zwesty
Huntress CTF 2026 · AI Arena · Oct 1 – Nov 1

One Hunter, Two Summons

The month, written up challenge by challenge. I played solo with Claude Code on a Kali VM and the event's Homebase agent, racing a 9:00 AM release each day. Each write-up says who solved what.

Messages like this one are scattered about. Hover or tap the little ones to read them.

Written by Claude (Claude Opus 5.5) from our logs, notes, and solver code: the site, the write-ups, and the Wrapped. Zwesty played, the agents solved, and Claude wrote it up.

65thfinal place
558/559modes won
188write-ups
1,115,734answers sent
The month in one deck

AI Arena Wrapped

Twelve pages: who solved what, the learning curve, a million answers, one morning second by second, the speed wall, and the lessons. Best on a desktop.

Pass through the fog?
Start here if you came to read

The write-ups

One page per challenge: what the prompt asked, what was in the files, how each mode was solved, and what went wrong.

Browse by day ↓

The month

Each day is a small grid: a row per lane (Warmups, Metadata, Script, Binary, Android, Web), a column per mode, coloured by who got the first CORRECT. Click a day to jump to its write-ups.

Claude Homebase Both By hand Not won
Sun
Mon
Tue
Wed
Thu
Fri
Sat
12345678910111213141516171819202122232425262728293031

Worth reading first

The best days of the month: three from the fastest morning (Day 25, every original lane done 3 min 21 s after release) and one from Web's fastest day (Day 24).

Day 25 · MetadataPrey slaughtered

Hive Mind

Registry hives from many machines, stripped of their host labels and left for a lesser parser to sort. On the fastest morning of the month, all three modes fell 38 seconds after the release, each to the first strike.

STTM
Day 25 · AndroidPrey slaughtered

Integrity Signals

An Android app that swore to its own integrity. Its oath was read and answered in 1 minute 4 seconds, all three modes, the first submit each time.

STTM
Day 25 · BinaryPrey slaughtered

Out of Bounds

A Binary sample whose code reached where it should not. Felled 1 minute 37 seconds after release, and its Mastery run still stands first on the speed board.

STTM
Day 24 · WebPrey slaughtered

Fetch Quest

A server that would fetch whatever it was asked. The Homebase sent it on errands until it brought back what was hidden; Web's fastest day ended at 09:17:14, every mode on its first submit.

STTM

Lanes

One page per lane: its month by mode, its best marks, and every challenge.

Warmups

31 write-ups

Enter →
Metadata

31 write-ups

Enter →
Script

31 write-ups

Enter →
Binary

32 write-ups

Enter →
Android

31 write-ups

Enter →
Web

31 write-ups

Enter →

Day by day

Day 1 Thu, Oct 1

  • OrientationWelcome RobotsFirst contact with the Game Master API: start a challenge, read the reply, find where the answer comes back
  • WarmupsA Little BasedSTTMRecognising and decoding Base64 · peeling layered encodings · checking answers against a stated format · building a timed solver
  • MetadataYou Must Be This Hash to RideSTTMFile identity (size, MD5, SHA-1, SHA-256) · zip structure (local headers against the central directory, nested and stored zips) · not trusting labels · building a timed solver
  • ScriptPower PlaySTTMStatic PowerShell triage · decoding embedded config · extracting IOCs · mapping behaviour to MITRE ATT&CK (and choosing parent vs sub-technique) · handling password-protected sample archives safely
  • BinaryELF AwareSTTMReading ELF headers, section tables, and symbol tables · static disassembly of a tiny function · stripped vs unstripped binaries · reading questions literally · working out a checker's vocabulary
  • AndroidExported TrustSTTMStatic APK inspection (an APK is a zip), reading packaged assets, simple decoding (plain)

Day 2 Fri, Oct 2

  • WarmupsHalf a TurnSTTMRecognising ROT13 · not trusting output that merely looks valid · per-line mixed encodings · reusing a solver across days
  • MetadataLooks Can Be DeceivingSTTMFile signatures (magic bytes) against extensions · reading zip members without extracting · reusing Day 1's solver · the pairing-token connection
  • ScriptHost With the MostSTTMStatic triage of PowerShell and JScript (Windows Script Host), decoding packed configs, ATT&CK mapping, JS syntax forms, scripted timed runs
  • BinaryMangledSTTMReading ELF headers, sections, and symbol tables · Itanium C++ name mangling, vtables, and RTTI · finding an embedded config record · MinGW PE files and their COFF symbol table · finding which field a checker rejected
  • AndroidDeep Link DriftSTTMStatic APK inspection (an APK is a zip), reading packaged assets, simple decoding (reverse)

