Overview

Challenge	Difficulty	Points	Category	Flag
Blackout Profile	Easy	10	Crypto/Web	`CYS{idor_is_just_an_object_reference}`
Two Locks, One Message	Easy	10	Cryptography	`CYS{c4es4r_x0r_2x}`
Campus Helpdesk	Easy	20	Web	`CYS{campus_helpdesk_7f29c1a8}`
The Hacker Left a Note	Easy-Medium	10	Web Recon, Basic Web Security	`FLAG{debugging_is_recon}`
XORception	Easy	10	Cryptography	`CTF{x0r_iS_fUn}`
Two Truths and a Steg	Easy	10	Steganography	`CYS{th3_d1ff_w4s_th3_p01nt}`
The King's Last Recipe	Easy	10	Cryptography	`CYS{B3LL4_C1A0}`
The Archive Behind the Chunk	Easy	10	Steganography	`CYS{W4k4nd443v3R}`
Reconfiguration Terminal	Easy	10	Web Exploitation	`CYS{7h3_h0ur6l455_5h4773r3d_bu7_m3m0ry_r3m41n5_1n_fr46m3n75_pl3453_l1573n_cl053r_65537_2025}`

Blackout Profile

Author: Advika

This is a crypto+web-based CTF challenge demonstrating an Insecure Direct Object Reference (IDOR) vulnerability.

Firstly for the Crypto part:

We can use common online tools like Cyberchef to solve the following 3 challenges.

The challenges are basic base64 encoding, caeser cipher (bruteforce), simple xor with the given key.

For the IDOR part: First, we access the login page

The application provides a login form. Use the credentials provided with the previous challenge:

Username: Alice Password: very_secure_pwd

After logging in, the application redirects to:

/idor/profile/1001

Since the profile ID is directly exposed in the URL, we test whether changing it allows access to another user’s profile.

We change the profile value 1001 to 1

The application returns another employee profile, confirming that it does not properly verify whether the authenticated user is authorized to access the requested profile.

The vulnerability is an Insecure Direct Object Reference (IDOR). The application exposes an internal object identifier directly in the URL:

/idor/profile/

The server accepts an arbitrary user_id and retrieves the corresponding profile without checking whether the current user is authorized to access it.

Flag

CYS{idor_is_just_an_object_reference}

Two Locks, One Message

Author: Sagnik

This is a cryptography-based CTF using two layers of encryption: a Caesar cipher and XOR.

From clue.txt, we determine the Caesar shift is 3 and the XOR key is 42 (0x2A).

A simple google search gives you the second lock key. :D

Since the message was encrypted twice, we reverse the operations during decryption.

The encrypted data is:

6c687c514c1e425c1e5f754b1a5f75184b57

First, undo the XOR layer using key 2A:

FBV{f4hv4u_a0u_2a}

Then undo the Caesar shift by shifting the letters back by 3:

CYS{c4es4r_x0r_2x}

Flag

CYS{c4es4r_x0r_2x}

Campus Helpdesk

Author: Dibyadipan (0DayMonxrch)

This is a web-based CTF challenge involving Stored Cross-Site Scripting (XSS).

First, submit a normal ticket and test whether HTML is interpreted in the ticket description:

<b>test</b>

The text is rendered as HTML, indicating that the description is not safely escaped.

Next, confirm JavaScript execution:

  
<script>alert(location.origin)</script>

The alert shows the challenge origin, confirming that JavaScript executes in the context of the helpdesk application.

Inspecting the ticket HTML reveals a hidden internal endpoint:

data-review-endpoint="/api/internal/note"

The endpoint relies on the browser’s existing review_session cookie. Although the cookie is HttpOnly and cannot be read using document.cookie, the browser automatically includes it in same-origin requests.

We can therefore use the stored XSS to make an authenticated request:

  
<script>
fetch('/api/internal/note', {method: 'POST'})
    .then(r => r.text())
    .then(flag => document.body.innerText = flag);
</script>

Opening the ticket again executes the payload, makes the authenticated request, and displays the flag.

Flag

CYS{campus_helpdesk_7f29c1a8}

The Hacker Left a Note

Author: Shruthi

This is a web reconnaissance challenge where the flag is hidden through a chain of developer artifacts.

First, visit the homepage

Viewing the page source reveals a hidden comment:

<!-- TODO: remove debug endpoint before deployment -->

Following the clue, visit: /debug endpoint

The debug console contains a note mentioning that the backup log was saved as backup.txt in the static assets folder.

We then visit: /static/backup.txt

The log contains a temporary access code:

Temporary access code: 4832

The surrounding log indicates that the code is intended for the /profile endpoint.

Finally enter the code and the page reveals the flag.

Flag

FLAG{debugging_is_recon}

XORception

Author: Guhan (DaBot)

This is a cryptography-based CTF using a repeating-key XOR cipher.

The provided ciphertext is:

3b3b340317420a301b2b30142d010f

The challenge uses the repeating key:

xor

Since XOR is its own inverse, we can decrypt the ciphertext by applying the same key again.

