https://ctf.adamino.dk/categories/forensics/Recent content in Forensics on Adamino CTF WriteupsHugoenAdamino 2023Sun, 23 Aug 2026 15:15:00 +0100https://ctf.adamino.dk/tools/forensics/binwalk/Sun, 23 Aug 2026 15:15:00 +0100https://ctf.adamino.dk/tools/forensics/binwalk/<h1 id="binwalk-finding-whats-hidden-inside-a-file">binwalk: Finding What&rsquo;s Hidden Inside a File<a href="#binwalk-finding-whats-hidden-inside-a-file" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h1> <p>Files lie about where they end. A JPEG can have a ZIP archive glued to its tail, a firmware image is really a dozen filesystems stacked back-to-back, and a &ldquo;picture&rdquo; might be three files in a trenchcoat. <a href="https://github.com/ReFirmLabs/binwalk">binwalk</a> scans a file for the <em>signatures</em> of other file formats embedded anywhere inside it, then extracts them. It&rsquo;s the go-to tool for firmware analysis and for the classic &ldquo;there&rsquo;s more to this file than meets the eye&rdquo; forensics/OSINT puzzle.</p>https://ctf.adamino.dk/tools/forensics/tshark/Sun, 23 Aug 2026 14:45:00 +0100https://ctf.adamino.dk/tools/forensics/tshark/<h1 id="tshark--wireshark-reading-packet-captures">tshark &amp; Wireshark: Reading Packet Captures<a href="#tshark--wireshark-reading-packet-captures" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h1> <p>When a forensics challenge hands you a <code>.pcap</code> or <code>.pcapng</code>, <a href="https://www.wireshark.org/">Wireshark</a> and its command-line sibling <strong>tshark</strong> are how you turn a wall of packets into an answer. Wireshark&rsquo;s GUI is unbeatable for exploring an unfamiliar capture; <code>tshark</code> is unbeatable for extracting exactly the fields you need into a form you can script against. You&rsquo;ll use both — GUI to find the needle, <code>tshark</code> to pull it out in bulk.</p>https://ctf.adamino.dk/brunner/forensics/2026/rubiks-cube/Sat, 22 Aug 2026 21:34:01 +0200https://ctf.adamino.dk/brunner/forensics/2026/rubiks-cube/<p><strong>Challenge Name:</strong> forensics_rubiks-cube</p> <p><strong>Category:</strong> Forensics</p> <p><strong>Difficulty:</strong> Medium</p> <p><strong>Author:</strong> Vincent</p> <h2 id="challenge-description">Challenge Description<a href="#challenge-description" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <blockquote> <p>Our coworker just got a new Rubik&rsquo;s Cube and it is driving everyone in the office crazy. But more importantly, it is decreasing their productivity and thereby shareholder value.</p>https://ctf.adamino.dk/nc3/forensics/2025/nissrensics-lykkehjulet/Thu, 11 Dec 2025 21:40:00 +0100https://ctf.adamino.dk/nc3/forensics/2025/nissrensics-lykkehjulet/<h2 id="challenge-name">Challenge Name:<a href="#challenge-name" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Nissrensics: Lykke(h)julet</p> <h2 id="category">Category:<a href="#category" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Forensics</p>https://ctf.adamino.dk/nc3/forensics/2025/nissrensics-forkromet-mellemgasfordeler/Thu, 11 Dec 2025 21:30:00 +0100https://ctf.adamino.dk/nc3/forensics/2025/nissrensics-forkromet-mellemgasfordeler/<h2 id="challenge-name">Challenge Name:<a href="#challenge-name" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Nissrensics: Forkromet Mellemgasfordeler</p> <h2 id="category">Category:<a href="#category" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Forensics</p>https://ctf.adamino.dk/nc3/forensics/2025/nissrensics-m%C3%B8rkets-dal/Thu, 11 Dec 2025 21:20:00 +0100https://ctf.adamino.dk/nc3/forensics/2025/nissrensics-m%C3%B8rkets-dal/<h2 id="challenge-name">Challenge Name:<a href="#challenge-name" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Nissrensics: Mørkets Dal</p> <h2 id="category">Category:<a href="#category" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Forensics</p>https://ctf.adamino.dk/nc3/forensics/2025/nissrensics-r%C3%A6v-og-n%C3%B8gler/Thu, 11 Dec 2025 21:10:00 +0100https://ctf.adamino.dk/nc3/forensics/2025/nissrensics-r%C3%A6v-og-n%C3%B8gler/<h2 id="challenge-name">Challenge Name:<a href="#challenge-name" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Nissrensics: Ræv og Nøgler</p> <h2 id="category">Category:<a href="#category" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Forensics</p>https://ctf.adamino.dk/nc3/forensics/2025/nissrensics-vandrestien/Thu, 11 Dec 2025 21:00:00 +0100https://ctf.adamino.dk/nc3/forensics/2025/nissrensics-vandrestien/<h2 id="challenge-name">Challenge Name:<a href="#challenge-name" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Nissrensics: Vandrestien</p> <h2 id="category">Category:<a href="#category" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Forensics</p>https://ctf.adamino.dk/nc3/forensics/2025/makulatoren/Fri, 05 Dec 2025 10:00:57 +0100https://ctf.adamino.dk/nc3/forensics/2025/makulatoren/<h2 id="challenge-name">Challenge Name:<a href="#challenge-name" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Makulatoren</p> <h2 id="category">Category:<a href="#category" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Forensics</p>https://ctf.adamino.dk/nc3/det-store-nissehack/2024/det-store-nissehack-alternativ-kodedeling/Tue, 17 Dec 2024 18:40:25 +0100https://ctf.adamino.dk/nc3/det-store-nissehack/2024/det-store-nissehack-alternativ-kodedeling/<h2 id="challenge-name">Challenge Name:<a href="#challenge-name" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Det store nissehack: Alternativ Kodedeling</p> <h2 id="category">Category:<a href="#category" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Det store nissehack</p>https://ctf.adamino.dk/nc3/det-store-nissehack/2024/det-store-nissehack-gerningsgnomens-afsloering/Tue, 17 Dec 2024 18:40:25 +0100https://ctf.adamino.dk/nc3/det-store-nissehack/2024/det-store-nissehack-gerningsgnomens-afsloering/<h2 id="challenge-name">Challenge Name:<a href="#challenge-name" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Det store nissehack: Gerningsgnomens Afsløring</p> <h2 id="category">Category:<a href="#category" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Det store nissehack</p>https://ctf.adamino.dk/nc3/det-store-nissehack/2024/det-store-nissehack-serverskjulet/Tue, 17 Dec 2024 18:40:25 +0100https://ctf.adamino.dk/nc3/det-store-nissehack/2024/det-store-nissehack-serverskjulet/<h2 id="challenge-name">Challenge Name:<a href="#challenge-name" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Det store nissehack: Serverskjulet</p> <h2 id="category">Category:<a href="#category" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Det store nissehack</p>https://ctf.adamino.dk/nc3/det-store-nissehack/2024/det-store-nissehack-ondsindede-loginfors%C3%B8g/Tue, 17 Dec 2024 18:39:25 +0100https://ctf.adamino.dk/nc3/det-store-nissehack/2024/det-store-nissehack-ondsindede-loginfors%C3%B8g/<h2 id="challenge-name">Challenge Name:<a href="#challenge-name" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Det store nissehack: Ondsindede Loginforsøg</p> <h2 id="category">Category:<a href="#category" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h2> <p>Det store nissehack</p>