When watching the tennis one day, the commentator said something along the lines of “this player (it was Federer) wins more than 90% of matches when they win the first set”. This sounded impressive, however then my mind got a bit skeptical on whether or not it was actually better than most players. After all, its only a five set match, and its first to three - having a 1-0 advantage would be massive, even if the two players were equally skilled. Further, if the player was good enough to win the first set, they were probably the better player anyway.

Firnsy from the Ballarat Hackerspace is developing a badge for BSides Ballarat 2026, and I thought it would be fun to add some SAOs for it. I have a few ideas, but I thought I’d start small and get something out the door, before committing to larger ideas.

This was my most ambitious challenge for BSides CTF 2025 - a multi-stage network penetration scenario running on a Raspberry Pi. I wanted participants to experience a realistic attack chain, starting from WiFi access all the way to compromising internal services.

I wanted a classic web vulnerability for the BSides CTF 2025, and SQL injection felt perfect. The irony of a security company having such a basic flaw made it even better.

This was the most basic challenge for the BSides CTF 2025, designed to just get people started. Anyone with some basic web experience or OSINT skills should be able to solve it quickly.