No Accessible Vector (CTF solution)

Sat, 18 Oct 2025 00:00:00 +0000

Another day, another tester leaking something they shouldn’t. You have no chance navigating your way to the flag though: It is simply not visible for you!

Difficulty: Medium

Let’s solve the No Accessible Vector challenge using the principles we’ve just learned. Make sure you read the Capture the Flag tips first, as this article leans heavily on the first.

First, we read the description and realize that a tester built a page that we don’t have access to. We can use our first principle of using developer mistakes to theorize about the solution. One common mistake is a developer not realizing that all pages are accessible regardless of access rules. All we have to do is figure out the name of the page.

Tips for the next Mendix Capture the Flag event

Sat, 18 Oct 2025 00:00:00 +0000

After winning this year’s Mendix Capture the Flag event, many people have asked me for tips. I wrote this writeup with my insights for next Capture the Flag events. Read on to learn more!

Recap

The Capture the Flag event consisted of three difficulty levels: Pizza Mario (beginner–medium), Patient Portal (hard–insane) and Magic level challenges. In total, you had about 30 hours to complete the 26 challenges. Since we solved 24 challenges (and also ate and slept), this leaves about 20 hours of hacking, which means solving approximately one challenge every hour of hacking. Time is of the essence, and working efficiently is important.

CTF on Marius van der Knaap

No Accessible Vector (CTF solution)

Tips for the next Mendix Capture the Flag event

Recap