This was my most ambitious challenge for BSides CTF 2025 - a multi-stage network penetration scenario running on a Raspberry Pi. I wanted participants to experience a realistic attack chain, starting from WiFi access all the way to compromising internal services.

I wanted a classic web vulnerability for the BSides CTF 2025, and SQL injection felt perfect. The irony of a security company having such a basic flaw made it even better.

This was the most basic challenge for the BSides CTF 2025, designed to just get people started. Anyone with some basic web experience or OSINT skills should be able to solve it quickly.

The Barcode challen was one of the first challenges I thought of when I started planning the BSides CTF 2025. It is a simple challenge that introduces participants to barcode analysis and decoding, specifically focusing on Code39 barcodes. However I threw some extra complexity in there to mess with people a bit.

This challenge was the most difficult I created for BSides CTF 2025. I was worried about the difficulty, and it was multiple-intermediate steps in a row without a “checkpoint” to help participants. However I did leave clues but I did not have anyone complete it, so I thought I would write this post to explain the challenge and how to solve it.