Red · offense
BrunnerCTF 2026 · Global
48-hour jeopardy, web, crypto, reversing and pwn, with an onboarding track for a first flag.
ECHO · Play
Wargames & CTF
Practice the craft. Hands-on wargames and Capture the Flag — offensive and defensive, from beginner labs (booting a toolkit from USB) to full weekend competitions. Every activity builds practical skill and ethical awareness.
ECHO · Mission clock
Counting down to the next competition
Practice runs to a date. The next competition on ECHO’s calendar is on the clock below — and where an organiser has published a date but not a start hour, it says days and says why, rather than inventing an hour nobody stated. The deck under the clock steps the readout onto any entry.
ECHO · Competition calendar
Competitions on the 2026-2027 Academic Year calendar
Only the competitions. The strip carries the club’s competitions one card at a time — drag it, or open a card for that event’s full record. The grid under it is the club calendar filtered to CTFs and wargame practice: the same event list the Events page draws, with the campus events, trainings and club meetings left out. The full calendar with everything on it lives on the Events page.
⣀ ⣤ ⣿ more marks = more on that day
the rail links a multi-day run
amber conditional or date not set
dimmed already happened
ECHO · The two sides
Red team, blue team
Two masks, one craft. Security has a half that gets in and a half that works out who did — and they are the same skill read from opposite ends. ECHO plays both, so every event on this page can be told apart by which half it asks of you.
Red · offense
Get in
The half that finds the way through: enumeration, web and binary exploitation, cryptography, privilege escalation. A red event hands you a target and asks what you can do to it. The flag is proof you reached somewhere you were not supposed to be.
Blue · defense
Find out who did
The half that reads the wreckage: threat hunting, incident response, digital forensics, malware analysis, detection engineering. A blue event hands you a compromised system and asks what happened to it. The flag is proof you reconstructed it.
Oni artwork & emblems — Protocol 973
ECHO · Approach vector
What’s coming up
Every competition on ECHO’s calendar, placed on one axis that runs from last week out to ninety days. Pick a marker to read it. A marker drawn wide is an event whose start hour was never published — a whole calendar day of uncertainty, drawn as what it is rather than counted down to an hour nobody stated.
ECHO · The calendar
On the calendar
Six events on one drum — three the club plays red, three it plays blue. Turn it to open a card in full. This is the whole set rather than the dated ones: what is actually coming up, with hours on it, is the axis in the panel above.
Red · offense
UND CyberHawks 2026
Jeopardy on Hack The Box, qualifiers into an in-person final.
Red · offense
RIFFHACK: Black Market Break-In
The club’s first ranked finish, and a break-in by name.
Blue · defense
Holmes CTF 2026
120 hours of DFIR on Hack The Box. In the club’s own words, the blue team one.
Blue · defense
ACE-T Core, Volumes I and II
Eight challenges worked end to end and submitted as written reports, not just solved.
Blue · defense
The IDS Router Reboot lab
A drawer router reflashed into a home intrusion-detection sensor. Now on Events.
ECHO · Standings
On the board
Every board ECHO competes on, and what that board records. One of them is running right now.
Boards06
Drag or scroll to spin · pick a board for its record
Not a board yet: UND CyberHawks CTF 2026, whose virtual qualifiers run Aug 29 on Hack The Box.
Hack The Box · the certificates
Round 1 Game 2 · 1st · 16/19 · 3,275 pts · 07 Mar 2026
Round 2 Game 1 · 2nd · 10/14 · 1,900 pts · 08 Mar 2026
Holmes CTF 2025 · Team Wolves · 1,809th of 7,085 · 18/65 · 2,250 pts · 22–26 Sep 2025
Cyber Apocalypse 2026 certificate (1.2 MB)Cyber Apocalypse 2026 · the organisers’ certificate · PDF
Final · Global division
BrunnerCTF 2026
48-hour jeopardy · SDU · Aug 21–23
Closes
Final result · BrunnerCTF 2026 (Global) closed 23 Aug 2026 12:00 UTC
-
The standing146th · ahead of 86% of the field4,185 points · final · of 1,103 teams
The team
- Digital Orukami 33 solves
- Digital Ripple 5 solves
- Red Reddington 0 solves
Solves by category
| Category | Solves | Points |
|---|---|---|
| Onboarding | 9 | 180 |
| Misc | 8 | 800 |
| Reversing | 6 | 600 |
| Mobile | 5 | 500 |
| Crypto | 4 | 400 |
| Web | 4 | 400 |
| Forensics | 1 | 100 |
| OSINT | 1 | 100 |
| Total | 38 | 3,080 |
Every solve, newest first — challenge, category, local time
The feed is read from the event’s own scoreboard when this page loads. With scripting off it is empty here — the board itself is public.
