ECHO · Public
Live Blog
The running log. Essays, write ups and field notes from ECHO members, public, citable, and open to anyone, not just the club.
What’s next
The next write up starts as a countdown
Every report below began as an event on the club calendar. Here is what is on it now, and where an organiser has published a date but not a start hour, the clock says days and says why, rather than inventing an hour to fill itself with. Pick any entry underneath to step the readout onto it.
Posts
Latest & featured
Field Notes · Linux
Omarchy, Before We Commit
A mini deep dive on Omarchy, DHH's Arch plus Hyprland distro, before it goes on a new AI workstation: what hardware actually works, what software has no Linux path, one real disclosed security bug that got patched, and an honest table against Windows.
Announcement · Hardware
Meet the ECHO creature
Digital Orukami forked Hermann Björgvin's Clawdmeter onto a 4 inch board, a desk screen that shows how much Claude Code you have left, and the club got a creature out of it: Clawd's silhouette in ECHO's colours, moving through the stock animations with a visor, an antenna and one glitch per cycle. What runs, what does not yet, and where it goes.
Post 001
CTFs, Local Models, and the Trust Boundary
Why CTF methodology is training data for accessible defensive tooling, how Anthropic's Cyber Verification Program removes default dual use safeguards for verified practitioners, and what actually strengthens an application, grounded in ECHOClub's own approved CVP submission.
BrunnerCTF 2026 · feature
Three Solves Worth Writing Down
The three that were worth the write up from a 146th of 1,103 weekend: a username less 2FA that checked one code against every employee, a CL.TE request smuggling desync proven with a timing oracle, and an LLM chess bot steered into Fool’s Mate, it refused in prose while complying on the board. One thread runs through all three: a trust boundary that only held in one of the two places it needed to.
Write ups
Competition and certification write ups
How a solve actually went, the approach, the method, the findings, and the lesson that outlives the flag. Written after the event and published as is, because a write up that has been tidied into a success story teaches nobody anything.
Technique · sanitized
Enumerate to Escalate: A Two Stage Web Chain
Two findings that look minor apart and are a full authorization bypass together: an
unauthenticated directory read that leaks every account’s role string, and an
admin route that treats that same string as a shared secret. The endpoint that leaks the
roles is the one that unlocks the endpoint that checks them, and the note it hands
back carries plaintext credentials for an internal shell, where a single
NOPASSWD sudo rule on an ordinary mail binary becomes root.
boroCTF 2026 · report
41 Solves, Six Categories, One Competitor
ECHOClub’s full competition report, published in full: every solve with its category, points and timestamp, plus the hard ones worked end to end, JWT forging through the alg:none hole, carving a 10 TB sparse file down to its eight real regions, reading binary out of packet timing, and undeleting a zip from an NTFS disk image that mounted clean. PDF download on the page.
ACE-T Core · Volume I
Forensics & Malware Analysis
ACE-T Core is not a multiple choice badge, section three of the exam is
report writing. Volume I is four Antisyphon Cyber Range challenges worked end to
end: a DLL search order hijack found in 108,560 Procmon events, an FTP file
rebuilt out of a raw packet stream, a 0x2a injection mask hunted through a
Sysmon log, and a malicious DLL pulled from a 143 MB minidump.
ACE-T Core · Volume II
Network Recon & Forensics
The second submitted report: enumerating a full SNMP MIB through a factory default
public community string, attributing a suspect IP, breaking a
bcrypt hash whose cost factor was set to 4, and reversing a PNG that had been
turned into 1,910 lines of xxd output. Each one carries its threat
assessment and its recommendations, not just the flag.
BrunnerCTF 2026 · Three solves
Three Solves from BrunnerCTF 2026
Three challenges worked end to end: a username less 2FA account takeover, a CL.TE HTTP request smuggling chain, and an LLM driven chess puzzle. Method, reasoning, and the flag for each.
Technique
Browser Cookie Value Manipulation
How a client side cookie value becomes an attack surface when the server trusts it, how to spot it, and the defensive fix, a lab safe walk through of the technique and why signed, server side state ends it.
MetaCTF · Another Data Trail
Another Data Trail
A virtual disk that mounts clean, a folder of two hundred ordinary looking Windows scheduled tasks, and one file carrying a second payload that no directory listing, Explorer window or plain signature scan will ever surface. Enumerating every file’s alternate data streams in one pass finds the one that answers back, the technique mapped to MITRE T1564.004. Flag redacted.