The Rose City Courier · Field Desk

Detective’s Field Kit

Everything you need for the Dellwood case, set up in about ten minutes. This page lists tools, not answers.

The short version

A web browser. You already have one.
CyberChef, a decoder that runs in your browser. Nothing to install.
A terminal, the text window where you type commands. Every computer has one.
nmap, for finding out what a server is running. The only thing most people need to install.
ssh and curl, for talking to servers. Already built into Windows, macOS and Linux.

No laptop, or can’t install things? Join a group. Teams of up to four are welcome, and the junior desk has hints for every step.

Show instructions for

0. Open a terminal

Built in

Press Win, type Terminal (or PowerShell), and press Enter.

Press ⌘ Space, type Terminal, and press Enter.

Usually Ctrl Alt T, or search your apps for Terminal.

Android: install Termux from F-Droid (the Play Store version is out of date). Then run:

pkg update && pkg install nmap openssh curl

iPhone / iPad: there’s no good way to run nmap. Use CyberChef in Safari for the decoding steps and team up with someone who has a laptop for the server steps.

Work laptop, school Chromebook, or no admin rights? You can still do a lot: the browser and CyberChef steps need nothing installed, and ssh and curl are usually already there. For the scanning step, team up with someone who has nmap.

1. Your browser’s view-source

No install

Websites hide things in their source code and in files that aren’t linked anywhere. Learn the shortcut to read a page’s source:

Ctrl U in Chrome, Edge or Firefox.
⌥ ⌘ U in Chrome or Firefox. In Safari, first turn on Settings → Advanced → Show features for web developers.
On a phone, type view-source: before the address in Chrome for Android. On iPhone, use a laptop for this one.

You can also type any path straight after a site’s address, like example.com/some-file.txt, to see if it exists.

2. CyberChef

No install

A free decoder from GCHQ that runs in your browser. It handles encodings, binary, old-school ciphers and much more.

Open CyberChef →

How to use it

Paste your mystery text into Input (top right).
Search the Operations list on the left (try “from”) and drag one into Recipe.
Read the Output. Not sure what you’re looking at? Try the Magic operation, which guesses for you.

3. nmap

Install

Scans a server to see which services are running on it, like a list of doors and what’s behind each one.

Install

Easiest: download the Latest stable release self-installer from nmap.org/download and click through it. Say yes when it offers to install Npcap.

Or, in a terminal:

winget install -e --id Insecure.Nmap

Close and reopen the terminal afterwards so it can find nmap.

With Homebrew (recommended):

brew install nmap

No Homebrew? Install it first with the one-line command on brew.sh, or download the .dmg from nmap.org/download. If macOS blocks the installer, right-click it and choose Open.

Debian / Ubuntu / Mint:

sudo apt update && sudo apt install -y nmap

Fedora:

sudo dnf install -y nmap

Arch:

sudo pacman -S nmap

Installed by the Termux command above (Android only).

If you can’t install it, a teammate can run the scan and share what it finds.

Check it works

nmap --version

Basic use

nmap <the-ip-address>

Add -sV to see which software each service is running.

Only scan the CTF’s own server. Scanning other people’s machines without permission isn’t okay, and in many places it’s illegal.

4. ssh

Usually built in

Connects you to a remote server’s command line.

Built into Windows 10 and 11. If ssh isn’t found, go to Settings → System → Optional features and add OpenSSH Client.

Built into macOS.

Almost always installed. If not:

sudo apt install -y openssh-client

Installed by the Termux command above (Android only).

Usually already available, even on locked-down laptops. Try the check below.

Check it works

ssh -V

Basic use

ssh anyname@<the-ip-address>

The first time, it asks whether to trust the server: type yes. Press Ctrl C to get out at any point.

5. Downloading over FTP

Usually built in

FTP is an old way of sharing files from a server. The simplest client is curl, which is already on your computer.

In PowerShell, type curl.exe, not just curl (plain curl runs a different PowerShell command).

List the files

curl.exe ftp://<the-ip-address>/

Download one

curl.exe -O ftp://<the-ip-address>/<file-name>

List the files

curl ftp://<the-ip-address>/

Download one

curl -O ftp://<the-ip-address>/<file-name>

The file lands in whatever folder your terminal is in. To just read a text file, leave out -O and it prints to the screen.

Prefer clicking to typing? FileZilla is a free FTP app. Its installer may offer extra software you don’t need; decline it.

6. A map

No install

Got a pair of numbers like 45.5, -122.6? Those are coordinates. Paste them, comma and all, into Google Maps or OpenStreetMap.

If something goes wrong

“nmap: command not found” (or “not recognized”)

Close the terminal and open a new one: it only learns about new programs when it starts. On Windows, if it still fails, reinstall with the self-installer from nmap.org.

nmap says “Host seems down”

Some servers ignore ping. Add -Pn to skip that check:

nmap -Pn <the-ip-address>

Everything times out on the conference Wi-Fi

Some networks block scanning, ssh or FTP. Try your phone’s hotspot, or ask the organizer.

curl on Windows prints a big red error or strange table

You typed curl in PowerShell. Use curl.exe instead.

macOS says the nmap installer “can’t be opened”

Right-click the installer, choose Open, then confirm. Or use Homebrew instead.

I’m stuck on a puzzle, not a tool

That’s what the junior desk is for: every question has a hint, and you can switch to it at any time. You can also flag down the organizer.

House rules

Everyone shares one small server, so be kind to it: no brute forcing, no flooding, and only scan what the case leads you to. If you break something by accident, tell the organizer, no judgement.