How CyberRex works

New to capture the flag? This is everything you need: where the jobs live, how to submit an answer, where to get help, and the tools that crack most beginner challenges.

Take the site tour

How it works

Every challenge on the range is a job in the story. You work them in Ops, one at a time. Each job has a brief (why it matters), the actual task, any files to download, and an answer bar pinned to the bottom of the screen.

Job list (left, hidden until you open it with the button at the top left or l). It shows the jobs at your current location, or flip it to All jobs. Drag its edge to resize it.
Field kit (right, open it with t). It lists the hosts and commands the current job mentions, one click to copy, plus a notes pad that's saved in your browser.
The map shows every location. Pick one to fly there and read about it, then use Next open job here to work its jobs.
The board ranks every crew, and shows how far your crew is through each job type.

Go roughly in order: the Prologue first, then the acts. Nothing stops you wandering, and Easy jobs are the best place to start.

Submitting flags

Almost every answer looks like this:

FLAG{...}

Paste it into the answer bar and press Enter. Flags are exact: include FLAG{ and the closing }, and match capitals. If a job gives you a plain value (a password, a decoded word), the job text says whether to submit it as-is or wrap it.

When you're stuck

Re-read the brief and the task. They usually say exactly where to look.
Hints sit under the task. Some are free; some cost points, and it says so before you unlock.
The crew. Hit Crew in the corner of any job (or c). They know which job you're on and will nudge you toward the technique. They never give you the answer.
ARIA lives inside the AI jobs. Getting it to slip is the challenge.

Keyboard

[Previous job]Next job nNext job you haven't solvedaJump to the answer bar /Search all jobslShow or hide the job list tShow or hide the field kitcOpen the crew chat EscClose whatever is open

Job types

Jobs carry in-world category names. The real CTF category is underneath each one.

Type	What it involves	Try first
Systems WorkWeb	IDOR, SQL/NoSQL injection, command injection, SSTI, LFI, cookie and JWT tampering, SSRF	View source, edit a cookie or URL parameter, try `' OR 1=1--`
SignalsCrypto	Base64/32, hex, ROT13, XOR, Caesar/Vigenère, weak RSA	Paste the blob into CyberChef and try “Magic”
RecoveryForensics	File metadata, carved or appended data, packet captures	`strings f`, `exiftool f`, `binwalk f`
Recon IntelOSINT	robots.txt, sitemaps, response headers, page source, public records	`curl -I`, view-source, check `/robots.txt`
CoverStego	Data hidden in images or audio (LSB, spectrograms, zero-width text)	Check metadata and least-significant bits; try a spectrogram
TeardownRevEng	Reading a binary's logic	`strings` the binary, look for an unused function
OverflowPwn	Overflowing a buffer to reach hidden code	Find the input length that crashes it, then aim
AscendPrivEsc	Going from a normal user to root via a misconfiguration	`sudo -l`, cron jobs, writable files
The MachineAI	Talking the in-game AI (ARIA) into giving up a flag	Open the ARIA chat on the job and try framing or role prompts
GhostsHidden	Flags planted around the platform itself	View-source, response headers, files nobody checks
Quick HitsMini	Warm-ups: one small idea each (decode it, read the obvious endpoint, check the file)	Try the simplest explanation first before you overcomplicate it
InterceptsIntercepts	Short transmissions, each hiding a flag	Spot the encoding, decode, submit
Long ConsMultiStage	Three-stage chains; each answer opens the next	Submit each stage as you reach it
All HandsCollab	Flags split into pieces across the crew	Coordinate with your team and combine fragments
The PatternMeta	Puzzles that only make sense once you've done the jobs they point back to	Collect what you learned elsewhere; don't treat it as a standalone decoder

Command recipes

A job tells you what to try. These show how on your machine. Pick your system once and every recipe switches to it. If a hint's command doesn't work in your shell, find the matching recipe here instead of forcing it. Swap HOST and PORT for the address the job gives you.

Download a file from a challenge

Use this for PDFs, packet captures, archives, keys, logs, images, and challenge artifacts.

curl -O http://HOST:PORT/file.ext
wget http://HOST:PORT/file.ext

Fallback if missing: use your browser and save the file manually.

Invoke-WebRequest http://HOST:PORT/file.ext -OutFile file.ext

Fallback if missing: open the URL in the browser and save the file.

curl -o file.ext http://HOST:PORT/file.ext

Fallback if missing: download with your browser.

Open the file URL directly
Right-click → Save link as...

Notes: this is often enough for images, PDFs, and text files.

Inspect HTTP response headers

Use this for hidden header values, redirect behavior, cookies, and server fingerprints.

curl -I http://HOST:PORT/
curl -i http://HOST:PORT/

Fallback if missing: browser devtools → Network → click request → Headers.

$r = Invoke-WebRequest http://HOST:PORT/
$r.Headers

Success looks like: you can see Server, Set-Cookie, custom X-... headers, or redirects.

curl -I http://HOST:PORT/

Notes: curl on modern Windows is enough for most header checks.

F12 → Network → reload page
Select the request → Headers

Notes: this also works for cookies, content types, and redirects.