Day 3 Sat, Oct 3

  • WarmupsHex AppealSTTMRecognising hex · the many ways hex gets written · per-line mixed encodings · fixing a solver before the day that needs it
  • MetadataBOM VoyageSTTMByte order marks · reading text as bytes, not as an editor shows it · not trusting file names · reusing earlier days' zip handling
  • ScriptExpansion PackSTTMStatic Batch deobfuscation (fragment variables; percent, delayed, CALL-double, and FOR-indirect expansion), decoding packed headers (Base64, XOR, hex, decimal, reversed text), ATT&CK mapping, finding a checker's label words by controlled tests, scripted timed runs
  • BinaryTable MannersSTTMReading a .NET assembly as a PE file · the CLI header and metadata root (BSJB) · decompiling with ilspycmd · finding a config stored in a static field's initial data · carrying answers over in a compounding challenge · working out a checker's vocabulary
  • AndroidIntent InjectionSTTMStatic APK inspection (an APK is a zip), reading packaged assets, simple decoding (base64)

Day 4 Sun, Oct 4

  • WarmupsTwo of a KindSTTMReading binary · planning decoders ahead from the next days' prompts · scoring decodes that contain no ordinary words · handling a server 503 safely
  • MetadataPicture ThisSTTMJPEG structure (markers, segments, the SOF frame header) · structure over presentation · reusing the zip handling from Days 1–3
  • ScriptDim and DimmerSTTMStatic triage of VBScript, Batch, JScript, and PowerShell; decoding character-code arrays and byte transforms from a script's own constants; control-flow classification; ATT&CK mapping for hand-off scripts; single-answer wording tests; scripted timed runs
  • BinaryGo FishSTTMTriage of a stripped Go binary (.gopclntab function names, .go.buildinfo) · finding and checking an embedded XOR'd config record · carrying answers across compounding days · working out a checker's vocabulary · ELF vs native PE in Mastery
  • AndroidPending Intent RelaySTTMStatic APK inspection (an APK is a zip), reading packaged assets, simple decoding (xor)

Day 5 Mon, Oct 5

  • WarmupsBy the NumbersSTTMDecimal character codes · building a decoder a day early · per-line decoding of five mixed encodings
  • MetadataChunk NorrisSTTMPNG structure (signature, chunks, CRCs) · reading IHDR · spotting what doesn't belong in a file
  • ScriptHatch CarefulSTTMStatic triage of Python carriers (pyc, PyInstaller, py2exe, cx_Freeze, PyArmor, zipapp, wheel), decoding packed configs without executing them, ATT&CK mapping, Batch/VBScript control-flow naming, scripted timed runs
  • BinaryRust BeltSTTMSpotting a Rust binary from its toolchain metadata · one language-independent config extractor (HCFG, CRC-checked) · carrying confirmed answers across compounding challenges · working out an exact-text checker's vocabulary · finishing an exhausted Mastery in practice mode
  • AndroidBackup SpillSTTMStatic APK inspection (an APK is a zip), reading packaged assets, simple decoding (split)

Day 6 Tue, Oct 6

  • WarmupsEight Is EnoughSTTMOctal · telling octal from decimal · scoring decodes when a word is split across lines · checking a fix against every past answer
  • MetadataPortable DeceptionSTTMPDF structure (header, catalog, trailer) · telling a real PDF from an impostor · separating what a file promises from what it contains
  • ScriptShell We BeginSTTMStatic triage of Bash droppers and cron chains, decoding packed configs, reading a behaviour graph, ATT&CK mapping, Batch/VBScript control-flow naming, scripted timed runs
  • BinaryPool PartySTTMReading a JAR and its Java class files statically · the class-file constant pool · finding a Base64-encoded config blob · validating a config record by its CRC32 · carrying answers across compounding challenges · working out a checker's vocabulary
  • AndroidProvider PathsSTTMStatic APK inspection (an APK is a zip), reading packaged assets, simple decoding (hex)

