KITCTF

Talk: Attacking and Defending GitHub Actions - Is it safe now?

Thu, 13 Aug 2026 00:00:00 +0000

You know GitHub Actions, these small building blocks that make your dev life easier… But they can also get you pwned in no time, if you are not careful.

The talk covers:

the basic structure of a GitHub Actions workflow.
the permission model of GitHub Actions.
insecure templating and executing user-controlled code in privileged workflows.
safer checkout defaults in actions/checkout@v7.
cache poisoning in workflows, including a case study on tempo/tempo-xyz.
new defenses: workflow execution protections and planned cache hardening.

The slides can be found here. The talk was held on 2026-07-02.

Talk: How to decompile a DSP architecture

Fri, 05 Jun 2026 00:00:00 +0000

This talk was held at GPN24, running from June 04, 2026 to June 07, 2026 at ZKM and HfG in Karlsruhe.

The slides are here: Slides
The link to the recording will be added here once available

Introduction

About a year ago, a friend gave me a binary to reverse engineer to playtest for a CTF. As the architecture lacked the necessary tooling, I started developing a decompiler plugin. What started as a small side project for learning, has been a part of my life over the last year. The project grew as my understanding of the architecture deepened, and it took several API updates to finally work. Join me on a journey into the rabbit hole of architecture features and how the decompiler works.

This talk will discuss the TMS320C6x Digital Signal Processor (DSP) family and use Binary Ninja as the decompiler.

Description

Decompilers take a compiled executable and aim to recover higher-level structures close to the original source code. As the name implies, they try to reverse the work of a compiler. This process is structured into many analysis steps of which most are independent of the architecture. However, a decompiler needs to support an architecture to get the required information for its analysis. Using a decompilers API, an architecture plugin can extend this support to any architecture (in theory).

In this talk, I will share my experiences from building such a plugin, and talk about occurring problems and solutions. You will learn the core tasks of an architecture plugin and how to fulfill them. The talk will discuss the TMS320C6x architecture family from high-level overview to opcode details. Both parts are combined to arrive at a plugin that can handle DSP architecture features. Along the way, we will discover limitations of APIs, compiler quirks and specification errors.

The talk uses Binary Ninja and its API. Some parts are specific to this tool, many concepts (and sadly problems) apply to other decompilers as well.

Intro Talks Summer 2026

Thu, 16 Apr 2026 00:00:00 +0000

Starting on the 7th of May, we will be holding introductory talks for the main categories of Capture the Flag. We meet on Thursdays at 7pm in the CS building 50.34 room -102. Please bring a laptop if possible.

Attention: This is not our customary meeting place. We meet there for space reasons.

07.05.26: What are CTFs? & Web Security
- Intro Slides
- Web Slides
21.05.26: Reverse Engineering
- Rev Slides
11.06.26: Binary Exploitation
- Pwn Slides
18.06.26: Cryptography
- Crypto Slides

Please note that the dates are a little spread out this year because of holidays and the GPN. Slides will be published here after the talks.

LakeCTF 2025 – pls respond – Writeup

Sun, 30 Nov 2025 00:00:00 +0000

Intro Talks Winter 2025

Fri, 17 Oct 2025 00:00:00 +0000

Starting on the 13th of November, we will be holding introductory talks for the main categories of Capture the Flag. We meet on Thursdays at 7pm in the CS building 50.34, room -101. Please bring a laptop if possible.

Attention: This is not our customary meeting place. We meet there for space reasons.

13.11.25: What are CTFs? & Web Security
- Intro Slides
- Web Slides
20.11.25: Reverse Engineering
- Rev Slides
27.11.25: Binary Exploitation
- Pwn Slides
04.12.25: Cryptography
- Crypto Slides

Slides will be published here after the talks.

Report: Flag Sharing Incidents During GPN CTF 2025

Tue, 01 Jul 2025 00:00:00 +0000

Background

Last year we organized GPN CTF 2024. During the event we received multiple reports from participants via Discord stating they had been approached by others asking for flags. In most cases, we responded by handing out an invalid but realistic fake flag. We later used these flags to identify teams engaging in flag-sharing.

Given the frequency of these incidents, we decided to implement dynamic, team-specific flags for GPN CTF 2025.

Dynamic Flags in 2025

For the 2025 event, most challenges featured team-specific dynamic flags, generated to appear similar at first glance, with differences in casing and typical leet-speak substitutions.

A team was assigned a flag when they either spawned their first instance of the challenge or downloaded its handout.

Throughout the event, we were contacted twice by teams who had been asked for a flag and handed out a wrong one – both of which allowed us to identify the submitting team.

To aid detection, we logged every flag submission in our CTF system’s database, including timestamps, submitting teams, and users.

After the event, we queried the database for all cases where a team submitted a valid flag of another team for a challenge they had not yet solved. This yielded 53 incidents, excluding submissions of known fake flags. In analyzing these incidents, we also reviewed instances where shared flags were submitted after the team’s correct submission.

