What you will learn
- Investigate systems with core commands
- Understand files and permissions
- Find evidence in logs and running processes
Hands-on Linux Security CTF Challenges
Practice Linux commands, permissions, processes, logs, and privilege boundaries through focused security challenges.
Linux challenges
39 challenges available.
LinuxLevel 2Linux-Package Info. Inspecting Installed Package Details
A custom-built deb package is installed on this system. Use dpkg or apt to inspect the package's details and find…
LinuxLevel 2Linux-Process Hunting. Tracking Down a Running Process
Among several background processes, one has the flag embedded in its command-line arguments. List them with ps and…
LinuxLevel 2Linux-User Investigation. Filtering the Target User with awk
Several users are registered on this system. Parse /etc/passwd with awk to find the one matching a specific condition,…
LinuxLevel 2Linux-Log Rotation. Searching Compressed Historical Logs
Some older log files have been gzip-compressed by log rotation. Use a command that searches inside compressed files…
LinuxLevel 2Linux-Log Explorer. Digging the Flag Out of Multiple Logs
Multiple application and system log files are provided. The flag is embedded in a single DEBUG-level line — narrow it…
LinuxLevel 2Linux-Environment Secrets. Finding the Variable Named FLAG
Several environment variables, including some dummy credentials, are set on this system. List them with env and find…
LinuxLevel 3Linux-Capabilities. Privilege Escalation Beyond SUID
A specific binary on this system has Linux capabilities assigned to it. Investigate a privilege escalation technique…
LinuxLevel 3Linux-SUID Exploit. Escalating Privileges via the find Binary
A copy of the find command with the SUID bit set exists on this system. Use a well-known GTFOBins technique to obtain…
LinuxLevel 3Linux-Proc Memory. Peeking at a Process's Environment
A daemon process runs continuously in the background, with the flag set as one of its environment variables.…
LinuxLevel 3Linux-Strace. Tracing System Calls to Expose a File
A binary that prints nothing to standard output is provided. Trace its system calls with strace to determine which…
LinuxLevel 3Linux-Race Condition. Exploiting a TOCTOU Gap for Root Files
A cleanup script that root runs periodically has a gap (TOCTOU) between checking and acting on a file. Try exploiting…
LinuxLevel 4Linux-Kernel Module. Gaining Root via a Vulnerable Driver
This challenge analyzes a vulnerable kernel module with a /proc interface as a safe user-space simulation. Find the…
LinuxLevel 4Linux-Buffer Overflow. Exploiting a gets() Vulnerability
A vulnerable SUID C binary with protections disabled is provided. Exploit its buffer overflow to redirect control flow…
LinuxLevel 5Linux-eBPF Rootkit. Unmasking a Hidden Process
This challenge safely recreates eBPF-rootkit investigation as offline evidence analysis. Without loading eBPF or…
LinuxLevel 5Linux-Kernel Exploit. Rewriting a Read-Only File with Dirty COW
This challenge models mmap, MAP_PRIVATE, and madvise—the ingredients used by Dirty COW (CVE-2016-5195)—as a safe,…