Using CyberChef, first apply From Hex, followed by XOR with:

Key: xor
Key type: UTF-8
Scheme: Standard

The repeating key is applied across the ciphertext:

xor xor xor xor xor

This produces the original plaintext:

CTF{x0r_iS_fUn}

Flag

CTF{x0r_iS_fUn}

Two Truths and a Steg

Author: Sagnik

This is a steganography challenge involving two seemingly identical images.

We are given:

before.png
after.png

Although the images look identical, their SHA-256 hashes are different, indicating that the underlying files have been modified.

We can compare the images directly using ImageMagick:

```text id=”4t7h7w” magick compare before.png after.png -compose src diff.png

This generates `diff.png`, which highlights the differences between the two images.

Opening the difference image reveals the hidden message:

```text id="4k7g4c"
CYS{th3_d1ff_w4s_th3_p01nt}

Flag

CYS{th3_d1ff_w4s_th3_p01nt}

The King's Last Recipe

The King’s Last Recipe

Author: Utkarsh

This is a cryptography-based CTF involving multiple encoding layers and hidden clues.

The original Google Doc contains hidden white-on-white text. Selecting the page contents reveals:

K;v>Sk,6xIrfXt3EJw<nlld)t7h9S2RuIR'Diqb/ysC3?NaZ=1h\sT6:su[llzdxGh1!cyWbK'j9XK6sHkkppx57KzH6({(Z@=vkhV4/yak!kv41Hm_LQ'$<ZT)(9E

This string is encoded using Base92 followed by ROT13. Reversing these operations gives a link to a second Google Doc.

The second document contains the encrypted key.

The story in the first document provides the encoding layers in order:

64 → 64 → 8 → 32 → 45 → 58 → 62 → 64 → 92

Therefore, the layers must be decoded in reverse order:

Base92 → Base64 → Base62 → Base58 → Base45 → Base32 → Octal → Base64 → Base64

Using CyberChef with the corresponding From Base operations reveals:

B3LL4_C1A0

Flag

CYS{B3LL4_C1A0}

The Archive Behind the Chunk

Author: Utkarsh

This is a steganography challenge involving image metadata, an encrypted payload, and a custom PNG chunk.

We are given:

CTF1.png
CTF2.png

First, inspect CTF1.png using exiftool:

exiftool CTF1.png

The metadata contains a Base64-encoded payload and the hint:

key - thor

Decode the payload and decrypt it using age:

base64 -d encoded.txt > secret.age
age -d -p secret.age

Using the password thor reveals a link to a Word document.

The document contains several images. Inspecting their metadata reveals the first half of the flag in one image’s Description field.

Next, inspect CTF2.png. Running:

pngcheck -v CTF2.png

reveals an unusual custom PNG chunk. The hidden data can also be located using:

strings CTF2.png | grep drive.google.com

This reveals a Google Drive folder containing a video. The video provides the second half of the flag.

Combining both fragments gives:

CYS{W4k4nd443v3R}

The flag would be:

CYS{W4k4nd443v3R}

Flag

CYS{W4k4nd443v3R}

Reconfiguration Terminal

Author: Yashwant Gokul P

This is a web exploitation challenge involving predictable resource enumeration.

The hint:

Numbers are truth, and truth always leaks through the cracks

suggests looking for numeric endpoints. Checking robots.txt reveals:

Disallow: /safe/420

Testing /safe/1, /safe/2, and /safe/3 returns individual characters from the flag, confirming that the /safe/<id> endpoint can be enumerated.

Instead of checking every page manually, we automate the requests and extract the character from each response until a 404 is reached.

  
import requests
from bs4 import BeautifulSoup

BASE = "https://reconfiguration-terminal.netlify.app/safe/{}"
flag = ""

for i in range(1, 1000):
    r = requests.get(BASE.format(i))

    if r.status_code == 404:
        break

    soup = BeautifulSoup(r.text, "html.parser")
    p = soup.find("p")

    if p:
        flag += p.text.strip()

print(flag)

The enumeration reconstructs the complete flag.

The flag would be:

CYS{7h3_h0ur6l455_5h4773r3d_bu7_m3m0ry_r3m41n5_1n_fr46m3n75_pl3453_l1573n_cl053r_65537_2025}

Flag

CYS{7h3_h0ur6l455_5h4773r3d_bu7_m3m0ry_r3m41n5_1n_fr46m3n75_pl3453_l1573n_cl053r_65537_2025}

CyberConverge 2026

Overview

Blackout Profile

Flag

Two Locks, One Message

Two Locks, One Message

Flag

Campus Helpdesk

Campus Helpdesk

Flag

The Hacker Left a Note

The Hacker Left a Note

Flag

XORception

XORception

Flag

Two Truths and a Steg

Two Truths and a Steg

Flag

The King's Last Recipe

The King’s Last Recipe

Flag

The Archive Behind the Chunk

The Archive Behind the Chunk

The flag would be:

CYS{W4k4nd443v3R}

Flag

Reconfiguration Terminal

Reconfiguration Terminal

The flag would be:

CYS{7h3_h0ur6l455_5h4773r3d_bu7_m3m0ry_r3m41n5_1n_fr46m3n75_pl3453_l1573n_cl053r_65537_2025}

Flag