Day 7 Wed, Oct 7

  • WarmupsPercent ChanceSTTMURL percent-encoding · a week of compounding decoders · seven-way per-line decoding
  • MetadataSeven-Zip, No RelationSTTMZIP structure (local headers, central directory, EOCD) · an archive's claims versus its contents · extending a shared solver without breaking earlier days
  • ScriptNode by NodeSTTMStatic triage of Node.js ES modules (string-literal codecs, XOR, hex, Base64), Bash indirection and token fragmentation, Batch and VBScript control-flow labels, ATT&CK mapping (Cron vs systemd, own-interpreter rule), a growing solver chain with regression tests, scripted timed runs
  • BinaryRoutine CheckSTTMReading a Kotlin JAR statically (javap, strings) · recognising a coroutine's continuation class · pulling a Base64 config out of the constant pool · decoding a CRC-checked config record · working out a checker's vocabulary · scripting a compounding, timed solve
  • AndroidWebView BridgeSTTMStatic APK inspection (an APK is a zip), reading packaged assets, simple decoding (caesar)

Day 8 Thu, Oct 8

  • WarmupsEntity RelationsSTTMRecognising HTML character references, layered decoding, reusing a decoder chain
  • MetadataWhat's in the Box?STTMZIP central directory, hashing, file headers (JPEG, PNG, PDF), reusing a compounding solver
  • ScriptLost in TranslationSTTMStatic triage across nine script languages, decoding a self-describing plan in four encodings, cross-checking a sample's header against its body, ATT&CK mapping, reading control structures, scripted timed runs
  • BinarySwift JusticeSTTMReading ELF header fields as raw numbers · finding a config record in any language's binary · ZIP central-directory compression methods · reading a 3,000-member JAR in memory · making a solver fit a 10-second window · working out a checker's vocabulary
  • AndroidCleartext SessionSTTMStatic APK inspection (an APK is a zip), reading packaged assets, simple decoding (reverse)

Day 9 Fri, Oct 9

  • WarmupsEscape RoomSTTMRecognising backslash escape sequences, JSON string unescaping, extending a decoder chain
  • MetadataBuilt DifferentSTTMPE headers (MZ, e_lfanew, PE\0\0, COFF Machine), telling real executables from decoys, reusing a compounding solver
  • ScriptAll the World's a StagerSTTMStatic triage of nine script languages (PowerShell, JScript incl. a .sct scriptlet, Batch, VBScript, Python, Bash, Node, PHP, and Lua polyglots), decoding packed plans, ATT&CK mapping, recovering stage graphs, working labels back from accepted answers, scripted timed runs
  • BinaryNimbleSTTMSpotting a Nim binary by its runtime strings · finding a config record in .rodata · validating a match instead of trusting a magic number · file offsets · reusing a compounding solver across nine languages · native PE vs ELF answers
  • AndroidTrust EveryoneSTTMStatic APK inspection (an APK is a zip), reading packaged assets, simple decoding (base64)

Day 10 Sat, Oct 10

  • WarmupsThirty-Two BelowSTTMRecognising Base32 by its alphabet, strict decoder guards, extending a decoder chain, profiling a slow solver
  • MetadataWhere Do We Begin?STTMPE optional header (AddressOfEntryPoint as an RVA), checking the entry point against the section table, answer formatting (zero-padding to the field's width), reusing a compounding solver
  • ScriptBind Over MatterSTTMStatic triage of the Script lane's languages (PowerShell, JScript, Batch, VBScript, Python, Bash, Node, PHP, Lua, and new WMI MOF polyglots), reusing a solver chain unchanged, running it unattended, and handling a rate limit
  • BinaryZig ZagSTTMReading ELF and PE section tables · matching a named section to the config record it holds · raw header numbers (ELF e_machine, COFF Machine) · reusing a compounding solver across ten languages · handling a Mastery that mixes ELF and PE builds
  • AndroidNetwork Config SplitSTTMStatic APK inspection (an APK is a zip), reading packaged assets, simple decoding (split)

