Red Guy's Path: A Don't Hug Me, I'm Scared CTF for DEF CON

Why I Built This

I'm going to DEF CON. Online I go by Red Guy — Don't Hug Me I'm Scared bit, not a full cosplay thing. I'll probably be in a Red Guy shirt so I'm easier to find in a crowd. That's about as far as the costume goes.

I made a short web CTF around that persona at redguy.xyz, plus a bunch of NFC chips that open it and some 3D printed SAOs if people finish and then actually find me. No booth. Just me walking around.

The CTF

There's a path of pages based on the show lessons:

Love, Time, Computers, Creativity, Dreams.

You have to do them in order. Each page has its own thing hidden on it. It's all normal web recon. View source, cookies, headers, DOM, some encoding. Phone-friendly-ish. I kept the hints pretty unhelpful on purpose.

After Dreams there's an optional Death page for a Duck SAO. It's easy to miss.

I made ~150 chips. They all go to the home page.

SAOs

Red Guy: finish the main path (~50)
Duck: do Death too (~25)
Yellow Guy: I have ~25 and I'll give them out if I feel like it

No mailing anything. Check in on the site with a Discord name, message me, find me at the con. Completions go to a Discord webhook so I can see who finished.

Stack

Flask app. Multi-page frontend. Progress is tracked with signed cookies so later stages stay locked until you clear earlier ones. Config is in a .env file. Webhook for check-ins / completions.

Not a big complicated system. I didn't want it to be.

Final Thoughts

If you see me at DEF CON and want one of the chips, just ask. Or if you already have one and finished the thing, message me and come find me for the SAO.

I'm not posting solutions here. Maybe after the con.

live site: https://redguy.xyz/
discord: @bradleyuniversity

Building the IoT Railroad: Smart Control for a Classic DC Layout

🧠 Why I Built This This project started like a lot of mine do: I wanted to combine something nostalgic with something technical. After relocating and downsizing my layout space, I saw an opportunity to do something different with my model train setup—integrate it with my homelab and smart control

findaredbox.kbots.tech: Mapping the Ghosts of Redbox Kiosks

🧠 Why I Built This Redbox may be going the way of the DVD itself—but the machines are still out there. Some are still operational, others have been shut off, removed, or never even deployed. And after the company's bankruptcy and shifting digital priorities, their official locator isn’

My Hacker Toolkit

🧠 Why This Toolkit Exists Every good exploit starts with curiosity—and sometimes a hunch. Over the last few years, I’ve disclosed vulnerabilities ranging from GraphQL overexposures in social apps like Fizz and YikYak to full API-level data leaks in life safety infrastructure—one of which became CVE-2025-0352 and was

Too Close for Comfort: Location & User Data Exposure in YikYak's GraphQL API

⚠️ Transparency Statement All findings described below were discovered through traffic analysis of my own user account using standard tools. No unauthorized access occurred. This post serves as a permanent public record of what was found. Since YikYak is no longer in operation with this API or backend, redaction is not