This year’s BSides Ballarat CTF was my most ambitious yet - a five-challenge story that took teams from analysing smart meter traffic all the way to physically cutting wires under a countdown timer. The whole thing is built around an underground bitcoin mining operation leeching power from Ballarat’s electricity grid, and teams had to track it down, find the insider, break into their communications, and ultimately stop a self-destruct mechanism before it destroyed all the evidence.

When watching the tennis one day, the commentator said something along the lines of “this player (it was Federer) wins more than 90% of matches when they win the first set”. This sounded impressive, however then my mind got a bit skeptical on whether or not it was actually better than most players. After all, it’s only a five set match, and it’s first to three - having a 1-0 advantage would be massive, even if the two players were equally skilled. Further, if the player was good enough to win the first set, they were probably the better player anyway.

Firnsy from the Ballarat Hackerspace is developing a badge for BSides Ballarat 2026, and I thought it would be fun to add some SAOs for it. I have a few ideas, but I thought I’d start small and get something out the door, before committing to larger ideas.

This was my most ambitious challenge for BSides CTF 2025 - a multi-stage network penetration scenario running on a Raspberry Pi. I wanted participants to experience a realistic attack chain, starting from WiFi access all the way to compromising internal services.

I wanted a classic web vulnerability for the BSides CTF 2025, and SQL injection felt perfect. The irony of a security company having such a basic flaw made it even better.