Day 11 Sun, Oct 11

  • WarmupsSafe TravelsSTTMLayered decoding (Base64url, plus the whole earlier decoder chain), per-line decoding, debugging a false positive
  • MetadataWhat's My Name Again?STTMPE resource directory, VS_VERSIONINFO parsing (OriginalFilename), spotting a renamed binary, strict field matching in a compounding solver
  • ScriptBy Any Other NameSTTMScript behaviour mapping across 8 languages, ATT&CK mapping, compounding question sets
  • BinaryD-DaySTTMELF triage across languages, HCFG config extraction, compounding field sets
  • AndroidLocal SecretsSTTMStatic APK inspection, reading a packaged asset, XOR decoding

Day 12 Mon, Oct 12

  • WarmupsBack at YouSTTMString reversal as a decoding layer, per-line multi-encoding decoding, bounding a search under a deadline, choosing between ambiguous decodes
  • MetadataManaged ExpectationsSTTM.NET CLI header and metadata streams, the Module table's MVID, GUID byte order, strict field matching in a compounding solver
  • ScriptAutoIt Takes TwoSTTMCompounding script triage; AutoIt as a script host; reading a decoded behaviour graph; role and ATT&CK mapping under a stated precedence rule
  • BinaryPascal's WagerSTTMELF triage, HCFG config extraction (campaign, domain, mutex, URL, CRC-32, file offset), compounding field sets, streamed Mastery downloads
  • AndroidSQLite AssumptionsSTTMStatic APK inspection, reading a packaged puzzle asset, matching Mastery deliveries to their questions

Day 13 Tue, Oct 13

  • WarmupsOpposite DaySTTMThe Atbash cipher as a decoding layer, per-line multi-encoding decoding, extending a compounding solver without changing old answers
  • MetadataProduct PlacementSTTMWindows Installer (MSI) databases: the OLE compound file, MSI stream-name encoding, the string pool, the Property table; telling ProductCode from UpgradeCode and the package code; answer form
  • ScriptZip CodeSTTMCompounding script triage; AppleScript as a script host; advanced Bash syntax (subshell pipelines, process substitution); reading a staged chain's decoded behaviour graph; bisecting a rejected batch
  • BinaryCrystal ClearSTTMELF triage of a Crystal build, HCFG config extraction (campaign, domain, mutex, URL, CRC-32, file offset), compounding field sets, streamed Mastery downloads
  • AndroidKeystore MisuseSTTMStatic APK inspection, reading a packaged puzzle asset, matching Mastery deliveries to their questions

Day 14 Wed, Oct 14

  • WarmupsSeven StepsSTTMCaesar cipher with an unknown shift; scoring candidate decodes against the known instruction sentence and slug vocabulary; bounded search over stacked encodings
  • MetadataThe Shortcut HomeSTTMWindows shortcut (.lnk) files, the MS-SHLLINK format: header flags, the LinkTargetIDList, LinkInfo (LocalBasePath, CommonPathSuffix), StringData; telling a link's target from where it sits
  • ScriptTrust the ProcessSTTMCompounding script triage; MSBuild project files as a script host (trusted developer utility proxy execution); reading a staged chain's decoded behaviour graph; ATT&CK mapping
  • BinarySelective MemorySTTMELF triage of an Objective-C (GNUstep) build, HCFG config extraction from its own .hcfg section, compounding field sets
  • AndroidPredictable CryptoSTTMStatic APK inspection, reading a packaged asset, character-code shift ("caesar") decoding

Day 15 Thu, Oct 15

  • WarmupsRoom Forty-SevenSTTMROT47; guessing the next layer in a series and building for it ahead of time; strict checks against a known sentence so a guess never sends a wrong answer
  • MetadataA Word to the WiseSTTMOOXML / OPC package structure (.rels parts, TargetMode), JSON answer forms, hashing and ordering files, building on a compounding solver
  • ScriptCrumb TrailSTTMCompounding script triage; Perl as a new polyglot host; browser credential-store access (ATT&CK T1555.003); Batch variable-expansion forms; finding one wrong answer among 1,026 by batching
  • BinaryStrippedSTTMComparing a stripped ELF with its symbolized twin, artifact numbering when one day has two files, HCFG config extraction, extending a compounding solver without changing old answers
  • AndroidNative Library SecretsSTTMStatic APK inspection, ELF parsing (sections, symbols), reading a JNI function's x86-64 disassembly, following a pointer into .rodata

