What you will learn
- Parse and transform evidence
- Break investigations into testable steps
- Automate repetitive security analysis
Programming Challenges for CTF and Security
Write small programs to transform data, automate investigation, and solve security tasks that do not scale by hand.
Programming challenges
47 challenges available.
ProgrammingLevel 3Programming - Multithreaded Result Reassembly
worker-results.jsonl is generated from the FLAG injected at startup. Base64-decode results, XOR with worker SHA-1, and…
ProgrammingLevel 3Programming - Memory Dump Analysis
memory.img is generated from the FLAG injected at startup. Extract the ALLOC:0x4040 little-endian region and…
ProgrammingLevel 3Programming - Known-Plaintext Attack
known.txt and ciphertext.b64 are generated from the FLAG injected at startup. Derive the repeating XOR keystream from…
ProgrammingLevel 3Programming - Custom Protocol Parsing
protocol.bin is generated from the FLAG injected at startup. Walk length-prefixed KINO frames and XOR-decrypt type=3…
ProgrammingLevel 3Programming - Image Steganography
image.pgm is generated from the FLAG injected at startup. Read pixel LSBs in 8-bit groups until NUL to recover the flag.
ProgrammingLevel 4Advanced Python - Custom VM Bytecode Execution
program.kvm is bytecode for a custom four-register VM. Implement an interpreter in Python from the instruction…
ProgrammingLevel 4Binary Repair - Firmware Header and CRC32
Repair firmware.bin by writing KINO at bytes 0-3 and the little-endian CRC32 of bytes 12+ at bytes 8-11. Submit the…
ProgrammingLevel 4Programming - C2 Traffic Analysis
beacon.log is generated from the FLAG injected at startup. Join Base64 payloads by seq and repeat-XOR with the first…
ProgrammingLevel 4Programming - Buffer Overflow Crash Analysis
crash-report.txt is generated from the FLAG injected at startup. Select the SIGSEGV/fault_offset record and…
ProgrammingLevel 4Programming - Fuzzing Result Analysis
fuzz-results.log is generated from the FLAG injected at startup. Select the SIGSEGV input and XOR-decrypt it with…
ProgrammingLevel 4Programming - Blockchain Event Reassembly
blocks.json is generated from the FLAG injected at startup. Filter FlagFragment events with topic 0xfeedface, order by…
ProgrammingLevel 4Programming - Rootkit View Diffing
proc_ps.txt and proc_kernel.txt are generated from the FLAG injected at startup. Diff process views and ROT13-decode…
ProgrammingLevel 4Programming - Anomaly Detection
requests.csv is generated from the FLAG injected at startup. Select the highest-signal payload, Base85-decode, then…
ProgrammingLevel 4Programming - Pentest Finding Analysis
findings.json is generated from the FLAG injected at startup. Locate the reachable critical finding and reverse…
ProgrammingLevel 4Programming - Async Scan Result Analysis
scan.json is generated from the FLAG injected at startup. Select the verification host with open 443/tcp and…
ProgrammingLevel 5Advanced Python - Concurrent Event DAG Correlation
events.jsonl interleaves randomly ordered events from many services and traces. Starting from the marked auth.failed…
ProgrammingLevel 5Programming - APT Timeline Analysis
timeline.jsonl is generated from the FLAG injected at startup. Filter exfiltration events, order by part, reverse…
ProgrammingLevel 5Programming - AST-Based Vulnerability Detection
audit_samples.py is generated from the FLAG injected at startup. AST-detect shell=True and hex-decode review_token…
ProgrammingLevel 5Programming - AWS Permission Analysis
cloud_inventory.json and approved.json are generated from the FLAG injected at startup. Verify forensic-reader's…
ProgrammingLevel 5Programming - IoT Firmware Analysis
firmware.bin is generated from the FLAG injected at startup. Verify the KFW1 integrity tag and parse salt, length, and…
ProgrammingLevel 5Programming - Coverage-Guided Fuzzing
coverage-queue.jsonl is generated from the FLAG injected at startup. Order Base64 inputs by offset and XOR-decrypt…
ProgrammingLevel 5Programming - Zero-Click Message Analysis
messages.ndjson is generated from the FLAG injected at startup. Order payloads by sequence and XOR-decrypt with 0x31…
ProgrammingLevel 5Programming - Timing Attack Data Analysis
timings.csv is generated from the FLAG injected at startup. Join the candidate with maximum median_us at every…