What you will learn
- Use essential CTF tools
- Develop a methodical observation habit
- Build foundations for specialist categories
Beginner CTF and Security Fundamentals
Build the command-line, encoding, search, and tool skills needed before moving into specialist security topics.
General Skills challenges
42 challenges available.
General Skills Level 4 CI/CD Security - GitHub Actions Vulnerability
Investigate the GitHub Actions workflows under `/challenge/repo/.github/workflows/` and the run logs under…
General Skills Level 4 Infrastructure as Code - Terraform Security
Analyze a generated tfstate artifact without initializing a Terraform provider. Recover the flag from the audit_only…
General Skills Level 4 Kubernetes Basics - Cluster Investigation
Investigate a Pod snapshot artifact without connecting to a Kubernetes cluster. Recover the encoded value in the…
General Skills Level 4 Custom Tool Development - Web Directory Scanner
Analyze a locally generated directory-scanner report instead of scanning a live website. Recover the payload on the…
General Skills Level 4 Network Tunneling - SSH Port Forwarding
Practice SSH local port forwarding inside one container. The SSH jump role is 127.0.0.1:22 and the internal service…
General Skills Level 4 Encrypted Communication - GPG Public Key Cryptography
Practice GnuPG decryption. Import every private key under `/challenge/keys/` and decrypt each ciphertext under…
General Skills Level 4 Vulnerability Scanning - Advanced Nmap NSE
Analyze the vulnerability-scan report `scan_results/nmap_scan.nmap`. Most Nmap NSE `vuln` results are `NOT VULNERABLE`…
General Skills Level 4 Static Analysis - Code Vulnerability Scanning
`/challenge/src/` contains the Python source of a web application. Use static analysis (`bandit`, `semgrep`) to…
General Skills Level 5 APT Simulation - Full Breach Scenario
This is not an attack exercise but a blue-team task of reading the logs of an incident that already happened. Analyze…
General Skills Level 5 Bug Bounty Practice - Vulnerability Discovery Master
Analyze a fixed bug-bounty triage report instead of testing a live application. Recover the proof attached to the…
General Skills Level 5 Red Teaming - Custom C2 Framework
No C2 server, agent, socket communication, or command execution is started. Analyze the analysis-result record in the…
General Skills Level 5 Anti-Forensics - Evidence Elimination
After intrusion the attacker tried to cover their tracks, truncating part of `/challenge/auth_syslog.log` and clearing…
General Skills Level 5 Custom Malware - Stealth Techniques
No executable malware, injection, or evasion capability is included. Analyze an inert configuration sample and recover…
General Skills Level 5 Cloud Pentesting - AWS Multi-Stage Attack
Do not use AWS credentials, a metadata endpoint, or Lambda. Analyze the local simulated CloudTrail chain and recover…
General Skills Level 5 Container Escape - Kubernetes Privilege Escalation
Do not use a Kubernetes API, host mount, privileged container, or escape. Read the static privileged-mount audit and…
General Skills Level 5 Supply Chain Attack - Dependency Exploitation
Analyze the dependency records of a Node.js app (`package.json`, `dependencies.txt`, `install.log`). Identify the…
General Skills Level 5 Pivoting - Multi-Tier Network Penetration
Analyze a prerecorded offline routing topology without creating routes, tunnels, proxies, or remote services. Recover…
General Skills Level 5 Fuzzing Basics - 0-day Discovery
Analyze a pre-minimized safe crash artifact without running a fuzzer or target binary. Recover the flag from the…