ENIGMA CTF 2026: A Comprehensive Write-up

Forensics

Echoes in the Static

During an investigation of an abandoned research facility, our team recovered a strange audio recording from an old workstation.

At first, it sounds like an ordinary transmission, but the previous analyst left a note before disappearing:

“The message isn’t meant to be heard… sometimes secrets hide beneath the surface.”

We believe the audio contains a hidden signature left behind by the researcher. Analyze the file carefully and uncover the secret before the signal fades forever.

Flag Format: ENIGMA{…}

Solution:

I analyzed the sound.wav file using the strings command, which revealed a Base64 encoded string. I then decoded it using CyberChef to capture the flag.

Flag: ENIGMA{f14g_f0und_i5_c0r3ct}

MISC

Tactical Jigsaw

We managed to steal the opponent coach’s tactical board where he wrote his master game plan (the flag). However, before escaping, our spy had to shred the board into 16 pieces to avoid detection. To make matters worse, the shredder burned the edges of the pieces (black borders), and they got completely shuffled in the bag. Can you piece together the tactical vision and read the coach’s handwriting?

Flag format: ENIGMA{…}

Solution:

I unzipped the 16 image pieces, reassembled the puzzle, and the flag appeared on the completed image.

Flag: ENIGMA{t4ct1c4l_v1s10n}

The Red Card

The referee was about to show a red card to the star player, but the TV broadcast feed was suddenly corrupted! The VAR (Video Assistant Referee) team managed to extract the frame (red_card.jpg) from the data stream, but the file signature seems to have suffered a ‘FOUL’. Can you fix the file corruption and reveal what was written on the card?

Flag format: ENIGMA{…}

Solution:

The red_card.jpg file was corrupted with a custom header; I used a hex editor to replace the incorrect “FOUL” bytes with the standard JPEG magic bytes ( FF D8 FF E0 ). Fixing the file header allowed me to open the image and reveal the flag.

Flag: ENIGMA{magic_bytes_foul}

Git Gud

We managed to exfiltrate a ZIP file containing a developer’s local Git repository. We know they stored a 4-part flag inside it, but they were very clever about hiding it using various Git features. The flag is split into 4 parts. Can you find all of them and reconstruct the flag?

Flag format: ENIGMA{…}

Solution:

• git stash show -p gives me the first part of the flag: ENIGMA{g1t_
• git show v1.0-secret gives the second and third part of the flags
• git show 116f666 gives the final part of the flag.

Flag: ENIGMA{g1t_1s_just_4_tr33_0f_c0mm1ts}

Crypto

Invisible ink

Not every secret is written in plain sight. An intercepted document appears completely ordinary, but appearances can be deceiving. Hidden within the seemingly endless spaces lies a message waiting to be uncovered. The information isn’t encrypted with letters or symbols — it’s concealed in what most people ignore. Your mission is to look beyond the visible text, extract the hidden whitespace, decode it, and recover the flag. Hint: Sometimes, what you can’t see carries the most information.

Flag Format: ENIGMA{…}

Solution:

The invisible_ink.txt file initially appeared as Base64 code. After decoding it using CyberChef, I was left with a set of whitespace characters; I then used a Python script to convert those sequences of spaces and tabs into binary, which translated into the final flag.

Flag: ENIGMA{p33l1ng_th3_d3f3ns1v3_l4y3rs}

The Twin Strikers

The rival team’s coach has sent an encrypted playbook to his captain. We managed to intercept the transmission, along with the public key. Our scouts reported something very interesting about their formation: their two star strikers (the prime components of their attack) are practically twins on the field, always standing

side-by-side with almost no distance between them. Can you exploit this tactical weakness to decrypt the playbook and find the flag?

Flag format: ENIGMA{…}

Solution:

The challenge involved an RSA-encrypted playbook where the prime factors were unusually close. Recognizing this as a vulnerability to Fermat’s Factorization, I used a Python script to factorize the modulus n by finding the difference of two squares. This allowed me to derive the prime factors, calculate the private key, and decrypt the flag:

Flag: ENIGMA{t0t4l_f00tb4ll_m4st3r_t4ct1cs}

Rev

String Theory

Description: The manager locked the playbook in this simple Python script. He thinks his ‘encryption’ is unbreakable. Can you reverse engineer the script and find the password? The password is the flag. Files Provided: checker.py

Solution:

I reverse-engineered the script by applying the XOR operation with 0x42 to the given values and reversing the string order to retrieve the flag

Flag: ENIGMA{b4s1c_r3v3rs1ng_1s_fun}

The Manager’s VM

The opposition’s manager has developed a proprietary tactical simulation script in Python (tactics.py). It checks a 6-character formation code. If the code is correct, it decrypts the ultimate playbook (the flag). At first glance, it looks like a simple array traversal, but AI tools trying to symbolically execute or statically analyze it are crashing because the ‘pitch’ array mutates itself dynamically during execution. You’ll have to use dynamic analysis to trace how the simulator works and brute-force the formation code one player at a time. Good luck!

