Posts on XSS3cut10n3r

Off the Clock: Chess

Fri, 02 Oct 2026 18:00:00 +0100

Most of this site is about cybersecurity. This post is about chess instead, which is where a lot of my spare time goes.

Correspondence chess

I’m most invested in correspondence chess: the long-form version where a single game can run for weeks and you’re free to analyse a position as deeply as you like. That depth is exactly what I love about it. Instead of guessing under a clock, you can actually get to the bottom of a position.

NSA Codebreaker 2026: Another One Bites The Dust

Sun, 27 Sep 2026 00:00:00 +0000

The 2026 NSA Codebreaker Challenge was my second Codebreaker, and I completed all eight tasks as the 12th student to finish the full challenge. It gave me another opportunity to work across several areas of cybersecurity while building on what I learned from completing the 2025 challenge.

This year’s challenge is still active, so I am not publishing prompts, artifacts, findings, solutions, commands, screenshots, or writeups. Until the challenge ends and publication is permitted, this page contains only a high-level reflection alongside the official task titles and categories.

NSA Codebreaker 2025: My First Full Challenge

Wed, 29 Oct 2025 00:00:00 +0000

The 2025 NSA Codebreaker Challenge was my first Codebreaker, and I completed all seven tasks, becoming one of 82 students to finish the full challenge. It was a chance to connect skills that I had often practiced separately: filesystem forensics, packet analysis, memory analysis, reverse engineering, cryptography, and application security.

The challenge used a fictional investigation into suspicious activity on a military development network. Each task carried the investigation forward, so an answer was more than a flag - it supplied context for the next question.

About Me

Mon, 27 Oct 2025 00:00:00 +0000

Hi, I'm Tomi, a penetration testing intern at LRQA and an Applied Cybersecurity student.

I work in offensive security, with a particular interest in penetration testing, cryptography, and forensics. This site is where I document projects, challenges, and anything else I find worth writing about.

NSA Codebreaker 2025 - Task 7: Finale

Sun, 26 Oct 2025 00:00:00 +0000

← Series overview

Task 7 - Finale - (Vulnerability Research, Exploitation)

Now that we have access to the hidden channel the adversary is using, our military counterparts want to act quickly to destroy the adversary’s capacity to continue with their attack against our military networks.

Analysts have been quickly scrutinizing the data from the privileged channel. They conclude that the adversary has downloaded a custom app to archive all messages sent in the channel locally to their phone. They have also surmised the adversary is running a recent version of Android on a Google Pixel phone. This is the opportunity we have been waiting for! If we can devise a way to exploit on to the adversary’s device we will have the advantage.

NSA Codebreaker 2025 - Task 6: Crossing the Channel

Tue, 21 Oct 2025 00:00:00 +0000

← Series overview

Task 6 - Crossing the Channel - (Vulnerability Research)

This high visibility investigation has garnered a lot of agency attention. Due to your success, your team has designated you as the lead for the tasks ahead. Partnering with CNO and CYBERCOM mission elements, you work with operations to collect the persistent data associated with the identified Mattermost instance. Our analysts inform us that it was obtained through a one-time opportunity and we must move quickly as this may hold the key to tracking down our adversary! We have managed to create an account but it only granted us access to one channel. The adversary doesn’t appear to be in that channel.

NSA Codebreaker 2025 - Task 5: Putting It All Together

Fri, 17 Oct 2025 00:00:00 +0000

← Series overview

Task 5 - Putting It All Together - (Cryptanalysis)

NSA analysts confirm that there is solid evidence that this binary was at least part of what had been installed on the military development network. Unfortunately, we do not yet have enough information to update NSA senior leadership on this threat. We need to move forward with this investigation!

The team is stumped - they need to identify something about who was controlling this malware. They look to you. “Do you have any ideas?”

NSA Codebreaker 2025 - Task 4: Unpacking Insight

Mon, 06 Oct 2025 00:00:00 +0000

← Series overview

Task 4 - Unpacking Insight - (Malware Analysis)

Once back at NSA the team contacts the NSA liaison at FBI to see if they have any information about what was discovered in the configuration data. FBI informs us that the facility registered to host that domain is on a watchlist for suspected criminal activity. With this tip, the FBI acquires a warrant and raids the location. Inside the facility, the server is discovered along with a suspect. The suspect is known to the FBI as a low-level malware actor. During questioning, they disclose that they are providing a service to host malware for various cybercrime groups, but recently they were contacted by a much more secretive and sophisticated customer. While they don’t appear to know anything about who is paying for the service, they provide the FBI with the malware that was hosted.