Names, categories, points and times — no flag strings and no methods. BrunnerCTF’s rules hold those inside the team until it closes, and this directory is published the moment it deploys, so the feed above carries only what the scoreboard itself holds. The shape of the run — the category split weighted by score, and the eleven-hour climb — is charted below from a dated capture, which is allowed to sit a solve or two behind this block.
Rating board · not a competition
CTFtime
ECHOClub · team 438173 · academic team: Front Range Community College
CTFtime is the open-source scoreboard the CTF industry runs on. Effectively every major competition registers its event there and reports results afterwards, which makes it the one public record of how a team performs against the whole scene rather than against a single platform’s own users.
That is also why it is the board that counts professionally. An employer checking whether a security credential is real will most likely go to CTFtime — a global ranking there is verifiable by anyone, on a site nobody involved controls.
What reports into it
| Event | CTFtime rating | Its rank is on |
|---|---|---|
| boroCTF 2026 | 6.814 | the boroCTF 2026 card |
| RIFFHACK: Black Market Break-In | 0.000 | the RIFFHACK card |
| BrunnerCTF 2026 (Global) | Rated at close · weight 24.66 | the BrunnerCTF card |
CTFtime records a rank but no field size for either finished event, which is why neither is drawn as a share of anything. Dividing CTFtime’s 268th by boroCTF’s own field of 831 would be arithmetic on two different boards — a number nobody measured.
Platform · live boxes and seasonal CTFs
Hack The Box
Team ECHO Club · Team Wolves (FRCC) · members sit on both
-
Cyber Apocalypse 2026: The Salt Crown507th of 6,744 teams · ahead of 92%Organisers’ certificate · 74 of 136 challenges · 29,925 points
-
506th
The same event, on the team pageHack The Box publishes 506th where the certificate it issued says 507thThe team page records no field size, so nothing is divided by anything here. Both readings stand; neither is resolved.
-
1st
Hack the Madness — Central, R1 G21st of 3 teams · 16 of 19 challenges · 3,275 pointsTeam Wolves · 07 Mar 2026 · the club’s best individual finish
-
2nd
Hack the Madness — Central, R2 G12nd of 3 teams · 10 of 14 flags · team MVPBoth Madness rounds recorded their field — three teams — and at that size the place is the clearer number, so the share is left off rather than dressed up.
Flags, and the two tiers they sit in
| Record | Flags | Points | Captured |
|---|---|---|---|
| Team ECHO Club | 74 | Unrecorded | 2026-08-09 |
| Digital Orukami — individual, 5 events | 98 | 34,325 | 2026-08-10 |
These do not add to 172. The same Cyber Apocalypse work appears on both profiles — the team’s 74 flags are inside the individual’s 98 — so the two are printed as separate tiers and never summed.
The team’s top categories
The three the team overview names — and this one does not add up to the team’s total, so it says so rather than implying it does.
| Category | Flags |
|---|---|
| Forensics | 27 |
| Cloud | 21 |
| Coding | 6 |
| Named above | 54 |
| Not broken out | 20 |
| Team total | 74 |
The team overview names only its top three categories, so these 54 are not the whole 74 and the chart is not a breakdown of the team’s record — it is the part of it the source actually states. The individual profile names a different third category (Sherlocks 18 rather than Coding 6); the team’s figures are the ones used here because the chart is about the team.
Platform · club sponsor · certification
SkillBit · MetaCTF
The ECHO Club group · members compete as a team · MetaCTF is SkillBit’s former name
-
SkillBit competition12th of 843 competitors · ahead of 98%Individual · a fixed competition board, so it does not drift · captured 2026-08-09
-
98th
SkillBit Hall of Fameapp.skillbit.com · captured 2026-08-09A live board with no total on its face — the crop reads “you are #98, 150 points behind #97” and stops there.
