Cyberweek Africa Qualifiers 2026

· 300 pts · bealthguy

Telemetry monitors detected anomalous BGP routing advertisements hijacking an Autonomous System Number prefix. Correlate historic routing table updates to identify the rogue origin AS. **FORMAT: FLAG{ }**

· 500 pts · bealthguy

Adversaries operated within an under-monitored secondary cloud region. Parse multi-region CloudTrail audit logs to identify anomalous API calls and carved secrets. **FORMAT: FLAG{ }**

· 150 pts · bealthguy

A company migrated its internal administrative panel behind a private tunnel, but historic DNS records still log the original public IP coordinates. Identify the historical records. **FORMAT:** FLAG{ }

· 100 pts · bealthguy

A microservice container was provisioned with the host's mounted into the runtime environment. The Docker API socket can be used to escape the container boundaries. **FORMAT:** FLAG{ }

· 250 pts · bealthguy

A public-facing web gateway exposes an unauthenticated SSRF endpoint. Query the cloud Instance Metadata Service (IMDSv1) to extract temporary instance credentials. **FORMAT:** FLAG{ }

· 250 pts · bealthguy

A developer removed an access key from a production repository in a recent commit, but the historical change log remains intact. Audit the commit graph and detached dangling commits. **FORMAT:** FLAG{ }

· 100 pts · bealthguy

A compromised low-privileged service account holds limited permissions across cloud resources. Identify configuration oversights to attach broader administrative policies to your role. **FORMAT:** FLAG{ }

· 500 pts · bealthguy

Audit logs reveal a developer role with permission to create temporary debugging pods. Exploit the cluster RBAC privileges to execute commands within the control plane namespace. **FORMAT: FLAG{ }**

· 150 pts · bealthguy

A pod running within an internal cluster has an attached service account token with excessive cluster role bindings. Query the Kubernetes API to pivot into administrative secrets. **FORMAT:** FLAG{ }

· 150 pts · bealthguy

Adversaries published a video claiming to stage operations outside a regional energy sub-station. Analyze spatial markers, transmission pylons, and topographical shadows to identify the exact coordinates. **FORMAT:** FLAG{ }

· 100 pts · bealthguy

An automated asset deployment script created a cloud object storage repository with public read access. Identify the bucket namespace and retrieve the unlisted storage objects. **FORMAT:** FLAG{ }

· 500 pts · bealthguy

A suspected dark fleet vessel rendezvous was captured off the East African coast via Synthetic Aperture Radar (SAR). Analyze radar reflectivity anomalies within the raw telemetry dataset to track the rendezvous coordinates.

· 300 pts · bealthguy

An industrial telemetry broker exposes an unauthenticated MQTT message bus to the internet. Intercept subscribed topic streams carrying sensor metrics and operator commands. **FORMAT: FLAG{ }**

· 500 pts · bealthguy

Decoding the segment yields the same string, which confirms the encoding rather than revealing anything further. The ciphertext work described in the brief was therefore not required to recover the value.

· 300 pts · bealthguy

Decoding the segment yields the same string, which confirms the encoding rather than revealing anything further. The ciphertext work described in the brief was therefore not required to recover the value.

· 500 pts · bealthguy

Decoding the segment yields the same string, which confirms the encoding rather than revealing anything further. The ciphertext work described in the brief was therefore not required to recover the value.

· 300 pts · bealthguy

Decoding the segment yields the same string, which confirms the encoding rather than revealing anything further. The ciphertext work described in the brief was therefore not required to recover the value.

· 100 pts · bealthguy

Decoding the segment yields the same string, which confirms the encoding rather than revealing anything further. The ciphertext work described in the brief was therefore not required to recover the value.

· 100 pts · bealthguy

Decoding the segment yields the same string, which confirms the encoding rather than revealing anything further. The ciphertext work described in the brief was therefore not required to recover the value.

· 500 pts · bealthguy

A live RAM acquisition preserved the runtime memory of an active OpenSSL cryptographic routine during an active TLS tunnel. Extract the expanded round keys directly from the key schedule buffer to recover the session master secret.

