Op vliegbasis Gilze-Rijen werden de plannen voor defensie voor komende jaren gepresenteerd.

This challenge involves exploiting an Insecure Direct Object Reference (IDOR) vulnerability combined with GraphQL Introspection to extract sensitive user data without authentication. The target application is a React-based web application using GraphQL as its API layer, which exposes more data than intended through nested queries on public endpoints. GraphQL is a query language for APIs that allows clients to request exactly the data they need.

This challenge is the third part of the ORMT (ORM Traversal) series. The developers have addressed both previously exploited vulnerabilities: ORMT1: The recursive clean() function that could be crashed via RecursionError to bypass ORM lookup sanitization has been replaced. ORMT2: The _connector injection (CVE-2025-64459) is no longer applicable since the vulnerable SiteUser.objects.get(**params) pattern has been removed. The application now features a new book repository with filtering and aggregation.

This challenge is the second part of the ORMT (ORM Traversal) series. While the first part (ormt1) was vulnerable to a Django ORM Injection via a flawed recursive clean() function that could be bypassed by triggering a RecursionError, the developers have now replaced the sanitization logic with a seemingly robust iterative sanitize() function that strips all double underscores (__) from parameter keys.

This challenge presents a Django web application vulnerable to ORM (Object-Relational Mapping) Injection, specifically exploiting Django's powerful QuerySet filter functionality. The application implements a custom sanitization function designed to prevent ORM injection attacks, but contains a critical logic flaw that can be bypassed using circular model relationships. ORM Injection is a lesser-known cousin of SQL Injection that targets the abstraction layer between application code and the database.

This challenge presents a seemingly innocent Flappy Bird browser game, compiled from Rust to WebAssembly. Beneath the nostalgic gameplay lies a fully functional credential-stealing phishing kit. After a "Game Over" event, the game prompts the user with a pixel-perfect fake Google OAuth sign-in dialog, claiming to "save your score to the leaderboard." Any credentials entered are silently XOR-encrypted using a key fetched from a server-side configuration file, further obfuscated with a bitwise rotation cipher, base64-encoded, and exfiltrated to a fake OAuth token endpoint — all disguised as a legitimate Google OAuth2 authorization code exchange.

This challenge presents a hardened PowerShell sandbox environment called "SAFEPSv2". Players are given access to a restricted PowerShell shell that implements multiple layers of input filtering and command restrictions. The goal is to bypass these security measures and extract the flag stored in a PowerShell variable $FLAG. The challenge is a continuation of a previous "JailPS" challenge safeps, with significantly enhanced security measures including:

This challenge presents a PowerShell Jail Escape scenario, a common category in CTF competitions where participants must break out of a restricted shell environment. The challenge implements a "safe" PowerShell interpreter that attempts to limit user commands to a predefined whitelist while blocking dangerous cmdlets and constructs through blacklist filtering. PowerShell jail escapes typically exploit one or more of the following weaknesses:

A l’approche des JO, testez vos réflexes de cybersécurité. Entrez dans le dojo. Version française English version Contact Mentions légales Linkedin-in

To boost national cybersecurity capabilities, the Ministry of Information, Communications, and the Digital Economy, in partnership with the Slovakian Ministry of Interior and National Administration, will host Kenya Cyber Game 2025, a 10-week initiative meant to identify and nurture promising cybersecurity professionals. The Kenya Cyber Game was launched by ICT Principal Secretary John Tanui and Slovakian Ambassador Katarina Zuffa Leligdonova on Tuesday, April 1. Principal Secretary Tanui explained that the Kenya Cyber Game, with the theme “Unlocking Your Cybersecurity Potential” is scheduled to continue until June 9, 2025, and is primarily aimed at participants from tertiary institutions and those working in the cybersecurity industry. “The goal of this competition is to offer university students, tertiary learners, and professionals a chance to test and improve their cybersecurity abilities,” he stated. To participate, individuals must register online through the player interface. Prize eligibility is limited to Kenyan citizens; however, non-citizens are welcome to participate without competing for prizes. The Ministry has specified that participation in the game is free of charge, and a new cybersecurity challenge, encompassing a variety of categories such as malware analysis, digital forensics, cryptography, open-source intelligence, offensive security, and security governance and processes, will be released on a weekly basis. The awards, encompassing tech gadgets, cybersecurity training, software licenses, and tech store vouchers, will be distributed across distinct categories: students, the junior category, and participants from the public and private sectors. Furthermore, those participants who demonstrate exceptional performance in the game and satisfy the specified age criteria will be eligible for consideration to join the National Cybersecurity team, which represents Kenya in regional and international cybersecurity competitions. According to a recent Communications Authority of Kenya (CAK) report, cyber threats in the country increased by 27.2% in the second quarter of the 2024/2025 financial year. The Communications Authority of Kenya’s (CAK) report indicated that Kenya’s technology ecosystem experienced 840 million cyber threats during the period of October to December 2024. The report further specified that system vulnerabilities were the most common threat vector, accounting for 752.4 million of the detected threats. **By Hellen Lunalo** __ Share on Facebook Share __ Share on TwitterTweet __ Send email Mail

De gemeente Waalwijk organiseert een speciale Cybergame op donderdag 28 augustus. Bedrijven krijgen praktische tips en leren van een slachtoffer van cybercrime.