Firnsy from the Ballarat Hackerspace is developing a badge for BSides Ballarat 2026, and I thought it would be fun to add some SAOs for it. I have a few ideas, but I thought I’d start small and get something out the door, before committing to larger ideas.

This was my most ambitious challenge for BSides CTF 2025 - a multi-stage network penetration scenario running on a Raspberry Pi. I wanted participants to experience a realistic attack chain, starting from WiFi access all the way to compromising internal services.

I wanted a classic web vulnerability for the BSides CTF 2025, and SQL injection felt perfect. The irony of a security company having such a basic flaw made it even better.

This was the most basic challenge for the BSides CTF 2025, designed to just get people started. Anyone with some basic web experience or OSINT skills should be able to solve it quickly.

The Barcode challen was one of the first challenges I thought of when I started planning the BSides CTF 2025. It is a simple challenge that introduces participants to barcode analysis and decoding, specifically focusing on Code39 barcodes. However I threw some extra complexity in there to mess with people a bit.