· 300 pts · bealthguy

A workstation used by an insider threat was impounded. While the operator cleared their screen, raw SQLite databases storing visited resources, auto-completion caches, and local session artifacts remain on the disk. Uncover the submitted credentials. **FORMAT: FLAG{ }**

· 100 pts · bealthguy

A physical flash memory drive recovered from an unauthorized drone flight near a maritime container terminal contains surveillance photography. Threat actors failed to purge hardware markers and geodetic tags before abandoning the unit. Audit the internal file descriptors. **FORMAT:** FLAG{ }

· 500 pts · bealthguy

Adversaries executed an unlinking routine across a Linux database server to prevent incident analysis. Given a raw unallocated disk partition slice, trace the unlinked inode structures and reconstruct the cleared records. **FORMAT: FLAG{ }**

· 150 pts · bealthguy

Border firewalls observed abnormal ICMP Echo Request size variance moving toward an unclassified off-shore IP. Data payloads within each echo request contain sequenced fragments of an exfiltrated token. Reassemble the payload stream. **FORMAT:** FLAG{ }

· 300 pts · bealthguy

Domain telemetry alerted on anomalous Ticket Granting Service requests utilizing degraded encryption ciphers. The intercepted authentication handshake contains an encrypted service ticket payload. Recover the plain authorization token. **FORMAT: FLAG{ }**

· 250 pts · bealthguy

Following an emergency drive seizure from a compromised hypervisor node, examiners isolated the raw Master File Table. Although the operating system reported the flag document as deleted, residual record extents remain preserved across resident attributes. **FORMAT:** FLAG{ }

· 100 pts · bealthguy

The brief describes a workstation that was transmitting supervisor credentials over an unsegmented internal network, and the capture was taken before anyone isolated the interface. The traffic is therefore still in cleartext, and the task is to reconstruct the single request that carried the key.

· 100 pts · bealthguy

During a malware staging event, an adversary altered the file signatures and chunk CRC checksums of an internal floor layout graphic to evade automated gateway sandboxing. Restore the damaged structural markers to render the hidden image. **FORMAT:** FLAG{ }

· 100 pts · bealthguy

Regional listening stations intercepted an encrypted acoustic carrier pulse over VHF frequencies. Intelligence confirms the message modulates high-frequency phase shifts into an ambient WAV recording. Extract the hidden dispatch. **FORMAT:** FLAG{ }

· 500 pts · bealthguy

A rogue microcontroller was detected posing as a standard USB human interface peripheral on a critical infrastructure terminal. The provided capture recorded raw interrupt transfers detailing keystroke scan codes. Decode the keystroke sequence. **FORMAT: FLAG{ }**

· 150 pts · bealthguy

An encrypted archive discovered on an adversarial staging server protects exfiltrated audit records. One member file is known to be identical to an unmodified open-source operational license. Exploit the stream cipher implementation to recover the archive passkey. **FORMAT:** FLAG{ }

· 150 pts · bealthguy

A diagnostic routine passes user input directly into a formatted output function without format specifiers. Exploit direct parameter access specifiers to leak pointers and secret data from the stack. **FORMAT:** FLAG{ }

· 300 pts · bealthguy

A session management service fails to nullify object pointers following dynamic deallocation. Allocate a crafted structure into the freed chunk to hijack the subsequent function pointer dereference. **FORMAT:** FLAG{ }

· 150 pts · bealthguy

A transaction buffer allocates storage based on user-supplied item counts multiplied by record size. Provide boundary integer values to trigger an arithmetic overflow, resulting in an undersized allocation. **FORMAT:** FLAG{ }

· 100 pts · bealthguy

A legacy management daemon running on internal infrastructure reads unchecked user input directly into a fixed-size stack frame. Overwrite the saved instruction pointer to hijack execution to the victory subroutine. **FORMAT:** FLAG{ }

· 100 pts · bealthguy

An embedded service allocates an executable memory region and transfers execution directly to the submitted buffer. Craft compact machine code to read the flag from the environment. **FORMAT:** FLAG{ }

· 500 pts · bealthguy

Given a severe constraint on available ROP gadgets, the sigreturn syscall mechanism permits an entire processor register context to be forged from user-controlled memory. **FORMAT:** FLAG{ }

· 100 pts · bealthguy

An access-control check compares a local stack variable to an administrative magic constant immediately following a buffer read. Adjust input length to overwrite the adjacent stack variable. **FORMAT:** FLAG{ }

· 300 pts · bealthguy

The service allocator manages small dynamic allocations via glibc thread-local caching bins. Corrupt the forward pointer of a freed tcache chunk to force the allocator to return an arbitrary memory location. **FORMAT:** FLAG{ }

· 500 pts · bealthguy

A firmware blob extracted from an edge sensor operates on bare-metal AArch64 hardware without an underlying OS kernel. Disassemble the reset vector and memory map. **FORMAT:** FLAG{ }

· 250 pts · bealthguy

A high-performance calculation engine derives verification keys into processor registers during execution before zeroing them out. Inspect dynamic register states at the calculation breakpoint. **FORMAT:** FLAG{ }

· 150 pts · bealthguy

A compiled licensing binary checks for hardware dongle responses and immediately branches to an error handler. Modify the conditional jump instructions in the binary to force successful validation. **FORMAT:** FLAG{ }

