My experience during the XXVI SBSeg CTF

On August 29, 2026, I took part in the Capture the Flag (CTF) competition held during the XXVI Brazilian Symposium on Cybersecurity (SBSeg), the main academic security conference in Brazil. This year's edition was a replay of the FIRST CTF, so the challenge set followed the same style and difficulty as the one played by incident response teams from around the world at the FIRST Conference.

I decided to compete solo. Most of the roughly 55 participants were organized in teams of up to four people, which made the event a good test of how far one person can go across many different categories in a limited amount of time.

The challenges

The FIRST CTF is known for covering the full spectrum of incident response work rather than focusing on a single discipline. The categories included, among others:

• Digital forensics: disk and memory artifacts, log analysis, and timeline reconstruction.
• Malware analysis and reverse engineering: static and dynamic analysis of samples, unpacking, and understanding hidden logic.
• Network analysis: PCAP inspection, protocol dissection, and extraction of exfiltrated data.
• Cryptography and steganography: weak implementations, encoding chains, and hidden payloads.
• OSINT and miscellaneous: puzzles that reward creativity and attention to detail.

Some challenges that stood out for me (without many details and answers):

• Tor website challenge: a real .onion domain that was hosting leaked documents of an organization. Once the correct PDF was found, I had to find the correct sequence for decrypting the sensitive data.
• NetFlow challenges: a set of challenges around NetFlow data, including beaconing discovery, data exfiltration, and general statistics.
• DNS exfiltration challenges: a set of challenges related to DNS tunneling. After reassembling the pieces of information, I had to discover the algorithms for decrypting the data.

The image below shows the categories I solved during the event:

Score

I finished the event with 4320 points, placing 3rd overall. The screenshot below shows the scoreboard of the CTF:

Awards

The top three finishers were recognized during the conference closing session. As the 3rd-place finisher I received a challenge coin and a Raspberry Pi Kit. Being on the podium as an individual competitor, against teams of four, was the part I am most proud of.

Some CTF tips

A few things that helped me, especially while playing alone:

• Prepare your environment beforehand: A VM with your usual DFIR, RE, and network tooling already installed and tested saves precious minutes. I recommend using REMnux and a Windows box with forensictools.
• Read the challenge description carefully: Hints about the expected flag format, file type, or tool are often hidden in plain sight.
• Triage first, solve second: Skim every challenge in the first minutes and rank them by expected effort versus points. Cheap points early in the event free up time for the hard ones.
• Time-box everything: If a challenge is not moving after 20-30 minutes, switch to another one and come back later with fresh eyes.
• Keep notes: Write down every intermediate finding (hashes, strings, credentials). Many challenges reuse artifacts from earlier ones.
• Practice with real IR data: The FIRST CTF rewards day-to-day incident response experience more than exotic exploitation tricks.

Conclusion

The XXVI SBSeg CTF was a great opportunity to test my skills against a well-designed, incident response oriented challenge set and to meet other players from the Brazilian security community. Finishing 3rd as a solo competitor was a rewarding result.

Thanks to the SBSeg organizers and to FIRST for making the challenge set available for a Brazilian replay.