What you will learn
- Use essential CTF tools
- Develop a methodical observation habit
- Build foundations for specialist categories
Beginner CTF and Security Fundamentals
Build the command-line, encoding, search, and tool skills needed before moving into specialist security topics.
General Skills challenges
42 challenges available.
General SkillsLevel 101. First Steps - Binary and Hexadecimal
In the security world, binary and hexadecimal are commonly used. In this challenge, convert hexadecimal to ASCII…
General SkillsLevel 110. Security Basics - Ethics and Rules
To become a white hat hacker, knowledge of ethics and laws is just as important as technical skills. In this…
General SkillsLevel 2Bash Scripting - Power of Automation
/app/numbers.txt contains numbers from 1 to 1000, one per line. Extract all numbers that satisfy these conditions and…
General SkillsLevel 2Git Detective - Lost Commit
/app/repo is a Git repository. A developer accidentally deleted a commit containing important information. Use git…
General SkillsLevel 2JSON Master - Data Extraction
/app/users.json contains information of 100 users in JSON format. Extract users that meet these conditions: - age…
General SkillsLevel 2OSINT Basics - Metadata Analysis
Recovered files sit under `/challenge/evidence/`. Analyze the metadata (Exif / docProps) across the photos…
General SkillsLevel 2Text Processing Master - sed & awk
/app/data.csv contains CSV data. Perform these operations: 1. Extract only rows where column 2 (price) >= 1000 2.…
General SkillsLevel 2Process Hunter - Hidden Process
A process named "secret_service" is running in the background. Find this process and get the following information: 1.…
General SkillsLevel 2Log Analysis - Find the Intruder
/app/auth.log contains authentication logs. Detect suspicious activity: - Identify IP addresses with 10+ failed logins…
General SkillsLevel 2Compression Maze - Nested Archives
/app/flag.tar.gz is a nested compressed file. Decompress step by step: flag.tar.gz → flag.tar → flag.zip.bz2.gz →…
General SkillsLevel 2Regex Master - Log File Analysis
The file /app/access.log contains thousands of access log entries. Extract all entries where the IP address starts…
General SkillsLevel 2Environment Variable Master - PATH Hijacking
There is a hidden command "getflag" in /app/secret_bin directory. However, this directory is not in PATH, so you…
General SkillsLevel 3Docker Forensics - Container Investigation
Investigate a `docker save`-style image record. The final `Config.Env` in `image_config.json` looks scrubbed, but…
General SkillsLevel 3Find the Deleted API Key in Git History
/app/repo is a Git repository. A developer accidentally committed an API_KEY and removed it in a later commit. Inspect…
General SkillsLevel 3Python Automation - REST API Data Collection
A paginated local API runs in the container at `http://127.0.0.1:8000/api/records?page=N`. Walk every page until…
General SkillsLevel 3SQL Query Master - Complex Joins
SQLite database /app/company.db has 3 tables: - employees (id, name, department_id, salary) - departments (id, name,…
General SkillsLevel 3System Call Tracing - strace Debugging
Analyze `/challenge/strace.log`, a recorded trace of the source-less program `/app/mystery_program`. Find where it…
General SkillsLevel 3System Log Analysis - journalctl Master
Analyze `/challenge/system.log`, an exported systemd journal. Exactly one log line is from the authentication service…
General SkillsLevel 3Network Master - Netcat Reverse Shell
Analyze a prerecorded callback transcript without connecting to any external host. No listener or shell is started.…
General SkillsLevel 3Performance Analysis - Find the Resource Hog
Analyze the recorded performance metrics in `/challenge/metrics.log`. Identify the single process that is an outlier…
General SkillsLevel 3Regex Expert - Data Validation
/app/data.txt contains various data formats. Extract lines that satisfy ALL conditions: 1. Contains email format…
General SkillsLevel 3Advanced Automation - Directory Monitor
`/challenge/logs/` holds a large set of access logs. Aggregate status-404 requests per source IP and identify the…
General SkillsLevel 4AWS CLI - S3 Bucket Investigation
Analyze the S3 configuration audit under `/challenge/s3_audit/`. Inspect each bucket's `*_acl.json`, `*_policy.json`,…
General SkillsLevel 4Ansible Automation - Server Configuration Management
Analyze a generated vault export without running Ansible or touching a server. Recover the encoded payload recorded…