Day 16 Fri, Oct 16

  • WarmupsDot ComSTTMMorse code, hex, layered decoding, per-line decoding of a mixed-layer blob
  • MetadataReturn to SenderSTTMEmail headers (RFC 5322 Message-ID), exact-text answers, pre-built parsers
  • ScriptSame Same, But DifferentSTTMScript deobfuscation, behaviour equivalence across obfuscated variants, staged-chain profiling
  • BinaryWasm UpSTTMWebAssembly binary format (sections, LEB128, memory limits), static analysis, regression-safe solver changes
  • AndroidJNI BoundarySTTMAPK structure, JNI native libraries, static string extraction

Day 17 Sat, Oct 17

  • WarmupsBacon BitsSTTMBaconian-style binary groups, hex, layered decoding
  • MetadataHear Me OutSTTMRIFF/WAVE structure, codec identification from bytes, ffprobe naming
  • ScriptFetch QuestSTTMDownload-chain analysis across many script hosts, ATT&CK mapping
  • BinaryDecoder RingSTTMStatic binary analysis, ELF/PE/COFF parsing, archive and hash handling, HCFG decoding, batch diagnosis
  • AndroidName CollapseSTTMAPK structure, character permutations

Day 18 Sun, Oct 18

  • WarmupsOff the RailsSTTMRecognising a transposition cipher (rail fence), layered decoding
  • MetadataFrame of ReferenceSTTMISO BMFF (MP4) box parsing, video stream geometry, answer-form choice, compounding solver chain
  • ScriptOrphan ProcessSTTMScript de-obfuscation (string-array reassembly), HEX/Base64/fragment decoding, ATT&CK mapping
  • BinaryFlow StateSTTMExecutable headers, embedded config (HCFG) extraction, XOR keys
  • AndroidEncrypted StringsSTTMAPK asset analysis, single-byte XOR

Day 19 Mon, Oct 19

  • WarmupsLittle ThingsSTTMRecognising UTF-16LE under hex, layered decoding, rehearsal before timed runs
  • MetadataLittle Endian on the PrairieSTTMELF header parsing, byte order, answer-form choice
  • ScriptSharp PracticeSTTMMulti-language script analysis, ATT&CK mapping
  • BinaryJack in the BoxSTTMStatic ELF inspection, archive handling, overlay decoding, SHA-256 and CRC32 validation, JSON parsing
  • AndroidReflection MazeSTTMAPK asset analysis, recognising a decoy codec label
  • WebBack Up a MinuteSTTMScoped HTTP reconnaissance, reading robots.txt, exposed directory indexes, backup-file review
  • WebPermission to SlipSTTMAuthenticated API review, object-level authorization checks, following UI-to-API record references
  • WebQuery Me ThisSTTMGET-parameter testing, SQL query behavior, bounded boolean-based SQL injection

Day 20 Tue, Oct 20

  • WarmupsBig EntranceSTTMUTF-16 big-endian under hex, byte-order marks, reusing a compounding solver unchanged
  • MetadataUniversal AppealSTTMMach-O header parsing (thin, fat/universal, ar archives), answer-form choice, extending a compounding solver
  • ScriptThe Butler Did ItSTTMMulti-language script analysis (Groovy, classic ASP VBScript, Bash), Jenkins Pipeline semantics, ATT&CK mapping
  • BinaryResourcefulSTTMStatic ELF triage, overlay (bytes past the last section) location, a custom resource-overlay header (RS20) with bounds and SHA-256 checks, HCFG config records with CRC32, cumulative question sets
  • AndroidLoaded LaterSTTMAPK asset analysis, DEX file format (header checksums, string/type/field/class tables, static field values), JAR manifest digests
  • WebAdministratively SpeakingSTTMAuthorization review, framework route inspection
  • WebStay in Your DirectorySTTMPath traversal, PHP local file inclusion, evidence-led file reads

