University of New Mexico
LoboSec is UNM's student-led Capture The Flag team. We compete against universities around the world in web exploitation, reverse engineering, cryptography, forensics and binary exploitation — and we teach each other everything we learn along the way.
What we practice
A CTF puts real vulnerable software in front of you and asks you to find the flag hidden inside it. Every category below shows up in the competitions we play, and every one of them starts from the basics.
SQL injection, SSRF, broken authentication, template injection, and the request-forging tricks that turn a login page into a shell.
Stack and heap overflows, format strings, ROP chains — learning how memory really works by making programs do things they were never meant to.
Pulling apart stripped binaries and obfuscated code with Ghidra, GDB and a lot of patience until the algorithm gives up its secret.
Padding oracles, weak RNGs, reused nonces and homemade ciphers — the failures that show up when good primitives are used badly.
Disk and memory images, packet captures, and log timelines: reconstructing exactly what an attacker touched and when.
Protocol analysis, misconfigured services, and open-source intelligence gathering — the reconnaissance half of every real engagement.
How the team runs
Nobody joins LoboSec already knowing all of this. The team is built so that a first-year student with zero background and a Ph.D. student who writes exploits for fun both have something to do on competition weekend.
From the team
LoboSec took 3rd place in the college and university division of the Alamo AFCEA Capture The Flag, an on-site, four-hour competition at the JW Marriott San Antonio — a few hundred points behind the leaders after a hard second-hour climb up the scoreboard.
Our first fully defensive competition. Holmes CTF put the team on the other side of the keyboard — triaging intrusions from disk images, memory captures and logs instead of writing exploits.
We entered StackSmash CTF 2025 and spent the day on web security, reverse engineering and binary exploitation. A hard board against a strong field — and a useful read on where our categories actually stand.
What's next
What the team is training for. Rosters open to every member ahead of each one — including people solving their first challenge.
Hack The Box's blue-team, DFIR-focused competition — evidence triage and timeline reconstruction rather than exploitation. We're returning after our defensive debut in 2025 with practice material built for exactly this.
Read our 2025 writeupA story-driven Jeopardy-style CTF where every challenge advances an ongoing narrative, spanning OSINT, forensics, web and cryptography. New to the LoboSec calendar.
deadface.ioThe international student-only bracket, thousands of university teams deep. We finished inside the top 10% in 2024 — this is the scoreboard we most want to move up.
See our 2024 resultNext competition is always close
Join the Discord, say hi, and pick up a beginner challenge. That's the entire onboarding process — no application, no interview, no prerequisites.