XSS3cut10n3r

NSA Codebreaker 2025: My First Full Challenge

Sat, 03 Oct 2026 00:08:00 +0100

The 2025 NSA Codebreaker Challenge was my first Codebreaker, and I completed all seven tasks, becoming one of 82 students to finish the full challenge. It was a chance to connect skills that I had often practiced separately: filesystem forensics, packet analysis, memory analysis, reverse engineering, cryptography, and application security.

The challenge used a fictional investigation into suspicious activity on a military development network. Each task carried the investigation forward, so an answer was more than a flag—it supplied context for the next question.

NSA Codebreaker 2025 — Task 7: Finale

Sat, 03 Oct 2026 00:07:00 +0100

← Series overview

The final task supplied a custom Android APK used to archive chat messages. It brought together application reverse engineering, archive handling, and reasoning about how data moves through a program.

Starting with the application

I first reviewed the supplied dependency licenses. An old library looked like a promising lead, but my notes make clear that the decisive issue emerged from examining the application’s own handling of files.

NSA Codebreaker 2025 — Task 6: Crossing the Channel

Sat, 03 Oct 2026 00:06:00 +0100

← Series overview

Task 6 shifted the investigation into a Mattermost environment. The challenge supplied persistent application data and an account with access to a limited part of the system. The objective concerned reaching the channel used by the fictional adversary.

Reviewing the custom integration

I examined the provided bot plugins and found a flaw in the logic used to manage private negotiation channels. The relevant checks established that users belonged to the current channel, but did not adequately establish their authority to access the destination channel.

NSA Codebreaker 2025 — Task 5: Putting It All Together

Sat, 03 Oct 2026 00:05:00 +0100

← Series overview

Task 5 - Putting It All Together - (Cryptanalysis)

NSA analysts confirm that there is solid evidence that this binary was at least part of what had been installed on the military development network. Unfortunately, we do not yet have enough information to update NSA senior leadership on this threat. We need to move forward with this investigation!

The team is stumped - they need to identify something about who was controlling this malware. They look to you. “Do you have any ideas?”

NSA Codebreaker 2025 — Task 4: Unpacking Insight

Sat, 03 Oct 2026 00:04:00 +0100

← Series overview

Task 4 - Unpacking Insight - (Malware Analysis)

Once back at NSA the team contacts the NSA liaison at FBI to see if they have any information about what was discovered in the configuration data. FBI informs us that the facility registered to host that domain is on a watchlist for suspected criminal activity. With this tip, the FBI acquires a warrant and raids the location. Inside the facility, the server is discovered along with a suspect. The suspect is known to the FBI as a low-level malware actor. During questioning, they disclose that they are providing a service to host malware for various cybercrime groups, but recently they were contacted by a much more secretive and sophisticated customer. While they don’t appear to know anything about who is paying for the service, they provide the FBI with the malware that was hosted.

NSA Codebreaker 2025 — Task 3: Digging Deeper

Sat, 03 Oct 2026 00:03:00 +0100

← Series overview

Task 3 - Digging Deeper - (Reverse Engineering)

The network administrators confirm that the IP address you provided in your description is an edge router. DAFIN-SOC is asking you to dive deeper and reverse engineer this device. Fortunately, their team managed to pull a memory dump of the device.

Scour the device’s memory dump and identify anomalous or malicious activity to find out what’s going on.

Your submission will be a list of IPs and domains, one per line. For example:

NSA Codebreaker 2025 — Task 2: The Hunt Continues

Sat, 03 Oct 2026 00:02:00 +0100

← Series overview

Task 2 - The Hunt Continues - (Network Forensics)

With your help, the team concludes that there was clearly a sophisticated piece of malware installed on that endpoint that was generating some network traffic. Fortunately, DAFIN-SOC also has an IDS which retained the recent network traffic in this segment.

DAFIN-SOC has provided a PCAP to analyze. Thoroughly evaluate the PCAP to identify potential malicious activity.

Downloads

PCAP to analyze: traffic.pcap

Task

Submit all the IP addresses that are assigned to the malicious device, one per line.

Writeup

Upon opening the PCAP in Wireshark, I was greeted by approximately 2,400 packets consisting primarily of IPv4 and ARP traffic.

