Writeups on Rizzykun

Securinets CTF 2025: Preliminary

Wed, 15 Oct 2025 01:45:47 +0000

Securinets CTF 2025 OSINT

So, I quickly want to know, who Edmund is and I acquire that he is a game developer since 2000 era.

So I asked chatgpt, what are famous website for game developer & speedrunner in the year 2000 , I go to each website and search his name.

I found his acc

Then, I try to search “speed” in post section of his account

I found few related post.

I believe the link mention is the website of the speedrun.

http://gametrailers.com/gamepage.php?id=2057

So, I try to open the link.

But, when I try to open the link, the page is invalid, so I try wayback

SUN CTF 2025: SOC Shift

Tue, 07 Oct 2025 01:45:49 +0000

Challenge : SOC Shift

Open excel file, have like 10,000 lines . Filter by country ISO code MY

Find sus base64 , go cyberchef Me get flag, me happy ;D

sunctf25{S1EM_b4s1cs_f0r_l0g_4n4Lys1s!}

SUN CTF 2025: Get Clawed

Tue, 07 Oct 2025 01:45:47 +0000

SUN CTF 2025 Forensic

Challenge : Get Clawed

Analyze a disk image and network traffic capture to uncover hidden data.

Open .pcap file find :

Suspicious HTTP GET traffic containing ?guid= stood out — indicative of possible C2-style communication.

REFERENCE :

https://qiaonpc.github.io/post/get-clawed/

https://warlocksmurf.github.io/posts/cyberspacectf2024/

Open disk, find sus:

Use c2 script get link :

https://gist.githubusercontent.com/warlocksmurf/e19b5c0d8ab85e07573203ccaa6b39ef/raw/0b3ee0b5e7bc99bbbd4f618a6e025c6d4d6e3aee/sussy

Base64 it and get what to do with .clawed :

We get the key, decrypt XOR, me can export png now :

Man see flag, man happy

Siber Siaga 2025: Finale

Wed, 01 Oct 2025 09:14:47 +0000

The Starting Point

By Rizzykun

Category: OSINT

Description:

One of our agents managed to locate one of the suspects. We lost contact before he could tell us where he was. This snapshot was the only documentation he could send. Can you find where this place is?

Note: Use the google map name if you have found the location.

Flag format: SIBER25{main_street-town_name-state_name-country}

Answer:

Resource:

So, this is the last place the suspect was seen, okay , Let’s lock in!!

First, we need to identify where is this place, maybe the shops could help?

So, he is near these shops. Let’s try locating every single store.

When googling each of the store names, almost every single one returns that it is a part of multiple branches of a store chain in Russia except for Клубника, салон фотопечати (Strawberry, Photo Printing Salon). This store is an independent and unique store, then, I find a city website named chaykovsky which holds info about the store.

The website pinpoint the exact location of the store and give the address. Then, I enter the address in google Maps and it gave the result:

Then, we get the address , following the flag format we got :

SIBER25{ulitsa_sovetskaya-chaykovsky-perm_krai-russia}

The suspect was last seen located near mall named ТЦ (Мега).

Siber Siaga 2025: Preliminary

Mon, 22 Sep 2025 11:45:47 +0000

Challenge 5 : Dumpster Diving

Solved by: Rizzykun

Description:

Aiya. I accidentally deleted the flag when cleaning up my Desktop.

Flag Format: SIBER25{flag} Zip Password: 0b20ca0c4860364140f51583e32bb28cdeecf13ebad62fd66b4f9786bf2c700d Challenge Creator: @identities

Answer :

Given an image file and .txt file. I immediately opened the image file using Exterro FTK Imager.

As I was traversing through the image file, I found multiple image files in the recycle bin. When I click it to read as ASCII, I get the flag :

Flag = SIBER25{1OokiN6_foR_7R4ShED_1T3ms}

Challenge 6 : Viewport

Solved by: Rizzykun

Description:

Oops. I accidentally deleted the flag when cleaning up my Desktop.

Flag Format: SIBER25{flag} Zip Password: e0ff450ab4c79a7810ad46b45f4b8f10678a63df866757566d17b8b998be4161 Challenge Creator: @identities

Answer :

Just like the Dumpster challenge, I quickly open the image file given using Exterro FTK Imager.

I found out there were multiple interesting file directories, and when for looking.