Investigation Summary

In total, we reviewed 53 incidents, plus an additional 9 cases involving known fake flags.

For each incident, we analyzed team activities, submission timings, and flag ownership:

7 incidents had plausible non-malicious explanations. While still technically detected correctly, these were not pursued further.
3 teams were directly linked to fake flag submissions, providing conclusive evidence of flag-sharing.
2 teams were observed swapping flags shortly before the competition ended.

In many cases, the submitting team had never spawned an instance for the challenge or downloaded the handout, making it clear that they obtained the flag externally.

Typically, only individual players within teams were involved in these incidents.

Involved Teams and Incidents

All times are provided in UTC+2.

0bug

Submitted a flag for nasa originating from NOVA at 2025-06-21 09:53:25.

0day@freddy

Their flags for hinting, mini-dsp, the-old-way, free-parking-network, and intro-web-2 were later submitted by FPTU Ethical Hacker Club during the final 6 hours of the competition.

0xfun

Submitted a flag for the-old-way belonging to NOVA at 2025-06-21 09:47:11.

4O4NULLERS

Submitted a previously-known fake flag for real-christmas at 2025-06-20 20:22:18, as well as one for intro-web-1 between 2025-06-20 13:27:52 and 2025-06-20 13:57:28 4 times.
Their flags for intro-web-1, intro-web-2, and the-old-way were later submitted by ACSS Override.

ACSS Override

Submitted flags for intro-web-1, intro-web-2, and the-old-way that belonged to 4O4NULLERS.

Band 0xF Br3ach3rs

Submitted flags for check-this-out and image-contest belonging to Nc{Cat}.

BigBoys

Their flag for broccoli was submitted by seagull at 2025-06-20 18:29:02.

FPTU Ethical Hacker Club

Submitted flags for hinting, mini-dsp, the-old-way, free-parking-network, and intro-web-2 belonging to 0day@freddy during the competition’s final 6 hours.

Ganesh

Submitted flags from xupa curintia for the-old-way and hinting.

HoleInBottle

Their flags for intro-web-3 and intro-web-4 were submitted by ncodeks.
Submitted a flag for hinting that belonged to ncodeks.

Ialone

Their flag for mini-dsp was submitted by omtose phellack.

MindCrafters

Their flag for mini-dsp was submitted by NOVA at 2025-06-20 14:04:23.

NOVA

Solved nasa at 2025-06-21 09:41:17; their flag later appeared with 0bug at 2025-06-21 09:53:25.
Submitted fake flags for real-christmas at 2025-06-20 20:17:05 and 20:24:35, with an intermediate attempt by 4O4NULLERS.
Submitted MindCrafters’ flag for mini-dsp.
Their flag for the-old-way was later submitted by 0xfun.

Nc{Cat}

Their flags for check-this-out and image-contest were submitted by Band 0xF Br3ach3rs.
Submitted flags for restricted-oracle and free-parking-network belonging to SNI.

PuuPuu

Submitted flags for no-nc and note-editor belonging to RaptX.

RaptX

Their flags for no-nc and note-editor were submitted by PuuPuu.
Their restricted-oracle flag was submitted by momo and capablanca.
Submitted a flag for intro-web-1 belonging to PuuPuu.

SNI

Their flags for restricted-oracle and free-parking-network were submitted by Nc{Cat}.

Seagull

Submitted a flag for broccoli belonging to BigBoys at 2025-06-20 18:29:02.

TroJeun

Submitted a flag for free-parking-network belonging to Vuln3ra at 2025-06-20 23:39:18.

Vuln3ra

Their free-parking-network flag was submitted by TroJeun.

Zerolight

One player was active and submitted flags on both Zerolight and kBxAc.
A known fake flag was also submitted for intro-web-2 at 2025-06-20 13:28:51

capablanca

Submitted a flag for restricted-oracle belonging to RaptX at 2025-06-21 23:59:02.

kBxAc

One player participated and submitted flags on both Zerolight and kBxAc.

momo

Submitted a flag for restricted-oracle belonging to RaptX at 2025-06-21 23:54:58.

ncodeks

Submitted HoleInBottle’s flags for intro-web-3 and intro-web-4.
Their flag for hinting was submitted by HoleInBottle.

omtose phellack

Submitted a flag for mini-dsp belonging to Ialone at 2025-06-21 12:01:53.

xupa curintia

Their flags for the-old-way and hinting were submitted by Ganesh.

Graph of Shared Flags

Statements

We asked all involved teams to open a ticket in order to investigate the incidents and clear up misconceptions. Additionally, we allowed them to provide a statement in text form to provide their perspective on the situation. We publish those statements below.

capablanca

During the competition, we opened three support tickets requesting the removal of a newly joined member after observing that he was asking for solutions and appeared to be seeking them on behalf of another team. This behavior is unethical, violates competition rules, and is not tolerated by our team. Although the member was not removed from the CTF platform, we promptly removed him from our Team server. He submitted a flag for a challenge we had already solved while continuing to request additional solutions on private messages, requests we explicitly denied.