-
68th
SkillBit ranked tierRanked scoreboard · captured 2026-08-09A separate capture of SkillBit’s Live Rankings shows #50 — a different board on a different day, not a correction. Both are recorded; neither is the current standing.
Every figure on this card is reported by the member, never pulled: SkillBit’s terms forbid automated access site-wide, so nothing on this platform is ever scraped. It is also the home of the club’s ACE-T certification, and certifications earned before the rename still live on the MetaCTF domain.
Finished · Jun 13–15 2026
boroCTF 2026
ECHOClub, entered solo · 41 solves · 5,000 points
-
Open Division205th of 653 teams · ahead of 68%boroCTF’s own board, Open Division view
-
Overall276th of 831 teams · ahead of 66%boroCTF’s own board — the only board that recorded a field for this event
-
268th
CTFtime’s rank for the same runRated on the board, not scored on it · rating 6.814CTFtime records no field size. The 831 two rows up is boroCTF’s, and putting one over the other would invent a statistic.
-
#200
The organisers’ certificateIssued at close, 15 Jun 2026The certificate records no total either.
Four figures, one run. 268th on CTFtime, 276th of 831 overall, 205th of 653 in the Open Division, #200 on the certificate — the same 5,000 points and the same 41 solves behind every one of them, counted on four boards at four moments. None of them is a second result, and the two with a field of their own are the only two drawn as a share. The full solve list, the category split and the three-day climb are in the club’s own write-up and charted below.
Finished · 2026
RIFFHACK: Black Market Break-In
Hosted by Biterra.co · ECHOClub · 1,690 points
-
138th
CTFtime’s rankThe club’s first ranked finish · 1,690 points · CTFtime rating 0.000No board recorded a field size for this event — not CTFtime, and not the event’s own page. So there is no share to draw, and the place is printed raw and stays that way.
The event page did show 1,139 of 1,400 registered participants, and that is deliberately not used as a denominator: registered participants are not scored teams, and the capture was taken mid-event. A first result is worth more as a starting line than as a number to be quiet about — so it is printed as what it is, with nothing invented to flatter it.
ECHO · Leaderboard & spotlight
Who’s on the board
This rail carries the club’s record, one result to a card, each one labelled with the board that counted it. Member spotlights land here as members report them — nothing on this page is scraped from a platform. Until then it holds what ECHO has already done.
Spotlight · 06
Your seat
This board is waiting
Nobody has reported a rank yet. The leaderboard under this rail fills from what members type into the member deck themselves — so the first name on it is whoever puts it there.
Report a rank · member deck
Running now
BrunnerCTF 2026 · Global
ECHO is on a live board this weekend — a 48-hour jeopardy CTF run by SDU that counts toward the club’s CTFtime rating. The standing moves until it closes, so it is stated in one place only.
Live figure on the board wheel · closes Sun 23 Aug 12:00 UTC
Deepest run
boroCTF 2026 · entered solo
41 solves for 5,000 points over three days, across OSINT, forensics, crypto, web and misc. Forensics carried it — 13 of those solves and 1,800 of those points.
205th of 653 · boroCTF’s Open Division board
Largest field
Cyber Apocalypse 2026
Team ECHO Club against a field of 6,744 on Hack The Box: 74 of the 136 challenges, 29,925 points, and an organisers’ certificate at the close.
507th of 6,744 teams · ahead of 92% · HTB’s own board
First ranked finish
RIFFHACK: Black Market Break-In
The result that put ECHO on CTFtime at all — 1,690 points and the club’s name on a rating board for the first time.
138th · CTFtime’s rank · no board recorded a field, so no share is drawn
Written up
ACE-T Core · Volumes I and II
Eight Antisyphon Cyber Range challenges worked end to end and submitted as reports. Section three of that exam is report writing, so the write-up is the result.
8 challenges · 2 submitted volumes
Drag, scroll or use the arrow keys · the centred card is the one in focus
ECHO · Club leaderboard
ECHO Leaderboard
Members' own standings on the SkillBit ranked scoreboard. Each rank is reported by the member, not pulled from SkillBit automatically. Add yours from the member deck.
