HI Cyber Con CTF 2026. Miscellaneous.
The Foxglove Trace
Four small files and one debug log. The lab rebuilt the scoring rule and named the place in two minutes.
Published 2 November 2026. Challenge by Hidden Investigations.
The brief
A hobbyist had a quiet obsession: figuring out, without asking anyone, which unknown place they kept drifting back to on autopilot. Their idea was to mine two signals their phone already recorded, step-count spikes and the strength of nearby Wi-Fi access points. They never finished it. The loudest access point is a trap, so is the one that appears most often. Get the rule right and exactly one place rises to the top.
- notes.txt, 2 KB
- aps.conf, 178 bytes
- scan_export.csv, 1.4 KB
- run.log, 1.2 KB
In short
A tracker scored Wi-Fi access points by signal strength, but only for readings taken while its owner was moving, and the cutoff was never written down. The lab read the cutoff and the formula out of one debug log and scored all 33 readings. FoxgloveCoffee_Guest won with 1,044.
Four files and no server
The tracker was meant to find the place its owner kept going back to. All that is left are notes, a config that trusts four access points, 33 scanned readings and the log of the one run that worked.
The cutoff hides in the log
The notes leave out the step count that separates walking from sitting still. The log does not. It dropped a reading with a step delta of 40 and kept one with 41, so a reading counts from 41 up.
Two subtotals fix the formula
The log also prints two subtotals, and weight times the sum of kept signals matches both. CafeDelMundo keeps 58, 60 and 64, times 2 is 364. HomePlex_5G keeps only 87, times 2 is 174.
Two traps in plain sight
The loudest reading, xfinitywifi at 96, is not on the trusted list at all. HomePlex_5G shows up most often, 10 times, but 9 of those readings were taken sitting still.
One place rises to the top
Scored over all 33 readings, FoxgloveCoffee_Guest keeps 5 of its 7 at weight 3 and reaches 1,044. CafeDelMundo follows with 364, NETGEAR-8841 with 240, and HomePlex_5G finishes last with 174.
The insight
The log gave away what the notes held back. A dropped 40 and a kept 41 fix the cutoff, and only one formula fits both logged subtotals.
The flag
hiCTF{FoxgloveCoffee_Guest}