A second member, also participating with our team for the first time, submitted a flag for a different challenge. He provided a plausible explanation of how he obtained it, and based on the information available at the time, the Captain chose to trust him. At no point did he demonstrate any intention to share or request flags. However, after the announcement of the flag sharing, when we followed up for further clarification, he gave an explanation we were unable to verify. Both of these individuals were removed and banned from the team.

We acted in good faith throughout the competition and took proactive steps to maintain its integrity. As well as collaborated to the investigation when we were told about the irregularities.

kBxAC

Not much to report Just we were not aware our team mate was playing from another team we got to only when you told us just as I failed as Captain and a good teammate and We team kBxAc promised that this will not happen again in any of the ctf and once again we are sorry this happened

Nc{Cat}

Its regrettable that flag sharing did happen under our team, but we were not at all aware about this. One member was actively part of both SNI and Nc{Cat}, and another member was identified to be leading his own personal team for ctftime points. The guilty members were banned from the team as soon as we got to know about this. We will be doing a more careful background check of current and future members to prevent this from happening again.

NOVA

Official Statement from Team NOVA Regarding Flag Sharing Incident

We, Team NOVA, would like to formally present our position regarding the recent flag sharing incident during GPNCTF:

Pre-existing Suspicions:Prior to the event, we had ongoing concerns about a specific individual, dev_fire, being associated with multiple teams and potentially compromising our internal communications.

Controlled Integrity Test (Poisoned Flags):To validate these concerns, we strategically shared fake, invalid flags within our private team space during the competition. These flags were intentionally crafted to detect potential leaks and were never intended for legitimate submission.

Immediate and Transparent Reporting:We opened an official ticket during the CTF itself to transparently report this situation and provide full context for any unusual flag activity that might originate from our team. This was done to demonstrate good faith and maintain the competition’s integrity.

Acknowledgement of Process Oversight:In hindsight, we recognize that conducting such an internal test without prior coordination with event organizers was not ideal. Our intention was solely to safeguard competition integrity, but we acknowledge that our method conflicted with established rules.

Respect for the Organizers’ Decision:While we regret the disqualification outcome, we fully respect the organizers’ commitment to ensuring fairness across all teams. We appreciate the opportunity to share our perspective and clarify that at no point were valid, legitimate flags shared or compromised by our actions.

Commitment to Future Integrity:Moving forward, Team NOVA will:

Coordinate directly with organizers before competitions if internal leak concerns arise.

Implement stricter internal controls, including verified-only flag channels and comprehensive membership audits.

We appreciate the organizers’ recognition of our cooperation and respectfully request that our proactive approach, including the fact that we opened a ticket during the CTF itself, be noted in the final report to help preserve the integrity and reputation of Team NOVA.

Thank you for your time and understanding.

Team NOVA

RaptX

RaptX provided their statement as a PDF: statement.pdf

TroJeun

one of our players played the CTF for another team and submitted a flag from another team without our knowledge, the player who did it is now kicked out of the team, and it was decided that the credentials of the CTF being played should never be shared in a public channel but in a private channel for the specific CTF

RealworldCTF 2024 – Protected-by-Java-SE – Writeup

Wed, 07 May 2025 00:00:00 +0000

Intro Talks Summer 2025

Wed, 23 Apr 2025 00:00:00 +0000

Starting on the 08th of May, we will be holding introductory talks for the main categories of Capture the Flag. We meet on Thursdays at 7pm in the CS building 50.34, room -101. Please bring a laptop if possible.

Attention: This is not our customary meeting place. We meet there for space reasons.

08.05.25: What are CTFs? & Web Security
- Intro Slides
- Web Slides
15.05.25: Reverse Engineering
- Rev Slides
22.05.25: Binary Exploitation
- Pwn Slides
05.06.25: Cryptography (room -102)

Slides will be published here after the talks.

Talk: Windows User-space Emulation

Fri, 14 Mar 2025 00:00:00 +0000

Deep dive into Windows user-space emulation and why it’s cool.

The slides can be found here. The talk was held on the 13th of February 2025.

Intro Talks WS 2024/2025

Fri, 11 Oct 2024 00:00:00 +0000

Starting on the 07th of November, we will be holding introductory talks for the main categories of Capture the Flag. We meet on Thursdays at 7pm in the CS building 50.34, room -101. Please bring a laptop if possible.

Attention: This is not our customary meeting place. We meet there for space reasons.

07.11.24: What are CTFs? & Web Security
- Intro Slides, Web Slides
14.11.24: Reverse Engineering
- Rev Slides
21.11.24: Binary Exploitation
- Pwn Slides
28.11.24: Cryptography
- Crypto Slides

Slides will be published here after the talks.