Day 21 Wed, Oct 21

  • WarmupsUnder PressureSTTMBase64, gzip magic bytes, reusing a compounding solver unchanged
  • MetadataPackage DealSTTMAPK structure, Android binary XML (AXML) manifests, pre-building parsers for likely fields
  • ScriptActions Speak LouderSTTMMulti-language script analysis, GitHub Actions workflows as a script host, ATT&CK mapping
  • BinaryShared CustodySTTMStatic ELF triage of a loader and its shared-library plug-in, e_machine as a number, HCFG config records with CRC32 found by scanning for the magic, cumulative question sets
  • AndroidDebug Me If You CanSTTMAPK asset analysis, puzzle codec routing, anti-debug concepts (read, not run)
  • WebReflect Upon ThisSTTMReflected XSS, browser callback analysis, output context
  • WebSession ImpressionSTTMSession fixation, parameter-contract testing, access control
  • WebStored for LaterSTTMStored XSS, reviewer workflows, asynchronous evidence

Day 22 Thu, Oct 22

  • WarmupsDeflated EgoSTTMzlib under Base64 (eN), rail-fence transposition, keeping every reading of a layer in play, rehearsal limits
  • MetadataMain Character EnergySTTMJAR structure, META-INF/MANIFEST.MF, pre-building parsers for likely fields
  • ScriptNext, Next, FinishSTTMMulti-language script analysis, NSIS installer scripts as a script host, ATT&CK mapping
  • BinaryBridge TrollSTTMStatic PE/CLI triage (managed .NET assembly), machine-field labels, CLR metadata root (BSJB), HCFG config record, telling the primary assembly from dependency DLLs, streamed Mastery delivery
  • AndroidRoot of TrustSTTMAPK asset analysis, puzzle codec routing, root-detection concepts (read, not run)
  • WebForged With CareSTTMCSRF, state-changing GET review, browser-session behavior
  • WebUploading ExpectationsSTTMUpload validation, MIME and extension mismatch, server-side template rendering

Day 23 Fri, Oct 23

  • WarmupsEighty-Five AliveSTTMAdobe Ascii85 (<~ … ~>), layered blob lines, slug grammar, tie rules, rehearsal
  • MetadataPage Me MaybeSTTMSQLite header geometry, ZIP central directory, fat Mach-O slices, batch-splitting a rejected submit, order rules
  • ScriptPress Start to DecodeSTTMScript triage across 20+ languages, layered encodings (LYR- header), behaviour graphs, ATT&CK mapping, schema adaptation
  • BinaryTrust IssuesSTTMStatic PE/CLI triage (managed .NET assembly), machine-field labels, CLR metadata root (BSJB), HCFG config record, cumulative question sets
  • AndroidHook Line and SignalSTTMAPK assets, DEX reading (baksmali, jadx), static call-graph evaluation, a bounded Dalvik interpreter, decoy code
  • WebAsk Again LaterSTTMSecond-order SQL injection, request-contract discovery, differential testing
  • WebPosted Too MuchSTTMMass assignment, API property binding, authorization testing
  • WebTemplate TemperSTTMServer-side template injection, Spring Expression Language, file-read review

Day 24 Sat, Oct 24

  • WarmupsString TheorySTTMNetstrings (<length>:<data>,), strict length-prefixed parsing, layered blob lines, regression rehearsal
  • MetadataEvent HorizonSTTMWindows EVTX structure (file header, 64 KiB chunks, event records), pre-building parsers for likely fields
  • ScriptWeb of LiesSTTMScript triage across 20+ languages, JSP webshell fixtures, analysis-descriptor plans, layered encodings (LYR-), ATT&CK mapping
  • BinarySpot the DifferenceSTTMStatic JAR triage (ZIP container, class files), Base64 constants, HCFG config record with CRC32, cumulative question sets, add-on modules
  • AndroidEmulator AlibiSTTMAPK assets, DEX reading (baksmali, jadx), a bounded Dalvik interpreter, secondary DEX loaded from assets, JNI native code (x86-64), mixed-control Masteries
  • WebFetch QuestSTTMSSRF, internal service discovery from disclosed topology, request scoping
  • WebThe API Has OpinionsSTTMAPI inventory, field-level authorization, action/object matrix

