What you will learn
- Parse and transform evidence
- Break investigations into testable steps
- Automate repetitive security analysis
Programming Challenges for CTF and Security
Write small programs to transform data, automate investigation, and solve security tasks that do not scale by hand.
Programming challenges
47 challenges available.
Programming Level 3 Programming - Multithreaded Result Reassembly
worker-results.jsonl is generated from the FLAG injected at startup. Base64-decode results, XOR with worker SHA-1, and…
Programming Level 3 Programming - Memory Dump Analysis
memory.img is generated from the FLAG injected at startup. Extract the ALLOC:0x4040 little-endian region and…
Programming Level 3 Programming - Known-Plaintext Attack
known.txt and ciphertext.b64 are generated from the FLAG injected at startup. Derive the repeating XOR keystream from…
Programming Level 3 Programming - Custom Protocol Parsing
protocol.bin is generated from the FLAG injected at startup. Walk length-prefixed KINO frames and XOR-decrypt type=3…
Programming Level 3 Programming - Image Steganography
image.pgm is generated from the FLAG injected at startup. Read pixel LSBs in 8-bit groups until NUL to recover the flag.
Programming Level 4 Advanced Python - Custom VM Bytecode Execution
program.kvm is bytecode for a custom four-register VM. Implement an interpreter in Python from the instruction…
Programming Level 4 Binary Repair - Firmware Header and CRC32
Repair firmware.bin by writing KINO at bytes 0-3 and the little-endian CRC32 of bytes 12+ at bytes 8-11. Submit the…
Programming Level 4 Programming - C2 Traffic Analysis
beacon.log is generated from the FLAG injected at startup. Join Base64 payloads by seq and repeat-XOR with the first…
Programming Level 4 Programming - Buffer Overflow Crash Analysis
crash-report.txt is generated from the FLAG injected at startup. Select the SIGSEGV/fault_offset record and…
Programming Level 4 Programming - Fuzzing Result Analysis
fuzz-results.log is generated from the FLAG injected at startup. Select the SIGSEGV input and XOR-decrypt it with…
Programming Level 4 Programming - Blockchain Event Reassembly
blocks.json is generated from the FLAG injected at startup. Filter FlagFragment events with topic 0xfeedface, order by…
Programming Level 4 Programming - Rootkit View Diffing
proc_ps.txt and proc_kernel.txt are generated from the FLAG injected at startup. Diff process views and ROT13-decode…
Programming Level 4 Programming - Anomaly Detection
requests.csv is generated from the FLAG injected at startup. Select the highest-signal payload, Base85-decode, then…
Programming Level 4 Programming - Pentest Finding Analysis
findings.json is generated from the FLAG injected at startup. Locate the reachable critical finding and reverse…
Programming Level 4 Programming - Async Scan Result Analysis
scan.json is generated from the FLAG injected at startup. Select the verification host with open 443/tcp and…
Programming Level 5 Advanced Python - Concurrent Event DAG Correlation
events.jsonl interleaves randomly ordered events from many services and traces. Starting from the marked auth.failed…
Programming Level 5 Programming - APT Timeline Analysis
timeline.jsonl is generated from the FLAG injected at startup. Filter exfiltration events, order by part, reverse…
Programming Level 5 Programming - AST-Based Vulnerability Detection
audit_samples.py is generated from the FLAG injected at startup. AST-detect shell=True and hex-decode review_token…
Programming Level 5 Programming - AWS Permission Analysis
cloud_inventory.json and approved.json are generated from the FLAG injected at startup. Verify forensic-reader's…
Programming Level 5 Programming - IoT Firmware Analysis
firmware.bin is generated from the FLAG injected at startup. Verify the KFW1 integrity tag and parse salt, length, and…
Programming Level 5 Programming - Coverage-Guided Fuzzing
coverage-queue.jsonl is generated from the FLAG injected at startup. Order Base64 inputs by offset and XOR-decrypt…
Programming Level 5 Programming - Zero-Click Message Analysis
messages.ndjson is generated from the FLAG injected at startup. Order payloads by sequence and XOR-decrypt with 0x31…
Programming Level 5 Programming - Timing Attack Data Analysis
timings.csv is generated from the FLAG injected at startup. Join the candidate with maximum median_us at every…