CTF Writeup 500 pts

Sanity Check

An OSINT challenge combining social media investigation, hexadecimal decoding, and single-byte XOR analysis. The solution follows a four-member cybersecurity collective to a LinkedIn comment, where a hexadecimal payload and the reply 0x03 reveal the flag.

Suraj Vishwanath
4 min read
The key clues were the four-member collective and the instruction to look where professionals share their work and updates. These pointed toward Not_SDE and its LinkedIn activity.

1. Initial Reconnaissance

The description suggested two things to investigate:
  • "Four-member cybersecurity collective" — a clue to the group's identity.
  • "Where professionals share their work and updates" — a hint pointing toward LinkedIn.
Following the announcement and related cybersecurity activity led to Not_SDE. Its LinkedIn profile describes it as an independent cybersecurity collective formed by four security professionals.
I then examined Not_SDE's LinkedIn posts and interactions with BSides Mumbai. A post about the BSides Mumbai 2026 CTF registration announcement looked ordinary, but its comments contained an unusual hexadecimal string.

2. Identifying the Encoded Message

The hexadecimal payload found in the LinkedIn comments was:
text
41 50 6a 67 66 70 5c 4e 76 6e 61 62 6a 78 74 66 6f 60
6c 6e 66 5c 77 6c 5c 61 70 6a 67 66 70 6e 76 6e 61 62
6a 5c 60 77 65 5c 31 33 31 35 7e
Each pair of hexadecimal digits represents a byte. Decoding the bytes as ASCII produces:
text
APjgfp\\Nvnabjxtfo`lnf\\wl\\apjgfpnvnabj`we\\1315~
This output was still not readable, suggesting that hexadecimal encoding was only the first layer of the transformation.

3. The Important Hint: 0x03

The BSides Mumbai account replied to the hexadecimal comment with:
text
0x03
This was the key observation. The value 0x03 suggested trying a single-byte XOR operation with 0x03 as the key.
XOR (exclusive OR) returns 1 when two bits differ and 0 when they match. A useful property is:
\[ (A \oplus K) \oplus K = A \]
Applying XOR with the same key twice restores the original value.
For example:
text
0x41 XOR 0x03 = 0x42
0x42 = B

0x50 XOR 0x03 = 0x53
0x53 = S
Continuing this transformation across the decoded bytes reveals the flag.
Cryptographic Insight
Hexadecimal is an encoding, not encryption by itself. Hex decoding restores the bytes, while XOR with the single-byte key `0x03` removes the second layer of obfuscation.

4. Automating the Solution

Python can perform both transformations without manually processing every byte.

Python solver

python
#!/usr/bin/env python3

from binascii import unhexlify

hex_data = """
41 50 6a 67 66 70 5c 4e 76 6e 61 62 6a 78 74 66 6f 60
6c 6e 66 5c 77 6c 5c 61 70 6a 67 66 70 6e 76 6e 61 62
6a 5c 60 77 65 5c 31 33 31 35 7e
"""

# Decode the hexadecimal string into bytes.
encoded_bytes = unhexlify("".join(hex_data.split()))

# XOR every byte with the key 0x03.
key = 0x03
decoded_bytes = bytes(byte ^ key for byte in encoded_bytes)

# Convert the resulting bytes into readable text.
flag = decoded_bytes.decode("ascii")

print(f"[+] XOR key: 0x{key:02x}")
print(f"[+] Recovered flag: {flag}")
Run the script with Python 3:
bash
python3 solve.py
Expected output:
text
[+] XOR key: 0x03
[+] Recovered flag: BSides_Mumbai{welcome_to_bsidesmumbai_ctf_2026}
The solver performs three operations:
  1. unhexlify() converts each pair of hexadecimal digits into a byte.
  2. Each byte is XORed with 0x03.
  3. The resulting bytes are decoded as ASCII to display the flag.
Because the key was provided in the reply, brute-forcing all 256 possible single-byte XOR keys was unnecessary.

5. Complete Investigation Chain

Decompiled Logic
The key lesson is to inspect interactions and replies, not only the main post. The hexadecimal payload alone was insufficient; the reply provided the missing transformation key.

6. Flag

BSides_Mumbai{••••••••••••••••••••••••••••••••}

Conclusion

Sanity Check combined OSINT with a basic cryptographic transformation. The four-member clue led to Not_SDE, LinkedIn revealed the unusual comment, and the 0x03 reply supplied the XOR key.
Login