zwesty
Lanes / Metadata
Huntress CTF 2026 · AI Arena · Lane

Metadata

File formats read straight from their bytes: hashes, ZIP, JPEG, PE, MSI, ELF, registry hives, disk images, and more.

31 challenges31 write-ups93/93 modes won
The month, by modeClaude 67 Homebase 0 Both 26
STTM
12345678910111213141516171819202122232425262728293031
3rdbest speed-board placeof 60 · Day 22 Mastery, Main Character Energy
37 sfastest finishDay 22, from the 9:00 AM release to the last mode won
20,544answers sentin 286 submissions

Day by day

Day 1 · Thu, Oct 1

You Must Be This Hash to Ride

File identity (size, MD5, SHA-1, SHA-256) · zip structure (local headers against the central directory, nested and stored zips) · not trusting labels · building a timed solver

STTM
Day 2 · Fri, Oct 2

Looks Can Be Deceiving

File signatures (magic bytes) against extensions · reading zip members without extracting · reusing Day 1's solver · the pairing-token connection

STTM
Day 3 · Sat, Oct 3

BOM Voyage

Byte order marks · reading text as bytes, not as an editor shows it · not trusting file names · reusing earlier days' zip handling

STTM
Day 4 · Sun, Oct 4

Picture This

JPEG structure (markers, segments, the SOF frame header) · structure over presentation · reusing the zip handling from Days 1–3

STTM
Day 5 · Mon, Oct 5

Chunk Norris

PNG structure (signature, chunks, CRCs) · reading IHDR · spotting what doesn't belong in a file

STTM
Day 6 · Tue, Oct 6

Portable Deception

PDF structure (header, catalog, trailer) · telling a real PDF from an impostor · separating what a file promises from what it contains

STTM
Day 7 · Wed, Oct 7

Seven-Zip, No Relation

ZIP structure (local headers, central directory, EOCD) · an archive's claims versus its contents · extending a shared solver without breaking earlier days

STTM
Day 8 · Thu, Oct 8

What’s in the Box?

ZIP central directory, hashing, file headers (JPEG, PNG, PDF), reusing a compounding solver

STTM
Day 9 · Fri, Oct 9

Built Different

PE headers (MZ, e_lfanew, PE\0\0, COFF Machine), telling real executables from decoys, reusing a compounding solver

STTM
Day 10 · Sat, Oct 10

Where Do We Begin?

PE optional header (AddressOfEntryPoint as an RVA), checking the entry point against the section table, answer formatting (zero-padding to the field's width), reusing a compounding solver

STTM
Day 11 · Sun, Oct 11

What’s My Name Again?

PE resource directory, VS_VERSIONINFO parsing (OriginalFilename), spotting a renamed binary, strict field matching in a compounding solver

STTM
Day 12 · Mon, Oct 12

Managed Expectations

.NET CLI header and metadata streams, the Module table's MVID, GUID byte order, strict field matching in a compounding solver

STTM
Day 13 · Tue, Oct 13

Product Placement

Windows Installer (MSI) databases: the OLE compound file, MSI stream-name encoding, the string pool, the Property table; telling ProductCode from UpgradeCode and the package code; answer form

STTM
Day 14 · Wed, Oct 14

The Shortcut Home

Windows shortcut (.lnk) files, the MS-SHLLINK format: header flags, the LinkTargetIDList, LinkInfo (LocalBasePath, CommonPathSuffix), StringData; telling a link's target from where it sits

STTM
Day 15 · Thu, Oct 15

A Word to the Wise

OOXML / OPC package structure (.rels parts, TargetMode), JSON answer forms, hashing and ordering files, building on a compounding solver

STTM
Day 16 · Fri, Oct 16

Return to Sender

Email headers (RFC 5322 Message-ID), exact-text answers, pre-built parsers

STTM
Day 17 · Sat, Oct 17

Hear Me Out

RIFF/WAVE structure, codec identification from bytes, ffprobe naming

STTM
Day 18 · Sun, Oct 18

Frame of Reference

ISO BMFF (MP4) box parsing, video stream geometry, answer-form choice, compounding solver chain

STTM
Day 19 · Mon, Oct 19

Little Endian on the Prairie

ELF header parsing, byte order, answer-form choice

STTM
Day 20 · Tue, Oct 20

Universal Appeal

Mach-O header parsing (thin, fat/universal, ar archives), answer-form choice, extending a compounding solver

STTM
Day 21 · Wed, Oct 21

Package Deal

APK structure, Android binary XML (AXML) manifests, pre-building parsers for likely fields

STTM
Day 22 · Thu, Oct 22

Main Character Energy

JAR structure, META-INF/MANIFEST.MF, pre-building parsers for likely fields

STTM
Day 23 · Fri, Oct 23

Page Me Maybe

SQLite header geometry, ZIP central directory, fat Mach-O slices, batch-splitting a rejected submit, order rules

STTM
Day 24 · Sat, Oct 24

Event Horizon

Windows EVTX structure (file header, 64 KiB chunks, event records), pre-building parsers for likely fields

STTM
Day 25 · Sun, Oct 25

Hive Mind

Windows registry hive structure (regf base block, hbin, nk key cells), pre-built parsers, a candidate ladder, and its accepted-rule overlay

STTM
Day 26 · Mon, Oct 26

Before You Go

Windows Prefetch (SCCA header, MAM XPRESS Huffman compression), pre-built parsers

STTM
Day 27 · Tue, Oct 27

Packet Loss Prevention

Classic pcap (four magic forms, record walk), pre-built parsers, sorting questions by whether a pre-built parser covers them

STTM
Day 28 · Wed, Oct 28

Where It All Began

Disk images: protective MBR, GPT header and entry array, MBR primaries and EBR chains; the stored-rule overlay our Metadata solver applies

STTM
Day 29 · Thu, Oct 29

Trust Issues

X.509 certificate fingerprints (SHA-256 over the DER bytes); sorting questions into already-known, pre-built, and new fields

STTM
Day 30 · Fri, Oct 30

Seeing Double

Hashing real archive bytes rather than trusting a manifest; grouping identical files; tolerating archives with bad CRCs and mismatched header names; the stored-rule overlay our Metadata solver applies

STTM
Day 31 · Sat, Oct 31

No Artifact Left Behind

Per-artifact metadata across formats (PNG text chunks, SQLite tables, zip members, email attachments, PowerShell launch lines), building a directed graph and finding its one root-to-terminal walk, spotting a decoy cycle

STTM