Fetch page bodies and endpoint output

Use this when a challenge wants you to inspect HTML, JSON, plaintext, or endpoint behavior directly.

curl http://HOST:PORT/
curl http://HOST:PORT/path

(Invoke-WebRequest http://HOST:PORT/).Content

curl http://HOST:PORT/

Open the URL directly
View Source if needed

Recover an exposed `.git/` repository

Use this when a hint mentions git history, deleted commits, or an exposed .git/config path.

git-dumper http://HOST:PORT/.git/ dumped-repo
cd dumped-repo
git log --oneline
git log -p

Fallback if missing: fetch /.git/config first to confirm exposure, then use any git dump tool you already have.

Invoke-WebRequest http://HOST:PORT/.git/config
git-dumper http://HOST:PORT/.git/ dumped-repo
cd dumped-repo
git log --oneline

Fallback if missing: use the browser to confirm /.git/config, then switch to a crewmate or a machine that has git tooling.

curl http://HOST:PORT/.git/config
git-dumper http://HOST:PORT/.git/ dumped-repo

Notes: CMD can confirm exposure, but PowerShell or bash is usually more comfortable for the actual repo recovery.

Open /.git/config
Confirm the repo is exposed

Success looks like: you can browse commit history and inspect deleted data.

Extract `.zip` and `.tar.gz` archives

Use this for backups, leak bundles, evidence archives, and challenge artifacts.

unzip archive.zip
tar -xzf archive.tar.gz

Expand-Archive archive.zip -DestinationPath extracted
tar -xzf archive.tar.gz

tar -xf archive.zip
tar -xzf archive.tar.gz

Fallback if missing: extract with Explorer for .zip files.

Right-click archive → Extract All

Notes: built-in Windows extraction handles .zip; use a local archive tool if .tar.gz is awkward.

Inspect files, metadata, and content

Use this for images, PDFs, unknown files, archives, shell history, and suspicious text artifacts.

file sample.bin
strings sample.bin
exiftool image.jpg
cat file.txt

Get-Content file.txt
Format-Hex sample.bin
strings sample.bin
exiftool image.jpg

Fallback if missing: open the file in a text editor or hex viewer you already have.

type file.txt
certutil -dump sample.bin

Open plaintext files directly
Download PDFs/images and inspect locally

Inspect packet captures and log files

Use this for .pcap, DNS logs, suspicious auth traces, and replayable evidence files.

strings evidence.pcap
tshark -r evidence.pcap
grep keyword logfile.txt

Fallback if missing: open the file in Wireshark if you have it.

Select-String -Path logfile.txt -Pattern \"admin\",\"flag\",\"token\"
strings evidence.pcap

findstr /i \"admin flag token\" logfile.txt

Success looks like

Credentials, hostnames, tokens,
requests, or unusual sequences
start to stand out clearly.

Inspect audio and spectrogram-based artifacts

Use this for intercepted WAV files, tone sequences, and anything that makes more sense visually than by listening.

Open the file in Audacity
Switch the track to Spectrogram view
Zoom in on the tone bands

Fallback if missing: any spectrogram viewer works if it shows time on one axis and frequency on the other.

Download the WAV
Open it in Audacity or another
local audio viewer

Notes: the browser alone usually will not show the signal structure clearly enough.

What to look for

Dominant horizontal bands
Repeated tone steps
Time slices that map cleanly
to symbols or digits

Success looks like

A stable per-slice frequency pattern
you can convert into
hex, bytes, or tokens.

Interact with live TCP and UDP services

Use this for Intercepts and any challenge that gives you a host and raw port rather than a website.

nc HOST PORT
printf 'hello\n' | nc HOST PORT
printf 'ping' | nc -u -w1 HOST PORT

Fallback if missing: use ncat, socat, or a simple Python socket script.

$client = [Net.Sockets.TcpClient]::new('HOST', PORT)
$stream = $client.GetStream()

Fallback if missing: use Windows Terminal with ssh/nc if available, or a teammate on bash.

ncat HOST PORT
curl telnet://HOST:PORT

Notes: CMD is usually the least comfortable option here; PowerShell or bash is easier for iterative interaction.

Success looks like

You can connect, send one or more
commands, and capture the raw
service response for decoding.

SSH into a challenge host

Use this for the SSH privilege-escalation jobs, or anything that gives you credentials and a port.

ssh user@HOST -p PORT

ssh user@HOST -p PORT

ssh user@HOST -p PORT

Fallback if missing

Use Windows Terminal, PowerShell,
or any SSH client already installed.

Notes: once connected, common discovery steps include find, cat, sudo -l, ls -la, and history.

Decode common text encodings

Use this for Base64, Base32, hex, URL encoding, and binary-looking payloads.

echo TEXT | base64 -d
python -c \"import base64; print(base64.b32decode('TEXT').decode())\"
echo 464c4147 | xxd -r -p

[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('TEXT'))
[Text.Encoding]::UTF8.GetString([Convert]::FromHexString('464c4147'))

powershell -Command \"[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('TEXT'))\"

Notes: CMD is usually best paired with PowerShell for decode tasks.

Use your browser devtools console
if you are comfortable with it.