No ranks reported yet — be the first.
Self-reported by members, not verified against SkillBit.
ECHO · Write-ups
How the solves actually went
Every write-up the club has published, in full and unedited — the approach, the dead ends and the lesson that outlives the flag. A write-up tidied into a success story teaches nobody anything, so these are not tidied.
Write-ups · 07
Technique · sanitized
Enumerate to Escalate
Two findings that are nothing apart and a full authorization bypass together: an unauthenticated read that leaks every account’s role string, and an admin route that treats that string as a shared secret.
Sanitized · no event, no target, no result to state
boroCTF 2026 · report
41 Solves, Six Categories, One Competitor
The whole competition report, published as written: JWT forging through the alg:none hole, a 10 TB sparse file carved to its eight real regions, and binary read out of packet timing.
Report · 276th of 831 · boroCTF’s overall board
Under construction
ACE-T Core · Volume I
Forensics & Malware Analysis
A DLL search-order hijack found in 108,560 Procmon events, an FTP file rebuilt out of a raw packet stream, a 0x2a injection mask hunted through a Sysmon log, and a malicious DLL pulled from a 143 MB minidump.
Report · 4 challenges
ACE-T Core · Volume II
Network Recon & Forensics
A full SNMP MIB enumerated through a factory-default community string, a suspect IP attributed, a bcrypt hash broken because its cost factor was set to 4, and a PNG reversed out of 1,910 lines of xxd output.
Report · 4 challenges
BrunnerCTF 2026 · three solves
Three Solves Worth Writing Down
A username-less 2FA that checked one code against every employee, a CL.TE request-smuggling desync proven with a timing oracle, and an LLM chess bot that refused in prose while it threw the game on the board.
3 challenges · 146th of 1,103 · BrunnerCTF’s global board
Technique · sanitized
Cookie Value Manipulation
A cookie is data your server sent to a computer you do not control, and it will hand you back exactly what it decides to — how a trusted value gets read, decoded, edited and believed, and how to build so it never matters.
Report · web fundamentals · lab-safe, no result to state
Drag, swipe or use the arrow keys to move along the rail
ECHO · Scoreboard
The record, plotted
Every result the club has, computed and compiled from the boards themselves and updating while an event runs — so you can watch ECHO get better in public. It is a short record and it is growing fast.
boroCTF 2026 · score over time
All 41 solves, cumulative, plotted from the club’s own published solve list.
| Day | Solves | Points | Running total |
|---|---|---|---|
| 13 June 2026 | 16 | 1,800 | 1,800 |
| 14 June 2026 | 19 | 2,500 | 4,300 |
| 15 June 2026 | 6 | 700 | 5,000 |
Plotted from the 41 rows of the club’s write-up, sorted by solve time — the table there lists 14 June 12:09 PM above 11:55 AM, so its order is not strictly chronological. First solve 00:20 on 13 June, last 21:49 on 15 June, which matches the event’s own score-over-time capture. The challenge names, times, tooling and flags stay in the write-up and are not copied here — one record, one place to keep it true.
boroCTF 2026 · solves per category
Every category the club scored in. This one adds up to the whole result.
| Category | Solves | Points | Share of total |
|---|---|---|---|
| Forensics | 13 | 1,800 | 36% |
| OSINT | 11 | 1,300 | 26% |
| Crypto | 7 | 700 | 14% |
| Web | 6 | 700 | 14% |
| Misc | 4 | 500 | 10% |
| Total | 41 | 5,000 | 100% |
BrunnerCTF 2026 · solves per category
All 37 solves at the 22 Aug capture, on the organiser’s own category labels. This one adds up to the whole result — and the category that leads it is not the one the club is strongest in, which is what the next block is for.
| Category | Solves | Share of solves |
|---|---|---|
| Onboarding | 9 | 24% |
| Misc | 7 | 19% |
| Reversing | 6 | 16% |
| Mobile | 5 | 14% |
| Crypto | 4 | 11% |
| Web | 4 | 11% |
| Forensics | 1 | 3% |
| OSINT | 1 | 3% |
| Total | 37 | 100% |
Shares are rounded to whole percent and so sum to 101, not 100; the 37 is the real total and the percentages are the derived figure. The categories are CTFd’s, because CTFd is what the scoreboard is drawn from — the club’s own archive files four of these under different headings (its Stego and AI entries are CTFd’s Misc, and two of its Forensics entries are CTFd’s Onboarding). Both labellings are defensible; the organiser’s is the one that decides the score, so it is the one charted.
