Physical-media challenge

The RedMimicry CTF

Physical-media based capture the flag by RedMimicry. Artifacts handed out by our team hide flags that you can claim on rcr.sh to enter the arena and climb the leaderboard.

Claim your first flag Upcoming drops
Flag-backed invite Entry method
DWT Cyber Defence Conference Next drop
rcr.sh Platform

Start playing

To register to rcr.sh you need an initial flag that lives on one of our physical media. Pick up an artifact at the next event, investigate it, and bring the recovered string back to the scoring platform.

01

Meet us in the field

Visit RedMimicry at an exhibition or conference listed below to receive the current batch of CTF media.

02

Investigate the artifact

Use your skill and knowledge to interrogate the artifact and its data without destroying it.

03

Register & expand

Enter a recovered flag on rcr.sh to bind your handle, unlock more challenges, and climb the leaderboard.

Upcoming drops

Meet the RedMimicry crew on the road, receive the latest media, and claim the bootstrap flag you need for the rcr.sh registration.

Event Dates Location
DWT Cyber Defence Conference 9–10 Dec 2025 Bonn, Germany
Embedded World 10–12 Mar 2026 Nuremberg, Germany
ReThink! IT Security 10–20 Mar 2026 Berlin, Germany
INSECON 15 Apr 2026 Poznań, Poland
Hannover Messe 20–24 Apr 2026 Hannover, Germany
DMEA 21–23 Apr 2026 Berlin, Germany
Cloud & Cyber Security Expo 6–7 May 2026 Frankfurt, Germany
Cyber Security Summit 20–21 May 2026 Hamburg, Germany

Artifacts

Each artifact hides something special, and its up to you to find it. Investigate, image, and examine to find all hidden flags.

3.5" Floppy

SectorZero

Classified

SectorZero is the inaugural artifact. No rest for FAT12.

Release
2025
Available at
  • DWT Cyber Defence Conference
Flags
Optoelectronic 100 pts

Take a second look at the drive.

Remains 200 pts

DigDeeper.

Macrosoft 200 pts

Dare to execute.

SectorZero media

House rules

  • Keep the media intact. You never need to destroy an artifact to reveal its flags.
  • Flags stay valid even if already redeemed by somebody else.
  • Need help coordinating a private drop for your security team? Reach out below.
  • Do not share writeups of the CTF capture until the artifact has been made “public”. The status is marked in the artifact overview.

Support

Mail us at mail@redmimicry.com for any questions you might have.

We’re happy to coordinate private drops for internal team training or help your local hackerspace host a micro-event. Reach out if you need additional accessibility guidance.