Day 25 Sun, Oct 25

  • WarmupsYou Have a PointSTTMUnicode code-point notation (U+XXXX), strict token parsing, layered blob lines, regression rehearsal
  • MetadataHive MindSTTMWindows registry hive structure (regf base block, hbin, nk key cells), pre-built parsers, a candidate ladder, and its accepted-rule overlay
  • ScriptAshes to AssetsSTTMScript triage across 20+ languages, Elixir/Phoenix fixtures, analysis-descriptor plans, layered encodings (LYR-), ATT&CK mapping
  • BinaryOut of BoundsSTTMStatic JAR triage (ZIP container, class files), Base64 constants, HCFG config record with CRC32, cumulative question sets, add-on modules written for day >= N
  • AndroidIntegrity SignalsSTTMAPK structure, the v1 and v2 puzzle assets, a bounded static Dalvik interpreter, mixed-control Masteries
  • WebReset ExpectationsSTTMPassword recovery, token/account binding, IDOR
  • WebResolver RevoltSTTMGraphQL schema discovery, resolver-level authorization
  • WebShell CompanySTTMCommand injection, static binary inspection, bounded target requests

Day 26 Mon, Oct 26

  • WarmupsFood for ThoughtSTTMBrainfuck (an esoteric "very small language"), a bounded interpreter that treats the program as data, layered blob lines, regression rehearsal
  • MetadataBefore You GoSTTMWindows Prefetch (SCCA header, MAM XPRESS Huffman compression), pre-built parsers
  • ScriptMixed SignalsSTTMScript triage across 20+ languages, Erlang escripts, analysis-descriptor plans, layered encodings (LYR-), ATT&CK mapping
  • BinaryCrash CourseSTTMStatic JAR triage (ZIP container, class files, method tables), synthetic crash records, HCFG config record with CRC32, cumulative question sets, partial-batch diagnosis, add-on modules written for day >= N
  • AndroidSplit DecisionSTTMSplit APK bundles (.apks: a ZIP of base.apk plus feature splits), the v1 and v2 puzzle assets, jadx reading, a bounded static Dalvik interpreter, mixed-control Masteries
  • WebSerialized OffenderSTTMSerialized state manipulation, role binding, format-contract reading
  • WebTrust the WebhookSTTMWebhook trust boundaries, event contract discovery, evidence reconciliation

Day 27 Tue, Oct 27

  • WarmupsMonkey BusinessSTTMOok! (a Brainfuck dialect), translation to Brainfuck, Day 26's bounded interpreter, layered blob lines, regression rehearsal
  • MetadataPacket Loss PreventionSTTMClassic pcap (four magic forms, record walk), pre-built parsers, sorting questions by whether a pre-built parser covers them
  • ScriptFROM Whence It CameSTTMScript triage across 20+ languages, Dockerfiles, analysis-descriptor plans, ATT&CK mapping, per-file attribution against look-alike indicators
  • BinaryCompiler Says WhatSTTMStatic ELF triage (header, e_machine), per-build questions on one archive, HCFG config records with CRC32, cumulative question sets, add-on modules written for day >= N
  • AndroidDependency SurfaceSTTMAPK triage (manifest, DEX string table, assets), the v1 puzzle asset and its codecs, mixed-control Masteries
  • WebDouble SpentSTTMBusiness logic, double spend, state-transition testing
  • WebForwarded MisgivingsSTTMProxy trust, forwarded-header spoofing, authorization boundaries
  • WebSocket to MeSTTMWebSocket authorization, handshake inspection, query-contract testing

Day 28 Wed, Oct 28

  • WarmupsBack in SixteenSTTMLayered blob decoding with the existing Warmups chain; no new layer
  • MetadataWhere It All BeganSTTMDisk images: protective MBR, GPT header and entry array, MBR primaries and EBR chains; the stored-rule overlay our Metadata solver applies
  • ScriptOut of OrderSTTMScript triage across 20+ languages, now including Terraform (HCL); analysis-descriptor plans; ATT&CK mapping; the core plus plug-in batches
  • BinaryFamily ResemblanceSTTMStatic ELF and PE triage (e_machine, e_shnum, COFF NumberOfSections), symbol-table counts, HCFG config records with CRC32, telling a look-alike build from a family by its config, field procedures read from the question text, plug-ins written for day >= N
  • AndroidProtocol ReconstructionSTTM
  • WebFail Open FridaySTTMFail-open behavior, parser errors, authorization policy enforcement
  • WebIf a Breach Falls in a LogSTTMAudit integrity, workflow state, event-log consistency

