F5 Badge CTF

[A] DELIVERY | Ensure Availability

The backend is stable. The servers are humming. But something's off. Users in different regions are experiencing timeouts and session drops. You dig into the traffic flow... and discover a suspiciously encoded routing map buried in the packet logs. Is it an attack vector, or a misconfigured failover? The key to stabilizing delivery lies inside.
You must:
Filter out dropped/expired packets based on clues (e.g., timestamp vs a given threshold). Reorder valid packets based on sequence numbers or region latency. Decrypt each packet. Combine to form a meaningful phrase or key.
Resources: View Logs

[B] SECURITY | Mitigate The Threat

Red lights blink on your dashboard. An automated scanner is hammering your login page with credential stuffing attacks, while a parallel script fuzzes your API for unpatched endpoints. Somewhere buried in the encrypted logs is the signature of the botnet origin, cloaked to avoid detection. You must extract and neutralize the threat - without disrupting real traffic.
You must:
Detect bots: Based on UA (python-requests, curl) or frequency patterns. Extract only bot requests. Decode payloads. Sort payloads by request number or a tag in the payload. Combine decoded strings to form final key. If more than 3 requests from the same IP in < 10s, treat as bot.
Resources: View Logs

[C] XOPS | Bring Order To Operations

The system is unstable. Logs stream in from every direction - fragmented, inconsistent, and timestamped by drunk clocks. Alerts are firing for symptoms, not causes. Three teams see three different truths. You need to bring order to the chaos. Somewhere in the noise is the root cause - and the key to restoring system sanity.
You must:
Re-align timestamps (via a rule: "team X's clock is +5 min", or "timestamps use different epoch starts"). Decode corrupted log lines. Discard false alerts based on pattern frequency or known root cause patterns. Piece together a coherent incident timeline. Timestamps are UNIX epoch, except OpsLog uses hh:mm format. Final message/flag is hidden across log fragments but only revealed when logs are reassembled in correct chronological order.
Resources: View Logs

[D] DEPLOYMENT | Go Live With Confidence

The code is stable. The tests are green. But deploying across production, staging, and edge environments is never simple. Each environment has its quirks, policies, and failure modes. Your deployment manifest is partially encrypted, your release signature is out of sync, and one wrong move could trigger a rollback. Can you push to prod with confidence?
You must:
Decrypt each environment's manifest. Check policy compliance using clues. Reorder manifest fragments based on sequence tags. Validate against signature hash. Assemble the correct full deployment key or passphrase.
Resources: View Logs