Success looks like: readable text or a valid flag-like token appears.

Inspect page source, scripts, comments, and hidden client-side data

Use this for hidden flags, comments, JS hints, source-only clues, and odd response behavior.

curl http://HOST:PORT/
curl -I http://HOST:PORT/
curl http://HOST:PORT/script.js

(Invoke-WebRequest http://HOST:PORT/).Content
(Invoke-WebRequest http://HOST:PORT/).Headers

Right-click → View Page Source
F12 → Elements
F12 → Network
F12 → Sources

What to look for: comments, hidden spans, script variables, data attributes, unusual headers, alternate requests.

Success looks like

Something the visible page does not show:
comments, identifiers, fragments,
or hidden navigation clues.

Use ARIA correctly

Use this for the five AI jobs: the ARIA chat sits inside the job, above your answer bar.

In the job

Open the AI job in Ops
Use the ARIA chat inside the job
Send your prompt
Watch the replies carefully

Where the flag appears: when ARIA gives it up, the flag drops straight into your answer bar. Hit Submit.

What to do if ARIA stalls

Reload the job (a fresh chat)
Send a shorter prompt
Try a clearer framing

Notes: the job's own hints still matter; this page doesn't replace them. The crew can nudge you too.

What success looks like

The reply changes in a meaningful way,
and ARIA returns a flag in the chat.

Do not assume

Don't rely on the browser network tab alone.
The intended route is the ARIA chat itself.

Tools

Your browser: view-source (Ctrl+U) and DevTools (F12) to read comments, edit cookies, watch requests.
CyberChef: decode or encode almost anything.
curl: curl -I URL for headers, curl URL for the raw body.
Python: quick decoding, requests and crypto maths.
nmap for ports and services, Wireshark for .pcap captures.
exiftool and binwalk for file metadata and carving; john or hashcat for hashes.
jwt.io to read and forge JSON Web Tokens.

Quick reference

Task	Command
Fetch a page, or just its headers	`curl URL` `curl -I URL`
Readable strings in a file	`strings file`
Decode Base64 / hex	`base64 -d f` `xxd -r -p f`
File type and metadata	`file f` `exiftool f`
Carve embedded data	`binwalk -e f`
Crack an MD5 hash	`john --format=Raw-MD5 --wordlist=rockyou.txt h`
Connect to a raw service	`nc HOST PORT` `ssh -p PORT user@HOST`

On Windows, most of these work in WSL or Git Bash, and CyberChef or Python covers the rest in your browser.

Missing a tool

A hint says wget: curl, Invoke-WebRequest or the browser all work.
A hint says curl -I: your browser's DevTools (Network tab) shows the same headers.
A hint says git-dumper and you don't have it: confirm the repo is exposed at /.git/config first, then see the git recipe.
A hint says exiftool and you don't have it: start with the file's properties, or an online metadata viewer for files that aren't sensitive.
A hint says sqlmap: it's never the only route unless the job says so. A careful manual payload usually wins.

Troubleshooting

A hint's command doesn't work in my shell. Use the matching recipe for your system instead of copying the exact syntax.
The job page and a hint show different commands. The job text says what to do; this guide says how to do it on your setup.
I don't have a tool installed. Check Missing a tool. Many jobs can be started in the browser or with built-in PowerShell or CMD tools.
A file looks empty or unreadable. Check metadata, strings, hex, headers, comments and other encodings before assuming it's broken.
"Incorrect" but I'm sure. Flags are exact: check for spaces, capitals, and that you included FLAG{ and }.

Rules

Only attack the targets your jobs give you: the hosts, ports and pages named in a job. Scanning and fuzzing those challenge boxes is fine. Everything below is out of scope.

Out of scope

This platform itself: the CTFd site, its scoreboard, login and API. Don't scan it, fuzz it or brute-force logins.
Anything under /admin, and the CTFd admin API.
The server's own SSH on port 22, the host machine and the Docker daemon.
The database, cache and AI model behind the range (MariaDB, Redis, Ollama), unless a job points you at them.
The cloud metadata address 169.254.169.254, from anywhere, including through an SSRF job.
Other teams: their accounts, sessions, machines and submissions.
Denial of service, floods and mass brute-forcing. The jobs are built to be solved with thought, not volume.

The range is monitored. Out-of-scope activity is logged against your team and the organizers will contact you. Repeat or serious cases can cost points or end your event.

Read carefully, change one thing at a time, and watch how the target reacts. Good luck.

How CyberRex works

How it works

Submitting flags

When you're stuck

Keyboard

Job types

Command recipes

Download a file from a challenge

Inspect HTTP response headers

Fetch page bodies and endpoint output

Recover an exposed .git/ repository

Extract .zip and .tar.gz archives

Inspect files, metadata, and content

Inspect packet captures and log files

Inspect audio and spectrogram-based artifacts

Interact with live TCP and UDP services

SSH into a challenge host

Decode common text encodings

Inspect page source, scripts, comments, and hidden client-side data

Use ARIA correctly

Tools

Quick reference

Missing a tool

Troubleshooting

Rules

Out of scope

Recover an exposed `.git/` repository

Extract `.zip` and `.tar.gz` archives