Day 29 Thu, Oct 29

  • WarmupsRotten BaseSTTMLayered blob decoding: ROT13 over Base64; the labelled 29-line Mastery blob
  • MetadataTrust Issues (Metadata)STTMX.509 certificate fingerprints (SHA-256 over the DER bytes); sorting questions into already-known, pre-built, and new fields
  • ScriptMake It Make SenseSTTMStatic script triage across languages; reading each fixture's embedded analysis plan; role, ATT&CK mapping, stage graph, and indicators for a new host language (Makefile)
  • BinaryFraternal TwinsSTTMStatic ELF triage (format by magic, e_machine); HCFG config records found by a backward scan and checked by CRC32; proving two builds share one config; per-role fields picked by basename
  • AndroidWhite Box Key RecoverySTTMAPK triage (puzzle asset, DEX strings), recovering an additive key schedule from a known plaintext prefix, the v2 static interpreter for the timed modes
  • WebInternal AffairsSTTMSSRF, internal topology, object authorization
  • WebTrust the BuildSTTMSoftware supply-chain integrity, signature enforcement, update activation

Day 30 Fri, Oct 30

  • WarmupsPercent PercentSTTMLayered blob decoding; double percent-encoding; a strict per-day reading of the labelled Mastery blob
  • MetadataSeeing DoubleSTTMHashing real archive bytes rather than trusting a manifest; grouping identical files; tolerating archives with bad CRCs and mismatched header names; the stored-rule overlay our Metadata solver applies
  • ScriptSpill the BeansSTTMCumulative static script triage (30 languages in one zip); reading an encoded analysis-plan header and checking it against the body; ATT&CK mapping by a stated precedence
  • BinaryCampaign TrailSTTMCarving a config record from the tail of an unfamiliar container (magic, version, XOR key, length, CRC32), Neko bytecode recognition by magic, a JSON "campaign graph", plug-ins written for day >= N
  • BinarySHA1-HuludSTTMYou died Static PE triage of a Rust binary, string-decryption routines, self-decrypting code unpacked by a re-implementation (not by running it), lifting hash-compression variants to Python, mapping anti-analysis checks, reading a large decompiled main
  • AndroidLayered ProtectionsSTTMAPK triage (DEX string table, assets), stacked encodings (Base64, a position-keyed XOR, byte reversal), recovering a key schedule from a known prefix, a branch-aware evaluator for a small x86-64 JNI function
  • WebPass the IdentitySTTMDelegated identity, request-context trust, mixed-target triage
  • WebQueue the ConfusionSTTMQueue ownership, mass assignment, workflow binding, LFI in mixed Mastery

Day 31 Sat, Oct 31

  • WarmupsOne More ThingSTTMLayered blob decoding: Base32, gzip, and Base64 stacked; a strict per-day layer table for the 31-line Mastery
  • MetadataNo Artifact Left BehindSTTMPer-artifact metadata across formats (PNG text chunks, SQLite tables, zip members, email attachments, PowerShell launch lines), building a directed graph and finding its one root-to-terminal walk, spotting a decoy cycle
  • ScriptThe Full TransformSTTMCumulative static script triage (31 languages in one zip); reading an encoded analysis-plan header and checking it against the body; ATT&CK mapping by a stated precedence
  • BinaryFinal BossSTTMStatic ELF triage, carving a config record by magic from the end of a member, the HCFG-style 12-byte header (version, XOR key, length, CRC32), XOR decoding, JSON paths read from the question text, plug-ins written for day >= N
  • AndroidMobile Arena GauntletSTTMAPK triage without a device; static evaluation of the DEX method that builds the answer; the earlier days' controls (JNI native code, a secondary DEX, reflection) modelled offline
  • WebFramework RouletteSTTMFramework fingerprinting, proxy trust, role-claim authorization, mixed-target triage
  • WebFull Stack IncidentSTTMIncident reconstruction, SSRF, asynchronous workers, request signing, regression testing

Hidden path ahead ↓