LigaCTF 2026

Find The C2 Server

LigaCTF 2026 ligactf2026, forensics, reverse engineering writeup covering Find The C2 Server with analysis, solution steps, and final recovery notes.

#ctf#ligactf2026#forensics#reverse-engineering#malware-analysis#mobile#network

Challenge Info

Challenge: Find the C2 Server Category: Mobile / Malware Analysis Difficulty: Medium Flag Format: OWASPKL{xxx}

The challenge provides a malicious APK. The goal is to identify the C2 server contacted by the application and retrieve the flag.

The APK was analyzed using static analysis only. The file was not executed because it was described as malicious.

mkdir apk_out
unzip -q malapk.apk -d apk_out

APK files are ZIP archives, so extracting the file allows inspection of resources, DEX files, and metadata.

strings -a malapk.apk | grep -Ei 'http|https|c2|server|liga|appsecmy|OWASPKL'

This revealed a suspicious URL split into parts:

https://appsecmy.com/
pages/liga-ctf-2026

After combining both parts, the C2 endpoint becomes:

https://appsecmy.com/pages/liga-ctf-2026

The C2 page was downloaded and inspected:

curl -s https://appsecmy.com/pages/liga-ctf-2026 | grep -i OWASPKL

This revealed a hidden HTML comment near the bottom of the page.

The HTML comment contains:

<!-- OWASPKL{https://chat.whatsapp.com/KAdpus4R0pb895ulC2jo8p} This is the FL4G. But feel free to join our Community Group-->

Therefore, the real flag is:

OWASPKL{https://chat.whatsapp.com/KAdpus4R0pb895ulC2jo8p}

A fake flag was also found:

OWASPKL{n0t_A_Fl4g}

This was a decoy and should not be submitted.

C2 Server:

https://appsecmy.com/pages/liga-ctf-2026

Flag:

OWASPKL{https://chat.whatsapp.com/KAdpus4R0pb895ulC2jo8p}