Challenge list
Network SecurityLevel 1★☆☆☆☆08. Network Basics - Learn Port Numbers
Networks use port numbers to identify services. For example, a web server (HTTP) usually uses port 80, and encrypted…
Digital ForensicsLevel 1★☆☆☆☆12. Identify File Signatures
Files contain identification information called "magic bytes" at the beginning. Even if the extension is disguised,…
Digital ForensicsLevel 1★☆☆☆☆13. Hidden Metadata in Images
Photos and images contain metadata called EXIF. This metadata records shooting date, camera info, GPS coordinates,…
Digital ForensicsLevel 1★☆☆☆☆15. Extract Strings from Binary
Binary files (executables, etc.) contain human-readable strings. Passwords, URLs, error messages, and other hints can…
Digital ForensicsLevel 2★★☆☆☆Find Attack in Apache Logs
Analyze the Apache access.log (common format) to find traces of SQL injection. Tell which attacks succeeded and which…
Digital ForensicsLevel 2★★☆☆☆Flag Hidden in Excel Macro
Analyze the macro code embedded in the Excel workbook and find the hidden authentication code (the flag). Learn how to…
Digital ForensicsLevel 2★★☆☆☆Hidden PDF Streams
The PDF file contains compressed object streams. An internal note that is not shown on the page is hidden inside them.…
Digital ForensicsLevel 2★★☆☆☆Find USB History in Windows Registry
Analyze the SYSTEM file (a text model of the USBSTOR part of the registry hive) to identify the USB device that was…
Digital ForensicsLevel 2★★☆☆☆Find Secret File in Disk Image
Inspect the ext4 filesystem disk image `disk.img`, find the secret backup hidden in the filesystem, and recover the…
Network SecurityLevel 2★★☆☆☆Network Analysis - DNS Zone Transfer Leak
An unauthenticated DNS zone transfer (AXFR) against a misconfigured authoritative server was captured. Download the…
Network SecurityLevel 2★★☆☆☆Network Analysis - ICMP Data Exfiltration
Data was exfiltrated from the internal host 10.20.0.15 to the external host 203.0.113.66 disguised as ping (ICMP echo…
Network SecurityLevel 2★★☆☆☆Network Analysis - SMB Share Enumeration Leak
An attacker enumerating SMB shares on the network was captured. Download the packet capture (traffic.pcap), follow the…
Network SecurityLevel 2★★☆☆☆Network Analysis - Telnet Credentials
A legacy server was administered over Telnet in clear text. Download the packet capture (traffic.pcap), follow the…
Network SecurityLevel 2★★☆☆☆Network Analysis - Anonymous FTP Transfer
An anonymous FTP session was captured in clear text. Download the packet capture (traffic.pcap), follow the FTP data…
Network SecurityLevel 2★★☆☆☆Network Analysis - Clear-text HTTP Credentials
Analyze traffic intercepted on public Wi-Fi where someone logged in over plain HTTP. Download the packet capture…
Network SecurityLevel 2★★☆☆☆Network Analysis - Plaintext SMTP Attachment
The internal host 10.30.0.25 sent an email to port 25 of the mail server 10.30.0.10 without encryption. Download…
Digital ForensicsLevel 2★★☆☆☆Find Password in Packet Capture
Clear-text HTTP traffic from a shop's internal network was captured. Among many requests, exactly one is the…
Digital ForensicsLevel 2★★☆☆☆Identify Intrusion Time from File Timestamps
Analyze the modification times of the files in evidence/ to identify when the intrusion occurred and which hidden…
Digital ForensicsLevel 2★★☆☆☆Find Process in Memory Dump
memory.dump is a simplified text of memory-analysis output (pslist / psscan / cmdline). Find the suspicious process…
Digital ForensicsLevel 2★★☆☆☆Recover Deleted Files
Recover the deleted compressed file (ZIP) from the disk image and find the flag in the memo inside it. Learn how to…
Digital ForensicsLevel 2★★☆☆☆Message Hidden in Image LSB
Extract the message hidden in the LSB (Least Significant Bit) of a PNG file. Learn the basics of steganography…
Digital ForensicsLevel 3★★★☆☆Extract Session Cookies from Chrome
You are given `/challenge/Cookies` and `/challenge/History` (both SQLite) taken from a Linux Chrome profile. The…
Digital ForensicsLevel 3★★★☆☆Detect DNS Tunneling
Analyze the DNS query log `dns_queries.log` to detect data exfiltration via DNS tunneling. Find the host flooding a…
Digital ForensicsLevel 3★★★☆☆Find Deleted File Traces in NTFS $MFT
You are given `/challenge/mft_records.txt`, the `$MFT` of the Windows machine `KINOCO-WS07` written out as per-record…