The first step in any forensics challenge is identifying the file type. Despite the .rar extension, tools like file or a hex editor (like HxD) are used to confirm the header. file 2_boys_1_cup.rar
Once the final layer is reached, you are typically left with a text file or an image. 2 Boys 1 Cup.rar
In this specific DUCTF challenge, the "Cup" refers to the final file containing the flag string. Flag Format: DUCTF{...} Key Takeaway The first step in any forensics challenge is
Most solvers use a simple Python or Bash loop to repeatedly unzip/unrar until no more archives remain. 2 Boys 1 Cup.rar