Five Rings to rule them all, Five Rings to find them,

Five Rings to bring them all and in the darkness pwn them.

In the Land of Kringle where the Red-teamers lie.

(see, I can mix it up)

Here's my write-up for the 2022 SANS Christmas Challenge.

Jingle shell, jingle shell, jingle shell rock

Jingle shells swing and jingle shells ring

Pwnin' and poppin' up boxes is fun

Now the jingle hop has begun

Here's my write-up for the 2021 SANS Christmas Challenge.

Oh, the COVID is frightful,

But KringleCon is so delightful,

And since we must all stay home,

Let it pwn! Let it pwn! Let it pwn!

Here's my write-up for the 2020 SANS Christmas Challenge.

On the twelfth day of Christmas, my true love gave to me:

Twelve Phishers phishing

Eleven Shells a-popping

Ten Passwords spraying

Nine Splunks a-splunking

Eight Machines learning

Seven Metasploit scanning

Six Blue Teamers crying

Five Golden Tickets

Four Domain Hashes

Three Malicious Macros

Two LAN Turtles

and a Pwnage in …

🎵 I'm dreaming of a pwned Christmaaaaas 🎵 As usual, here's my write-up for the 2018 SANS Christmas Challenge.

'Tis the season to be pwning, falalalala lalalala. As usual, here's my write-up for the 2017 SANS Christmas Challenge.

This blog is beginning to look a lot like being exclusively about SANS Christmas Challenges write-ups. What can I say, they're so good! Anyway, let's roll for the 2016 edition of this marvelous Christmas Challenge.

Everything starts again with the Dosis children. As they're reminiscing on last year's Christmas, they …

This year again, the SANS institute delights us with a wonderful Christmas Challenge.

We follow the Dosis family, after they purchase a Gnome in Your Home for their kids, Jessica and Joshua. These two kids, especially bright for their age, tinker with the gnome, to find that it has a …

During December, SANS posted a Christmas challenge based on a Christmas story.

This year, Santa is sad because he feels that nobody believes in him anymore, so he decides to cancel Christmas. Mrs. Claus wants to cheer her husband up, in order not to let children down, but her reindeer …

You can find the code for this level here.

(sha256: d211aa240a0a59eb1f56d3c42a55080d0e27eea2c04bc4410bf608824c847c96)

This is it. The final level to the Stripe CTF. The goal here is to retrieve a 12-digit password, which is too long to brute force. Let's see how we can use the protocol to our advantage.

The infrastructure …