BrunnerCTF 2026 · points per category
The same 37 solves weighted by what they were worth. Onboarding falls from first to sixth; Misc, Reversing and Mobile are where the score actually came from.
| Category | Points | Solves | Points per solve | Share of points |
|---|---|---|---|---|
| Misc | 700 | 7 | 100 | 23% |
| Reversing | 600 | 6 | 100 | 20% |
| Mobile | 500 | 5 | 100 | 17% |
| Crypto | 400 | 4 | 100 | 13% |
| Web | 400 | 4 | 100 | 13% |
| Onboarding | 180 | 9 | 20 | 6% |
| Forensics | 100 | 1 | 100 | 3% |
| OSINT | 100 | 1 | 100 | 3% |
| Total | 2,980 | 37 | 81 | 100% |
Why the two charts disagree, stated plainly: in this capture every solve outside Onboarding was worth a flat 100, and the nine Onboarding solves were worth 10 to 25 each — 180 points between them. So the gap between the charts is the event’s starter tier, not a scoring curve, and not a claim that the club solved harder challenges faster than anyone else. Read the two together: 28 scored solves for 2,800 points outside Onboarding, concentrated in Misc, Reversing and Mobile — those three are 18 of the 28. Forensics and OSINT sit at one solve each, which is a thin base and is printed rather than rounded away. Points per solve is a column of the table and deliberately not a second chart: it is the same two numbers divided, and it would need a second scale to draw beside them.
BrunnerCTF 2026 · score over time
All 37 solves, cumulative, across a single day — 11 hours 16 minutes from the first solve to the last. Times are local (MDT, UTC−6).
| Hour | Solves | Points | Running total |
|---|---|---|---|
| 10:00 | 2 | 200 | 200 |
| 11:00 | 9 | 900 | 1,100 |
| 12:00 – 15:00 | none | none | 1,100 |
| 16:00 | 4 | 310 | 1,410 |
| 17:00 | 3 | 135 | 1,545 |
| 18:00 | 5 | 185 | 1,730 |
| 19:00 | 3 | 150 | 1,880 |
| 20:00 | 3 | 300 | 2,180 |
| 21:00 | 5 | 500 | 2,680 |
| 22:00 | 3 | 300 | 2,980 |
The 12:00–15:00 row is a real gap, not missing data: no solve was recorded in those four hours, so the line runs flat across them. It is listed rather than skipped because a table that jumps from 11:00 to 16:00 invites the reader to assume the rows were lost. The steepest hour is 11:00 — nine solves and 900 points — and the flattest scoring stretch is 17:00–19:00, which is where most of the low-value Onboarding tier was cleared. First solve 10:51, last 22:07.
BrunnerCTF 2026 · the standing, and what it is not
Stated as text, on purpose. The event has not finished.
The charts above are one dated capture of the event’s API: 22 Aug 04:20 UTC, 37 solves, 2,980 points. BrunnerCTF runs until Sun 23 Aug 12:00 UTC, so those numbers can still move. The live standing is on the BrunnerCTF card at the top of this page, which reads the scoreboard live — printing a staler one here would give the page two answers to one question.
Two things are out on purpose: member-against-member charts, because the card already names who solved what and ranking teammates is not a picture worth drawing; and challenge detail — flags, techniques, write-ups, which stays inside the team until the event closes. The write-ups are drafted and wait outside this site’s publish root until then.
Sources: the CTFtime and Hack The Box team pages, the boroCTF 2026 and Cyber Apocalypse 2026 certificates, the club’s own boroCTF write-up, and that dated CTFd capture (scoreboard and team 463 solves). Where sources disagree, both are printed. Nothing in this section is fetched — the board wheel above is the one live read, and may sit ahead of these charts while the event runs.