NSA Codebreaker 2025 — Task 1: Getting Started

Sat, 03 Oct 2026 00:01:00 +0100

← Series overview

Task 1 - Getting Started (Forensics)

You arrive on site and immediately get to work. The DAFIN-SOC team quickly briefs you on the situation. They have noticed numerous anomalous behaviors, such as: tools randomly failing tests and anti-virus flagging on seemingly clean workstations. They have narrowed in on one machine they would like NSA to thoroughly evaluate.

They have provided a zipped EXT2 image from this development machine. Help DAFIN-SOC perform a forensic analysis on this - looking for any suspicious artifacts.

About Me: Cybersecurity, LRQA & AI

Mon, 27 Oct 2025 00:00:00 +0000

Hey! I'm Tomi, an Associate Security Consultant at LRQA and an Applied Cybersecurity student.

What I’m Working On at LRQA

I’m currently working at LRQA in Birmingham, UK, as an Associate Security Consultant, with a focus on implementing AI into penetration testing workflows. My work includes developing vulnerability knowledge bases (VKBs) for local AI penetration testing tooling to help streamline testing automation.

About Me: Cybersecurity, LRQA & AI

Mon, 27 Oct 2025 00:00:00 +0000

Hey! I'm Tomi, an Associate Security Consultant at LRQA and an Applied Cybersecurity student.

What I’m Working On at LRQA

Crypto Cheatsheet for CTFs

Wed, 27 Aug 2025 00:00:00 +0000

Cryptography challenges are one of the most common categories in Capture the Flag (CTF) competitions. This guide provides a focused overview of essential algorithms, how to recognize them, common weaknesses exploited in CTFs, and practical resources for practice.

Common CTF Crypto Patterns

Flags often follow formats like CTF{...}, which can help in known-plaintext scenarios.
Key reuse across ciphertexts can allow XOR analysis.
Small RSA exponents (e = 3) can lead to direct root extraction if the plaintext is small.
Small primes allow for easy factorization of RSA moduli.
Padding issues in AES frequently lead to oracle-style attacks.
Images encrypted with ECB will show visible repeated patterns.

Tools

CyberChef - versatile tool for conversions, encodings, and ciphers.
CacheSleuth MultiDecoder - automated format and cipher detection. Easily my favorite tool.
dCode - classical cipher solvers and crypto utilities.
RsaCtfTool - specialized RSA attack tool.

Core Algorithms

RSA

RSA is an asymmetric encryption algorithm based on modular arithmetic with large primes.

Gaining Interactive Shells

Tue, 26 Aug 2025 00:00:00 +0000

Often when uploading a reverse shell on a webserver we are dealing with non-interactive shell. This means it doesn’t prompt us for user input or display output in real-time in a traditional terminal window.

The biggest problem with a non-interactive shell is that you can’t run su or sudo.

Useful ways to upgrade your shell to an interactive one:

python -c 'import pty; pty.spawn("/bin/sh")'

When to use it: Almost always the first go-to if Python is available on the target. After spawning, run Ctrl-Z and then stty raw -echo; fg on your local terminal to fully fix arrow keys and job control.

Whoami

Tue, 26 Aug 2025 00:00:00 +0000

中國人

你好！我是一名对网络安全充满热情的人，尤其对渗透测试和道德黑客很感兴趣。我计划在这里记录自己的学习过程，分享在安全、技术和实践方面的心得与体会。希望这个网站能成为我整理经验、总结知识的地方，同时与大家一起在这个领域不断成长。

Русский

Привет! Я человек, увлеченный кибербезопасностью, особенно меня интересуют тестирование на проникновение и этичный хакеринг. Я планирую здесь документировать свой процесс обучения и делиться своими знаниями и наблюдениями в области безопасности, технологий и лучших практик. Надеюсь, что этот сайт станет для меня местом, где можно систематизировать опыт, аккумулировать знания и расти в этой области вместе с другими.

English

Hello! I’m an individual with a strong interest in cybersecurity. I’m particularly drawn to penetration testing and ethical hacking, and I plan to document my learning journey here. My goal is to explore and share knowledge about security, techniques, and best practices, all in a safe and responsible manner. This website will serve as a place to catalog insights, experiences, and resources as I continue to grow in this field.