Experiences of a cybersecurity guy 🐱‍💻

Nadya’s Puzzle — Complete Writeup

This is a full writeup of Nadya’s Puzzle, a multi-stage cryptographic and steganographic puzzle that circulated on various imageboards.

The puzzle was introduced with the following message:

There are 10 steps to the puzzle. It starts very simple but gets more complex with each step.
Each step will give you information to discover the next step.
Some knowledge of steganography, encryption, and ciphers will help.
I apologize in advance for the difficulty of step 9 — it’s driven some people to insanity — but it can be solved, I promise.

If you would like to enter The Wired your first step is…

hsvvrp.zjsvzlsfo.paola.lluayhjlp..pzy.bolyl.


Step 1 — Caesar Cipher and Hidden URL

The first hint already starts the puzzle:

hsvvrp.zjsvzlsfo.paola.lluayhjlp..pzy.bolyl.

Applying a Caesar shift produces:

alooki.scloselyh.ithet.eentracei..isr.uhere.

Which reads:

Look closely, the entrance is here

Extracting the apparently superfluous letters:

ai.sh.it.ei..r.u

Removing dots gives a URL:

https://aishitei.ru


Step 2 — Finding Lain

Inspecting the page source reveals hidden text:

You’re off to a good start.
Now look up.
Or maybe it was down?
Try asking the girl, Lain, for help.
She should be around here somewhere.

Refreshing the page changes the mascot. The FAQ explains mascots can be selected using a waifu URL parameter.

Enumerating mascots reveals one representing Lain.


Step 3 — Hidden Audio

Running strings on the Lain image reveals reversed messages and a filename hinting at an embedded audio file:

track_44.wav

Listening to it reveals Morse code.


Step 4 — Morse Code

Decoding the Morse code yields:

CAN YOU HEAR ME
LISTEN CLOSELY
LISTEN CLOSELY
DANGER DANGER
RUN
NADYANAY DOT ME
FIND ME THERE

Another URL is revealed.


Step 6 — Hexadecimal URL

Inspecting https://nadyanay.me reveals a hex string:

6e616479616e61792e6d652f77697265642e747874

Decoded to ASCII:

nadyanay.me/wired.txt


Step 7 — Capital Letters

Extracting all capitalized words from wired.txt produces:

INO WE NEED YOUR HELP
WHAT DOES IT WANT
THE ENTRANCE CAN BE FOUND
KEEP LOOKING
PROCEED TO STEP EIGHT TXT


Step 8 — Monoalphabetic Cipher

The next file contains a monoalphabetic substitution cipher which decodes to:

YOU FOUND US
WELCOME TO THE WIRED
SHH THEY CAN HEAR YOU
GO BACK TO THE GIRLS
LAIN WANTS YOU TO WATCH
OMNIPRESENCE MKV
THEN READ
OMNIPRESENCE OMNIPRESENCE


Step 9 — Omnipresence

Two files are provided:

A hint is given:

this step has to do with endianness

The .omnipresence File

The file is composed of repeated 3×3 blocks where the center is always blank.

Mapping:
– O = 0
– X = 1

Reading the surrounding bits row-major yields:

present day
present time
how does it feel
to have entered the wired?
this is the final step
you must escape

The MKV Is Not a Video

The MKV contains raw pcm_s16le audio. Extracting and inspecting it reveals nibble-encoded data.

After nibble packing, byte swapping, XOR decoding, and raw DEFLATE decompression, the final payload reduces to a binary alphabet that decodes to:

UUUUUUUUU


Conclusion

There is no final URL, no flag, and no further message.

The meaningful ending was already given:

this is the final step
you must escape

Everything beyond that exists solely to ensure the solver proves they can decode it.

You entered the Wired.

#puzzle