Flag format: ENIGMA{…}

Solution:

The challenge featured a self-modifying virtual machine that required a 6-character formation code to decrypt the flag. By utilizing the known ENIGMA{ prefix and the properties of XOR, I determined the formation code was zid4n3; applying this key to the encrypted flag array decrypted the final result

Flag: ENIGMA{c4sc4d1ng_t4ct1cs}

OSINT

The Geometric Disaster

Description: Our intelligence agency has intercepted a manifesto from a rogue stadium architect. They claim to have hidden a secret cache at a stadium matching these exact clues:

Clue 1: ‘I am an architectural nightmare. My seating tiers are completely disconnected and shaped like geometric diamonds, forcing fans to look away from the center of the pitch just to face forward.’

Clue 2: ‘I was constructed in 1981 by a firm hailing from a massive empire that would collapse exactly ten years later.’

Clue 3: ‘I was originally built in the capital of an unrecognized independent state — a product of a globally condemned segregation policy.’

Clue 4: ‘Today, my country has hosted the FIFA World Cup once, but my bizarre diamond stands never saw a single World Cup match.’

Task: Identify the stadium. Your flag is constructed from three pieces of information related to it, separated by underscores:

1. The name of the CURRENT province where the stadium is located (two words).
2. The name of the UNRECOGNIZED STATE it was originally built in (one word).
3. The YEAR it was built.

Example format : if the answer was ‘New York’, ‘Atlantis’, ‘1999’: ENIGMA{new_york_atlantis_1999}

Solution:

By analyzing the architectural clues, I identified the stadium as the Mmabatho Stadium, which was built in 1981 within the former unrecognized state of Bophuthatswana. This information fits the required format, leading to the flag

Flag: **ENIGMA{north_west_bophuthatswana_1981}**

Shadow of History

Our scouting team recently took a stroll through a historic city and snapped the attached photo, img.jpg.

While the massive building in the frame is a landmark in its own right, the scouts were much more interested in what lies just next door. They mentioned that a stone’s throw from where they are standing sits a monumental piece of football history — a stadium deeply connected to the very origins of the world’s biggest international tournament.

Examine the photo carefully to figure out where they are. What is the name of the famous football stadium located right next to this building? Flag Format: ENIGMA{Stadium_Name} (Please capitalize the start of each word and replace spaces with underscores, e.g., ENIGMA{Old_Trafford})

Solution:

Using Google Lens, I identified the image as the Hospital de Clínicas Dr. Manuel Quintela, and subsequent searches for nearby stadiums led me to the Estadio Centenario.

Flag: ENIGMA{Estadio_Centenario}

The Scout’s Snapshot

Description: A football scout accidentally uploaded a photograph while traveling to assess a potential transfer target. Although the image was quickly taken down, a copy was recovered before it disappeared.

The scout made sure to avoid exposing any obvious identifiers — there are no readable signs, club logos, or stadium names in sight. But experienced investigators know that a single photograph can reveal far more than it seems. Architectural features, surrounding infrastructure, terrain, and subtle environmental clues may be all you need to uncover the location. Your mission is to determine exactly where the photograph was taken.

Identify:

🏟️ The football stadium 🌆 The city ⚽ The club that calls it home

flag format: ENIGMA{club_city_stadium}

Example: ENIGMA{example_fc_examplecity_examplestadium}

Solution:

I used the google lens and found out that It is Ethihad Stadium and the city is Manchester.

Flag: ENIGMA{manchester_city_manchester_etihad_stadium}

Silent Guardian

“He wore red for a club that became his legend, but his boots first touched grass somewhere else in the United Kingdom entirely — a place that never wanted the spotlight, a city built where ships have always come and gone. They say he could’ve chased chandeliers and penthouses, but the sensation from a West African nation chose humility over luxury, and a small ground held onto him longer than the history books remember. Trace the wings in the sky back to the ground below them. Find the arena of stone and steel where the crowds still gather, the temple that fills with thousands every match day. Someone stands guard at its gates, cast in stone, watching the crowds come and go. Learn his name — and the year he was born — for that is the key that opens this trail.”

Flag format: ENIGMA{full_Name_BirthYear}

Solution:

• Found location: Geolocated aerial image to Southampton, England.
• Identified stadium: Mapped “arena of stone and steel” to St Mary’s Stadium, home of the “Saints”.
• Determined guardian: Identified the stadium statue as club legend Ted Bates.

Flag: ENIGMA{Edric_Thornton_Bates_1918}

Steg

Blind Spot

Description: The manager handed us this seemingly harmless gradient image, but we know he’s hiding his playbook inside it. Our automated text-extraction scripts (like strings and zsteg) are coming up empty. Sometimes you just have to look at things from the right plane of view.

Files Provided: challenge.png

Flag Format: ENIGMA{…}

Solution:

Extracted the hidden flag by isolating and visualizing the individual bit planes of the image’s color channels using a Python script. By systematically separating the bits, I was able to reveal the concealed text that standard steganography tools had missed.

Flag: ENIGMA{st3gs0lv3_1s_y0ur_fr13nd}

Binary

BIN Vision Test

Description:

The manager has started distributing keys using compiled Python bytecode (.pyc) to avoid simple strings analysis. We managed to intercept this file. It’s said to be highly resilient against automated scanners because it relies on human vision. Can you run or decompile it and read the flag?

Files Provided: vault.pyc

Flag Format: FLAG{…}

Solution:

used python script for find the flag.

!uncompyle6 vault.pyc

Flag: FLAG{V1S10N}