· 150 pts · bealthguy

An enterprise middleware component was retrieved as a compiled JVM bytecode class. Decompile the class structure to audit the secret derivation method. **FORMAT:** FLAG{ }

· 100 pts · bealthguy

A proprietary credential validator dynamically links against standard C library routines to evaluate passcodes. Trace the dynamic library calls during verification to intercept the argument comparison. **FORMAT:** FLAG{ }

· 250 pts · bealthguy

A target binary implements active debugger detection via system tracing calls, intentionally terminating if monitored. Bypass or neutralize the anti-debugging checks to step through the execution path. **FORMAT:** FLAG{ }

· 100 pts · bealthguy

An operational automation script was deployed only as compiled Python bytecode (.pyc). Decompile the bytecode into source logic to review the validation conditions. **FORMAT:** FLAG{ }

· 100 pts · bealthguy

The artifact is presented as a compiled binary but is 98 bytes. Its first sixteen bytes are the ELF identification string, and from offset 16 onward it is ASCII rather than machine code:

· 100 pts · bealthguy

A dropped executable was modified with an executable packer to obstruct static analysis tools. Unpack the compressed sections to uncover the core disassembly. **FORMAT:** FLAG{ }

· 500 pts · bealthguy

A client-side authentication routine was compiled to WebAssembly. Decompile the WASM module into readable text representation to locate the hardcoded validation logic. **FORMAT:** FLAG{ }

· 100 pts · bealthguy

An internal administrative session manager encodes client state directly into browser cookies using predictable transformations. Alter the serialized identity parameters to elevate privileges to administrator status.

· 250 pts · bealthguy

An internal identity directory misconfigures Cross-Origin Resource Sharing by dynamically reflecting arbitrary headers with credentials allowed. Exploit the origin trust flaw to capture sensitive profile records.

· 100 pts · bealthguy

[BASIC] 05 Git Metadata Leak 100 web basic cwa2026 A production web application deployed its webroot directly from an active version-control directory. Query the exposed .git object database to reconstruct historical repository commits and recover the redacted credential. FORMAT: FLAG{ }

· 250 pts · bealthguy

An enterprise API gateway hosts a GraphQL endpoint with production introspection queries left enabled. Probe the introspection schema to enumerate hidden object types and query the administrative flag field.

· bealthguy

A regional payment gateway diagnostic endpoint was exposed during a rollout. The web server emits sensitive debugging flags and authorization headers inside its HTTP response metadata. Inspect the exchange headers.

· 100 pts · bealthguy

> A logistics inventory management console validates user checkout permissions via hidden DOM parameters > before submission. Audit the client-side markup and manipulate the internal form values.

· 300 pts · bealthguy

An internal cache service accepts serialized objects over HTTP and deserializes them directly. Craft a serialized object payload containing an execution gadget chain to trigger code execution.

· 250 pts · bealthguy

A microservices token service validates JSON Web Tokens but accepts signatures marked with the unsigned algorithm type. Forge an administrative token payload with a null signature. **FORMAT:** FLAG{ }

· 150 pts · bealthguy

An enterprise report viewer ingests document filenames through a GET parameter to serve static files. Escape the restricted document directory using relative path sequences to read sensitive system configuration records. **FORMAT:** FLAG{ }

· 250 pts · bealthguy

A client-side dashboard merges nested JSON state objects recursively into the global application prototype. Pollute Object.prototype properties to bypass the access-control filter.

· 100 pts · bealthguy

> A corporate portal attempts to hide restricted administrative paths by defining crawler exclusion standards without enforcing endpoint authentication. Inspect the spider directives to discover the unlinked directory.

· 500 pts · bealthguy

An enterprise single sign-on assertion parser verifies signed XML blocks but checks assertion attributes outside the signed scope. Apply XML Signature Wrapping (XSW) to inject an unauthorized administrative identity. **FORMAT:** FLAG{ }

· 150 pts · bealthguy

A perimeter authentication portal concatenates user-supplied form fields directly into backend database query strings. Exploit the boolean evaluation flaw to authenticate as the root operator without a valid password. **FORMAT:** FLAG{ }

· 250 pts · bealthguy

A document conversion microservice fetches external image URLs on behalf of users. Exploit the server-side fetching mechanism to query internal cloud metadata endpoints inaccessible from the external perimeter. **FORMAT:** FLAG{ }

· 300 pts · bealthguy

A dynamic notification system evaluates user-supplied greeting strings directly inside a server-side template engine. Escape the template interpolation block to execute commands within the underlying runtime.

· 250 pts · bealthguy

A financial invoice processor parses uploaded XML payloads with external entity expansion enabled. Define a custom XML entity pointing to internal system resources to read local files. **FORMAT:** FLAG{ }