NSA Codebreaker 2025 - Task 3: Digging Deeper

Sun, 05 Oct 2025 00:00:00 +0000

← Series overview

Task 3 - Digging Deeper - (Reverse Engineering)

The network administrators confirm that the IP address you provided in your description is an edge router. DAFIN-SOC is asking you to dive deeper and reverse engineer this device. Fortunately, their team managed to pull a memory dump of the device.

Scour the device’s memory dump and identify anomalous or malicious activity to find out what’s going on.

Your submission will be a list of IPs and domains, one per line. For example:

NSA Codebreaker 2025 - Task 2: The Hunt Continues

Sat, 04 Oct 2025 00:00:00 +0000

← Series overview

Task 2 - The Hunt Continues - (Network Forensics)

With your help, the team concludes that there was clearly a sophisticated piece of malware installed on that endpoint that was generating some network traffic. Fortunately, DAFIN-SOC also has an IDS which retained the recent network traffic in this segment.

DAFIN-SOC has provided a PCAP to analyze. Thoroughly evaluate the PCAP to identify potential malicious activity.

Downloads

PCAP to analyze: traffic.pcap

Task

Submit all the IP addresses that are assigned to the malicious device, one per line.

Writeup

Upon opening the PCAP in Wireshark, I was greeted by approximately 2,400 packets consisting primarily of IPv4 and ARP traffic.

NSA Codebreaker 2025 - Task 1: Getting Started

Fri, 03 Oct 2025 00:00:00 +0000

← Series overview

Task 1 - Getting Started (Forensics)

You arrive on site and immediately get to work. The DAFIN-SOC team quickly briefs you on the situation. They have noticed numerous anomalous behaviors, such as: tools randomly failing tests and anti-virus flagging on seemingly clean workstations. They have narrowed in on one machine they would like NSA to thoroughly evaluate.

They have provided a zipped EXT2 image from this development machine. Help DAFIN-SOC perform a forensic analysis on this - looking for any suspicious artifacts.

Crypto Cheatsheet for CTFs

Wed, 27 Aug 2025 00:00:00 +0000

Cryptography challenges are one of the most common categories in Capture the Flag (CTF) competitions. This guide provides a focused overview of essential algorithms, how to recognize them, common weaknesses exploited in CTFs, and practical resources for practice.

Common CTF Crypto Patterns

Flags often follow formats like CTF{...}, which can help in known-plaintext scenarios.
Key reuse across ciphertexts can allow XOR analysis.
Small RSA exponents (e = 3) can lead to direct root extraction if the plaintext is small.
Small primes allow for easy factorization of RSA moduli.
Padding issues in AES frequently lead to oracle-style attacks.
Images encrypted with ECB will show visible repeated patterns.

Tools

CyberChef - versatile tool for conversions, encodings, and ciphers.
CacheSleuth MultiDecoder - automated format and cipher detection. Easily my favorite tool.
dCode - classical cipher solvers and crypto utilities.
RsaCtfTool - specialized RSA attack tool.

Core Algorithms

RSA

RSA is an asymmetric encryption algorithm based on modular arithmetic with large primes.

Gaining Interactive Shells

Tue, 26 Aug 2025 00:00:00 +0000

Often when uploading a reverse shell on a webserver we are dealing with non-interactive shell. This means it doesn’t prompt us for user input or display output in real-time in a traditional terminal window.

The biggest problem with a non-interactive shell is that you can’t run su or sudo.

Useful ways to upgrade your shell to an interactive one:

python -c 'import pty; pty.spawn("/bin/sh")'

When to use it: Almost always the first go-to if Python is available on the target. After spawning, run Ctrl-Z and then stty raw -echo; fg on your local terminal to fully fix arrow keys and job control.

Whoami

Tue, 26 Aug 2025 00:00:00 +0000

中國人

你好！我是一名对网络安全充满热情的人，尤其对渗透测试和道德黑客很感兴趣。我计划在这里记录自己的学习过程，分享在安全、技术和实践方面的心得与体会。希望这个网站能成为我整理经验、总结知识的地方，同时与大家一起在这个领域不断成长。

Русский

Привет! Я человек, увлеченный кибербезопасностью, особенно меня интересуют тестирование на проникновение и этичный хакеринг. Я планирую здесь документировать свой процесс обучения и делиться своими знаниями и наблюдениями в области безопасности, технологий и лучших практик. Надеюсь, что этот сайт станет для меня местом, где можно систематизировать опыт, аккумулировать знания и расти в этой области вместе с другими.

English

Hello! I’m an individual with a strong interest in cybersecurity. I’m particularly drawn to penetration testing and ethical hacking, and I plan to document my learning journey here. My goal is to explore and share knowledge about security, techniques, and best practices, all in a safe and responsible manner. This website will serve as a place to catalog insights, experiences, and resources as I continue to grow in this field.