chris@mochajava:~/ctf$
CTF challenges are one of the few interactive things a static site does perfectly — because the flag is the URL. Solve the puzzle, guess the path, and the page that loads is your proof.
Wrong answer? The custom 404 does the rejecting.
# cat level-01.txt
desert_bridge — 50 points
-----BEGIN PGP SIGNED MESSAGE-----
VGhlcmUgYXJlIHR3byByb2FkcyBmcm9tIE1hZ2RhbGVuYSB0byBOb2dhbGVz
LiBPbmUgaXMgZW5naW5lZXJlZCBhbmQgcGF2ZWQuIFRoZSBvdGhlciBpcyBh
IGRpcnQgcGF0Y2ggdGhhdCB3aW5kcyB0aHJvdWdoIHVuZGVmZW5kZWQgcGFz
dHVyZS4gT25seSBvbmUgaGFzIGEgd2FybmluZyBzaWduIGF0IHRoZSBlbnRy
YW5jZS4gV2hpY2ggb25lIGRvIHRoZSBsb2NhbHMgdXNlIGZvciByb3V0aW5l
IHRyYXZlbD8=
Cg==
-----END PGP SIGNED MESSAGE-----
The code above is base64 — decode it, and the answer is your flag. Lowercase, underscores for spaces.
There are multiple valid answers for this one. Visit /ctf/<your_answer> to claim your points.
[>] hint 1/5
The strange-looking text isn't encrypted. It's an encoding.
[>] hint 2/5
The text uses a very common encoding found on the web. Notice it consists only of letters, numbers, and ends with =.
[>] hint 3/5
Try decoding it as Base64.
[>] hint 4/5
After decoding, you'll have a short story. Read it carefully — the answer isn't hidden in the encoding anymore.
[>] hint 5/5
The locations mentioned are real places in Sonora, Mexico. The answer starts with a 'c'. Think about what locals call the paved highway between Magdalena and Nogales — the one with the warning sign.
# cat level-02.txt
orientation — 100 points
saguaro_l02.jpg
This photo carries more than pixels. Find what it's carrying, read it the way the Romans wouldn't, and answer the question it asks.
Lowercase. Visit /ctf/<your_answer> to claim your points.
[>] hint 1/5
The image looks ordinary because the pixels are ordinary. Photos carry data that isn't picture.
[>] hint 2/5
Download the file and inspect its metadata. exiftool is the classic; even strings saguaro_l02.jpg will stumble onto it.
[>] hint 3/5
The comment you found isn't gibberish — every letter has moved the same distance. Thirteen is a number with a special property in a 26-letter alphabet.
[>] hint 4/5
tr 'A-Za-z' 'N-ZA-Mn-za-m' — or any ROT13 decoder. Now you have a question about saguaro relocation. This is fieldcraft, not cryptography. Research it.
[>] hint 5/5
The plant doesn't care which side you mark. It cares that it goes back in the ground facing exactly the way it came out. So crews pick one reference direction and never deviate — the same one every time, on every job, because consistency is what prevents a rotated replant. Ours is the shaded side, the one the noon sun never touches.
no JS · no trackers · static files · flags in URLs · last updated July 2026