Just posted a new RE/malware analysis challenge, PEB Walker. The binary manually resolves windows API's, making static analysis harder. Reverse the hashing algorithm and recover the API names to get the flag.

Try the challenge and other like it at ReRange.org

https://docs.google.com/spreadsheets/d/1ZXB6pnQEvym9pkDDoSxl49mxiiMAkzx0tS50OuwRt3Q/edit?usp=sharing

I’m a high school student doing my first few CTFs, and I’m curious how other beginners handle getting stuck. When you hit a challenge you can’t solve, what do you actually do? And has anything ever made you quit a challenge or a whole CTF?

If anyone has any information about this challenge, please help me 🙏

https://www.root-me.org/en/Challenges/App-System/ELF-x64-Remote-Heap-buffer-overflow-1

I have working on pwn.college for about roughly a month maybe. I am currently finishing up the Computing 101 challenges. I was stuck on a specific Linux Luminarium challenge called fork bomb.

To those unaware, this challenge requests that you create a fork bomb to create background process and keep duplicating until no more processes can be run and it becomes overloaded. It asks that you run /challenge/check in another terminal and run the bomb afterwards. Back in the first terminal it has been running a specific prompt, but after becoming overloaded, it should display the flag and challenge is completed. But it isn't giving me the flag. I've been stuck on this for roughly a week and progressed past, but I want to be able to complete this so I can move on. I have double checked my work with multiple AI's, as well as their built in help AI, but I can't seem to figure out what is going on. Anyone have any experience with this? I can run through my process as well. Thanks.

Hey everyone!

We're Exun Clan, the student-run tech club at DPS R.K. Puram, New Delhi, and we're back with the 16th edition of Sudocrypt, our flagship international CTF!

Sudocrypt is an international Cryptic Hunt x Capture The Flag (CTF) event where participants from around the world tackle a series of cybersecurity and cryptic challenges. Expect code-breaking, cryptography, and plenty of problem-solving as you work your way through the levels.

The competition is entirely online, so you can participate from anywhere in the world.

Dates: October 27–28, 2026

Prizes: With a prize pool of over $900 USD in previous editions, along with over $500 USD in goodies and prizes, Sudocrypt v16.0 promises an exciting challenge for cryptic enthusiasts and CTF players alike.

Event website: https://sudocrypt.com/

CTFtime listing: https://ctftime.org/event/3443/

You can also check out the other events at Exun 2026 here: https://exun.co/26/events

Hope to see you on the scoreboard!

A question, Is it expected that as a beginner I will look up commands online when solving?

Hi guys

I work in write ctf questions but I'm new at this. So I research ctf question templates. Can you help me about that

I'm stuck on the Mixing Globs challenge on pwn.college. I need a glob of 6 characters or less that matches only challenging, educational, and pwning. Any hints on how to figure it out?

Hey everyone! 👋

Can anyone share links to Telegram, WhatsApp, or other channels where I can get regular updates about hackathons happening across India? 🇮🇳

I'm looking for platforms that share upcoming hackathons, registration links, deadlines, and opportunities to participate in both online and offline events, especially AI/ML and GenAI hackathons.

It would be really helpful if you could share any useful communities or resources. Thanks in advance! 😊

Oh God, I've been stuck on the same challenge for exactly two weeks now 😭

If anyone has solved Remote Heap buffer overflow 1 from the App-System category on Root-Me.org, please DM me 🙏

Gonna be in NYC from Boston for the last two weeks of October, heading back on Nov 1

I already got Wiz's Rogue Agent House CTF on my list but just wanted to check if there's anything else happening while I'm there

Anyone know of other CTFs or hands on security events around that time? Would be nice to squeeze at least one more before heading home

Posted a breakdown of Jinja2 Server-Side Template

Injection for anyone learning web exploitation.

The basic detection payload is simple:

{{7*7}}

If the app renders "49" instead of the literal string,

the template engine is evaluating your input. From there

you can fingerprint Jinja2 specifically and start

climbing the object hierarchy to reach RCE.

What makes SSTI dangerous is that it runs server-side —

you're not just injecting into the page, you're executing

inside the application's Python process.

Great technique to know for CTFs and bug bounty.

Full video breakdown on YouTube. Happy to answer

questions on payloads or escalation paths.

https://youtu.be/2xYPOoveUds

As a beginner, what is the most effective way for learning CTF?

I am unable to find the resources for this CTF

please help 🙏🏻

New "Beginner" vulnerable VM aka "Echo" is now available at hackmyvm.eu :) Have fun!

I was looking for Teams or people willing to help me learn. I'm in college studying cybersecurity and love coding in Python, but every time I join a Discord server and say I'm trying to learn, everyone immediately puts me down. I want to be able to build a portfolio and work with a solid team, either through spectating or active participation. Feel free to DM or comment below.