StackSmash CTF 2025
LoboSec competed in StackSmash CTF 2025. It was a hard competition against a strong international field, and we worked challenges across web security, reverse engineering and binary exploitation.
How we played it
We split the board by category rather than having everyone pile onto the same challenge. Newer members paired with more experienced players, and anything we solved went straight into our Discord so the technique was available to the rest of the team while the clock was still running.
- Web — enumeration first, then hunting for injection and access-control flaws in the provided applications.
- Reverse engineering — static analysis in Ghidra to understand what the binary was checking, then reimplementing the algorithm instead of brute-forcing it.
- Binary exploitation — turning memory-corruption primitives into controlled execution, one mitigation at a time.
What we took away
Reverse engineering and pwn are where the points concentrate at the top of a scoreboard, and they're the categories that reward sustained practice rather than a good weekend. Competing here made that concrete, and it shaped how we run practice sessions now: less "solve the challenge," more "explain the solution out loud to whoever is in the room," which is a much better test of whether you understand a technique or just followed someone's writeup.
The other thing that carried forward was tooling discipline — everyone getting comfortable in the same debugger and disassembler, so a teammate can pick up a challenge mid-solve without re-deriving the whole setup.
Play the next one with us
Rosters are open to every member, including people solving their first challenge. Join the Discord to get on the next sign-up.