. DevSec › Number base (binary→text).
→ DevSec › numbaseThe XORcist
Hex ciphertext, XORed byte-by-byte with ONE secret byte. Recover the text.
man hint
Single-byte XOR — brute all 256 keys until "KBS{" appears (it is 0x5a). DevSec › XOR Cipher.
→ DevSec › xorCaesar's Ghost
Letters rotated by an UNKNOWN amount. Find the shift.
man hint
Letters shift, digits stay = Caesar. DevSec › Classical Cipher › Caesar (brute), then read the line that starts KBS{.
→ DevSec › cipherThe Vigenère
A repeating-key cipher over the letters. You need the key.
man hint
Vigenère, key "ghost". DevSec › Classical Cipher › Vigenère, type the key, Decode.
→ DevSec › cipherMirror
It reads wrong because it is the wrong way round.
The Onion
Wrapped three times. Peel from the outside in.
man hint
Base64 → Hex → ROT13 (outer to inner). DevSec › Base64, then Hex, then Classical Cipher › ROT13.
→ DevSec › base64Scan Me
A black-and-white square holds a secret.
Say Cheese
Download the photo. The pixels are a decoy — look at what the file carries, not what it shows.
man hint
Read the PNG metadata/strings. DevSec › File Inspector (metadata), or exiftool / strings.
→ DevSec › fileinspectThe Tail
A valid image... with something stapled to the end of the file.
man hint
Data lives AFTER the IEND marker. strings, binwalk, or DevSec › File Inspector (hex / strings).
→ DevSec › fileinspectHeadless
This file will not open — its first eight bytes were wiped. Restore the PNG signature, then read it.
man hint
The 8-byte PNG signature is wiped. DevSec › File Inspector spots it and offers "Repair PNG header & download" — then open the PNG.
→ DevSec › fileinspectWhisper
The flag is encoded in the least-significant bit of the red channel, left-to-right, top-to-bottom, terminated by a NUL byte.
man hint
Classic LSB steganography. Extract LSBs of the red channel into bytes (zsteg / stegsolve / a few lines of Python + PIL).
→ DevSec › fileinspectRight-Click Denied
Open the page. It blocks right-click and says there is nothing here. It is lying.
man hint
View source (Ctrl/Cmd+U) or DevTools. A Base64 string sits in a comment — decode it (DevSec › Base64).
→ DevSec › base64Spaghetti
A short, deliberately messy Python script. Figure out what it prints — or just run it.
man hint
Each byte is XORed with 0x2a. Run python3 spaghetti.py, or decode the list yourself.
Dots & Dashes
Dots, dashes, and silence. Decode the signal.
man hint
International Morse, letters split by spaces. DevSec › Morse › Decode, then lower-case into KBS{...}.
→ DevSec › morseEpitaph
A caretaker log, water-damaged. The words say nothing — but the lines do.
man hint
Acrostic — the FIRST letter of each line spells it. Paste the lines into DevSec › Text › First letters, then lower-case into KBS{...}.
→ DevSec › textPacket Capture
A captured HTTP exchange. One header is carrying more than it should.
man hint
Scan every header for Base64 — one token decodes to the flag, the rest are decoys. DevSec › Base64.
→ DevSec › base64A Dozen Veils
Base64, wrapped a dozen times. By hand you will give up; by loop you will not.
man hint
Base64 wrapped a dozen times. DevSec › Base64 › tick "Decode repeatedly" to peel every layer at once — or loop base64-decode in Python.
→ DevSec › base64_ _ _ __ __ _ _ ___ ___ | || | /_\ | \/ | \| | __| \ | __ |/ _ \| |\/| | .` | _|| |) | |_||_/_/ \_\_| |_|_|\_|___|___/
All 20 flags captured — 0 pts.
Clean sweep across the whole board — encoding, crypto, misc, forensics, stego, web, reversing, traffic, programming — with the same toolbox I bring to the real ones.
Your reward
A certificate worth earning.
Capture all 20 flags and claim a personalized certificate — scannable, downloadable, yours. Below is a live sample issued to Ksatria Bintang Samudra.
20 flags left to unlock your own — this is a live sample.
A practice certificate — not an accredited credential. Issued for motivation, under the honor code above (no AI, no shared solutions).