offsec blog https://bara.xyz en https://bara.xyz/posts/ctf/dusty-alleys https://bara.xyz/posts/ctf/dusty-alleys Sun, 28 Sep 2025 00:00:00 +0000 In the dark, dusty underground labyrinth, the survivors feel lost and their resolve weakens. Just as despair sets in, they notice a faint light: a dilapidated, rusty robot emitting feeble sparks. Hoping for answers, they decide to engage with it. ctf https://bara.xyz/posts/ctf/ws-todo https://bara.xyz/posts/ctf/ws-todo Mon, 22 Sep 2025 00:00:00 +0000 This WebSockets-based Todo application features ✨millitary-grade encryption✨ and is extremely low-latency. Ideal for busy students and working professionals alike. ctf https://bara.xyz/posts/labs/vulncicada https://bara.xyz/posts/labs/vulncicada Tue, 16 Sep 2025 00:00:00 +0000 VulnCicada is a Medium Windows Active Directory machine that involves discovering a password inside an image on a public share. labs https://bara.xyz/posts/misc/tcbelevation https://bara.xyz/posts/misc/tcbelevation Sun, 14 Sep 2025 00:00:00 +0000 misc https://bara.xyz/posts/labs/data https://bara.xyz/posts/labs/data Wed, 10 Sep 2025 00:00:00 +0000 Data is an Easy Linux machine that involves exploiting https://nvd.nist.gov/vuln/detail/CVE-2021-43798, an arbitrary file read via path traversal in Grafana. labs https://bara.xyz/posts/labs/retro https://bara.xyz/posts/labs/retro Sun, 07 Sep 2025 00:00:00 +0000 Retro is an Easy Windows machine that showcases an Active Directory Domain Controller. labs https://bara.xyz/posts/labs/down https://bara.xyz/posts/labs/down Sun, 07 Sep 2025 00:00:00 +0000 Down is an easy-rated Linux machine that involves exploiting an arbitrary file read by bypassing a protocol-based filter to discover the source code of the running PHP web app, eventually, a remote code execution to gain an initial foothold. labs https://bara.xyz/posts/ctf/hydroadmin https://bara.xyz/posts/ctf/hydroadmin Sun, 10 Aug 2025 00:00:00 +0000 With reservoirs sealed and cities teetering on thirst, our heroes storm the HydroAdmin control room to reopen valves and restore the flow of water. ctf https://bara.xyz/posts/ctf/resourcehub-core https://bara.xyz/posts/ctf/resourcehub-core Thu, 31 Jul 2025 00:00:00 +0000 The NecroNet unleashes its undead AI worm on the Global Resource Hub, cutting off water, food and power—and the Citadel Consortium calls in its elite white-hat operatives to reclaim the portal. ctf https://bara.xyz/posts/ctf/commnet https://bara.xyz/posts/ctf/commnet Sun, 27 Jul 2025 00:00:00 +0000 Cut off from each other and besieged by undead propaganda, humanity’s survivors rely on CommNet—until the white-hats break in to silence the broadcast and reconnect the enclaves. ctf https://bara.xyz/posts/ctf/wafwaf https://bara.xyz/posts/ctf/wafwaf Wed, 09 Jul 2025 00:00:00 +0000 My classmate Jason made this small and super secure note taking application, check it out! ctf https://bara.xyz/posts/bugbounty/first-bounty https://bara.xyz/posts/bugbounty/first-bounty Fri, 25 Oct 2024 00:00:00 +0000 How did I get my first bounty? bugbounty