The Pivot Hunt
A beginner-friendly CTF! Start at ctijen.com, follow three real pivots, and find the flag at the end. Everything you'll touch is my own lab infrastructure, so it's totally safe. Takes about 20–30 minutes.
Find the flag!
Each pivot gives you the next clue. Only peek at the hints if you're stuck, because the moment it clicks is the best part!
What does my site talk to?
Scan ctijen.com on urlscan (a public scan is totally fine, it's my site and you have my permission!). Now, normally I'd tell you to search before you scan, because just knowing someone else already thought a site looked phishy is a signal in itself! But searching here might spoil a surprise, so just this once, scan away lol. When it finishes, open the HTTP tab. Every line is something the page loaded. One of those requests goes to a domain that isn't mine (and isn't a big-name service like Google Fonts or Vercel).
Tool: urlscan.io
Hint 1
Look at the domain column, not the file names. Most lines will be ctijen.com, fonts, and Vercel.
Hint 2
The Domains tab gives you the same answer as a short list.
Why this matters (read after)
This is one of my favorite pivots! A phishing page has to send your password somewhere, and that request gives away the backend every time.
Find what nobody linked to
Visit the domain you found (it's safe, it's my lab). It claims there's nothing to see. Don't take its word for it. Every TLS certificate gets written to a public log, and certificates list the names they cover. Find a subdomain no page links to.
Tool: crt.sh · If it's slow or you're not seeing it, try Cert Spotter (swap example.com for the domain you found)
Hint 1
On crt.sh, search with a % wildcard in front of the domain, like %.example.com.
Hint 2
Ignore the bare domain and www. You're looking for a name that sounds like it's hiding something.
Why this matters (read after)
Certificate logs are how analysts find staging sites, admin panels, and sometimes the next phishing domain before it even goes live. Attackers forget about this ALL the time.
Follow the fingerprint
The hidden page shows an image that exists in exactly one other place on the internet. Scan the hidden page, find the image in the HTTP tab, and grab its SHA256 hash. Then search urlscan for every other page that loaded the exact same file.
Tool: urlscan.io
Hint 1
Click the image's row in the HTTP tab to see its details, including the hash.
Hint 2
Search urlscan for hash: followed by the hash. You'll see scans of the hidden door (yours and other players'). Look for the one page that isn't the hidden door. That's the flag!
Hint 3
You'll know you're done when you see a page that says "You pivoted!" Seeing it in a urlscan screenshot counts.
Why this matters (read after)
A one-of-a-kind file can tie sites together even across totally different domains. A file everyone uses (a logo, a blank page, a popular library) ties together... nothing. Ask me how I know lol
Look up the lab domain on ICANN Lookup. Who's the registrar, and when was it registered? A brand-new domain at a budget registrar is a classic phishing trait, and here it's completely innocent (it's me!). That's why it's a supporting clue, never proof on its own.
Keep notes as you go: what you searched, what you found, and when. You'll want them at the end, I promise. And as always, only do this where your work policies allow. Brand-new domains are often blocked on work networks, so a personal device is easiest.