In the explorer folder, I noticed there are multiple deleted files. So I try to export them to my laptop and try to see it using tools named Thumb cache viewer.

I check every single file and I see the flag in an image. Then I merged all the info from all the images and got the flag.

Flag = SIBER25{V3RY_sMA1L_thUm8n411S}

SUN CTF 2025: Who's Alpha

Mon, 25 Aug 2025 09:14:47 +0000

Chall details

Field	Details
Author	warlocksmurf & Sai
Category	OSINT
Score	260
Description	One of the largest financial institutions in Malaysia, MoneyPro Sdn Bhd, has been breached by a notorious hacker group led by a mysterious figure known only as “Alpha.” As part of the Malaysia Cyber Defend Associate (MCDA) team, your mission is to uncover Alpha’s true identity. Flag format: `sunctf25{Firstname_LastName}`

Interestingly this chall only had 4 out of 81 teams that were able to solve it in time.

The challenge shipped with an incident report on the MoneyPro breach: Investigation Report (PDF).

🕵️‍♂️ Solution

From the Investigation Report given, The only lead we have is the social media account of a user named Bravo. That’s where the OSINT trail begins..

I searched through popular social platforms and eventually located Bravo’s X (Twitter) account.

Scrolling through his timeline revealed an interesting clue—a suspicious Google Drive link:

Exploring the Google Drive

The Drive contained:

A folder full of logos
A file named Private.zip
A Note.txt file

Opening the note revealed a password hint: it was a combination of Bravo’s mother’s name and an important day (the day he signed a RM10,000 contract). Both details can be found in his X posts.

Unlocking the Zip

With the password reconstructed, I unzipped Private.zip to find intelligence on the TigerP4tch group. Inside Bravo’s folder, I finally uncovered a partial name:

Lucas M.

The hunt for his last name was on.

Following Charlie’s Trail

Inside Charlie’s folder, a chat log between Bravo and Charlie revealed another breadcrumb. Bravo hinted that something important was stored on Pastebin.

Pastebin Recon

After some digging, I located a Pastebin account under the username Alice_R. However, the paste was password-protected.

Back in the Google Drive folder full of logos, I noticed Alice’s shop logo featuring a rose. The chat log mentioned the password is the flower on her shop logo. Trying rose as the password worked, unlocking the paste.

The Final Reveal

The unlocked paste finally exposed Alpha’s full name:

Lucas Moore

With that, Alpha’s identity was confirmed.

WHY CTF 2025: Shoe Shop

Mon, 25 Aug 2025 09:14:47 +0000

📝 Description

We just launched a brand-new shoe store to sell some fancy kicks. Unfortunately, the admin beat us to it and already snagged the exclusive pair in his cart. 👟✨ But hey—feel free to explore the shop, try out the cart, and see what you can uncover.

💡 Solution Walkthrough

We’re dealing with an online shoe store where you can:

Sign up for an account
Add items to your cart
View your cart contents

Pretty normal e-commerce flow, right? Or… is it? 👀

🔓 The IDOR Moment

While browsing the cart, something caught my eye… The URL looked like this:

page=cart&id=694

That id parameter smells suspicious. What if we tweak it? 🤔

So let’s try checking id #1 cart:

https://shoe-shop-1.ctf.zone/index.php?page=cart&id=1

Bingo! 🎯 We just accessed another user’s cart. And guess who that is? Yep—the admin.

🏁 Flag

And there it is: flag{00f34f9c417fcaa72b16f79d02d33099}

⚡Lesson learned: Always validate user access before showing sensitive data.🚨

Writeups on Rizzykun

Securinets CTF 2025: Preliminary

Securinets CTF 2025 OSINT

SUN CTF 2025: SOC Shift

SUN CTF 2025: Get Clawed

SUN CTF 2025 Forensic

Siber Siaga 2025: Finale

The Starting Point

Siber Siaga 2025: Preliminary

Challenge 5 : Dumpster Diving

Challenge 6 : Viewport

SUN CTF 2025: Who's Alpha

🕵️‍♂️ Solution

Tracking Bravo’s Social Media

Exploring the Google Drive

Unlocking the Zip

Following Charlie’s Trail

Pastebin Recon

The Final Reveal

WHY CTF 2025: Shoe Shop

📝 Description

💡 Solution Walkthrough

🔓 The IDOR Moment

🏁 Flag