Safaricom PwnZone 2.0 Qualifiers 2026

· 450 pts · bealthguy

> The streets are quiet, the lights are fading, and one delivery is still waiting to be collected.

· 200 pts · bealthguy

200 pts. Forensics. The description pointed at a replay system still serving old data:

· 250 pts · bealthguy

> A favorite record deserves another listen. > The needle drops, the familiar rhythm returns, and somewhere between the first play and the replay, something feels different.

· 450 pts · bealthguy

A Flutter AOT app, package , about 47 MB. It shows a lock, the words *Device integrity required*, and a button: **Run integrity scan**. Tap it honestly and it refuses, because the device really is compromised. Tap it after convincing it otherwise and it decrypts the secret and writes it to a sqflite database at , which only root can read.

· 250 pts · bealthguy

A museum collection page that fetched user records through XML. The front end built a small document like and posted it to , then rendered the returned fields. The description hinted that one catalog pointed to a second, unrelated store of data.

· 200 pts · bealthguy

A Flask login page titled Pole Position with a username and password form. Any visitor could try to log in. A successful login as a normal user returned , which told me the flag was only shown to the account.

· 450 pts · bealthguy

450 points. The landing page was a newsroom skin called THE DAILY SCOOP. Two links mattered: a press pack zip and a record search. I grabbed both before I thought too hard about the story.

· 300 pts · bealthguy

300 points. The page was an upload form for a street art gallery. It accepted files and showed a success box with a URL. The first thing I did was try a PHP file with the wrong MIME type.

· 550 pts · bealthguy

550 points. The front page was all light colors and a little in-browser console for hitting the API. Two endpoints mattered: one to open a visitor session, one to submit a proof with a layout. I spent a while on the layout before I realized the token was the real door.

· 350 pts · bealthguy

350 points. One text field, a greeting back, nothing else. The page title was CITRUS STUDIO and the form said "Lock Up The Usual Suspects", which felt like a hint about what kind of mistake was sitting behind it.

· 250 pts · bealthguy

A record-store login page with two fields: username and access level. The access-level selector only offered , and the login script sent the request with a fixed header. After login the page linked to , described as a listening room.

· 300 pts · bealthguy

A dispatch console with a URL fetcher. The page sent JSON like to and rendered the fetched headers and preview. The text around it stressed things meant to stay inside and files already in place, which pointed at server-side fetching as the way in.

· 150 pts · bealthguy

There was no web page to look at. Opening the main address just returned JSON and set a cookie. I saved both. The cookie was a token, the body said:

· 150 pts · bealthguy

150 points. The blurb just said travel light, leave room for discovery. That turned out to be literal.

· 450 pts · bealthguy

450 points. The blurb had three instructions packed into one paragraph: reach the reviewer, slip into the hollow, and take what the staff keep there.

· 150 pts · bealthguy

> Something went wrong. Then, somehow, everything looked normal again. > The system recovered quickly — but...

· 300 pts · bealthguy

A fan-club greeting page with a single message field. Whatever I typed came back inside an on the same page. The hint said nothing looked wrong at first and that things would reveal themselves on the way back, which suggested the output deserved a closer look.

· 300 pts · bealthguy

A cinema-themed login at guarding a . Unauthenticated visits to redirected to . The vault, once opened, listed secrets including an encrypted and exposed a endpoint plus a JavaScript constant holding an encoded key.

· 450 pts · bealthguy

450 points. The blurb was one line: the old theater has seen a few surprising acts.

· 300 pts · bealthguy

300 points. The page was a soccer-themed desk with two API hints: lists documents, opens one. I started with the list.

· 350 pts · bealthguy

350 points. Three endpoints, all described on the page. A roster, a recovery flow, and a door.