Show, don't tell
Every session ends with hands on a keyboard. If a technique can't be demonstrated on a live target, it isn't ready to be taught.
Rule 01
Est. 2026 1337 Rabat
Named after the river
that binds the worlds.
In myth, the Styx is the boundary between the living and the dead — and Charon is the one who carries you across. We liked that: a ferryman who knows every crossing, every toll, every way the boundary can be broken.
01 Origin
A club built the way 1337 builds software.
StyxSec was founded in 2026 by six students who shared a complaint: the campus had plenty of people learning to code, and almost nobody learning how that code gets broken.
So we built the thing we wanted to attend. No lectures. A lab with live targets. A weekly slot where somebody shows a technique on a real machine and then everybody tries it.
The club is one month old. That is not a weakness we are hiding — it is the reason everything on this site is either a fact or marked as still to come.
Where we are
2026
Founded
Six board seats, three technical cells, one whiteboard.
Board
6 seats
President, general secretary, vice president, and three cell heads.
Cells
5 cells
Web, Reverse, Pwn, Cloud, and Pentesting & Bug Bounty.
Next
First edition CTF
Styx CTF is being written. No date fixed yet.
02 Principles
How we operate.
Four rules that will outlast the founding board. They are why people stay.
Everyone starts somewhere
No gatekeeping. First-years get a structured track and a mentor. The only requirement is showing up.
Rule 02
Publish what you find
Findings go in public writeups. Knowledge that stays in a private chat dies with the cohort.
Rule 03
Ethics, always
Written scope before every engagement. Responsible disclosure, no exceptions. We break what we're allowed to break.
Rule 04
03 The cells
Pick a river branch.
Onboarding covers the fundamentals for everyone. After that, members join one of five cells — four technical, plus pentesting and bug bounty.
Web
Injection, authentication flaws, SSRF, template injection and deserialisation. OWASP patterns and bug-bounty methodology against real stacks.
Reverse
Static and dynamic analysis with Ghidra, x64dbg and Frida. Stripped binaries, custom VMs and packed samples.
Pwn
Stack and heap fundamentals, ROP, format strings, mitigations and how to bypass them — escalating from ret2win to heap grooming.
Cloud
Cloud attack surface, IAM misconfiguration, containers, CI/CD pipelines, and the metadata paths people forget.
Pentesting & Bug Bounty
End-to-end engagements: scoping, recon, exploitation, and a report a triager will actually accept. Led by Ztafjout.
Founded
2026
Board seats
6
Cells
5
Run by
Students
Join the next crossing.
Recruitment opens at the start of every semester. If you are a student at 1337 Rabat or UM6P Rabat, you are already eligible.