Challenge list
Digital ForensicsLevel 3★★★☆☆Detect Brute-Force Attack in Event Logs
Analyze the sshd authentication log `/challenge/auth.log` of the server `kinoco-srv01` and identify the session of the…
Network SecurityLevel 3★★★☆☆Network Analysis - 802.1Q VLAN Separated Traffic
capture.pcap was captured from a mirrored switch trunk port, so frames from several VLANs are mixed together with…
Network SecurityLevel 3★★★☆☆Network Analysis - SNMP Information Leak
A device speaking SNMPv2c with a weak community string (public) was captured returning a GetResponse. Download the…
Network SecurityLevel 3★★★☆☆Network Analysis - SSL Strip Clear-text Credentials
An SSL Strip attack downgraded HTTPS to HTTP, so the victim's credentials traveled in clear text and were captured.…
Network SecurityLevel 3★★★☆☆Network Analysis - Unmasking WebSocket Frames
capture.pcap records WebSocket traffic between a browser and a chat server. Every client-to-server frame is masked…
Network SecurityLevel 3★★★☆☆Network Analysis - Custom Protocol Decoding
Traffic from a system using a small custom binary protocol was captured. Download the packet capture (traffic.pcap),…
Digital ForensicsLevel 3★★★☆☆Find Suspicious Network Connections in Memory
From the memory image of the compromised host `kinoco-app03`, the socket table `/challenge/netstat_dump.txt` and the…
Digital ForensicsLevel 3★★★☆☆Recover Executed Commands from Memory
Analyze the memory-string record `memdump.txt` to recover the executed command history. Decode the Base64 strings and…
Digital ForensicsLevel 3★★★☆☆Recover Deleted SQLite Records
You are given the SQLite database `/challenge/app.db` of the internal chat tool "kinoco-msg". The body of a message…
Digital ForensicsLevel 3★★★☆☆Decompress Multi-Layer Archive
`/challenge/artifact.xz` is a file an attacker tried to take out, wrapped many times in gzip, bzip2, xz, zip and tar.…
Digital ForensicsLevel 3★★★☆☆Decrypt Encrypted Disk
`/challenge/secret_disk.img` is a genuine LUKS2 container. Its data area holds a backup (a tar archive). The…
Digital ForensicsLevel 3★★★☆☆Data Hidden in Audio File
`hidden.wav` hides a message encoded with on-off keying (OOK). Turn the tone on/off slots into bits and decode them to…
Digital ForensicsLevel 4★★★★☆Extract Secret Key from Android App
Extract a safe ZIP-formatted APK fixture (evidence/app.apk) and analyze the encrypted API secret recorded in its…
Digital ForensicsLevel 4★★★★☆Detect Unauthorized Access in CloudTrail Logs
Analyze the CloudTrail export `/challenge/cloudtrail.json` and trace the unauthorized use of a stolen access key and…
Digital ForensicsLevel 4★★★★☆Extract Secrets from Docker Image Layers
`/challenge/image/` is an unpacked `docker save` export (OCI layout). The layers are stored in `blobs/sha256/` as…
Digital ForensicsLevel 4★★★★☆Decrypt TLS-Encrypted HTTPS Traffic
In `~/evidence/` there is a capture `traffic.pcap` (libpcap format) of HTTPS traffic from a client PC, and the TLS key…
Network SecurityLevel 4★★★★☆Network Analysis - Rebuilding Chunked gzip HTTP from TCP
capture.pcap records two HTTP exchanges over one TCP connection. The server's segments are reordered and some are…
Network SecurityLevel 4★★★★☆Network Analysis - TCP Retransmission Covert Channel
capture.pcap contains TCP retransmissions with duplicate sequence numbers. Extract retransmissions whose payload…
Digital ForensicsLevel 4★★★★☆Extract Malware Payload from Memory
`/challenge/memstrings.txt` holds the strings extracted from the address space of a suspicious process, and the…
Digital ForensicsLevel 4★★★★☆Detect Hidden Kernel Module in Memory
From the memory of a Linux host suspected of an LKM rootkit infection, three sets of module information were…
Digital ForensicsLevel 4★★★★☆Decode Multi-Stage Steganography
Three stages of steganography are planted in `/challenge/cover.png` and `/challenge/notes.txt`. Each stage holds the…
Digital ForensicsLevel 4★★★★☆Recover Fragmented JPEG File
`/challenge/fragments/` holds 256-byte clusters (`clus_NNNN.bin`) recovered from the unallocated space of a memory…
Digital ForensicsLevel 4★★★★☆Recover Damaged RAID5 Array
The RAID5 array `/dev/md0` (4 members) on the file server fs01 no longer assembles after the member sdd failed.…
Digital ForensicsLevel 4★★★★☆Reconstruct Attack Scenario from Multiple Logs
`/challenge/web.log`, `/challenge/auth.log` and `/challenge/db.log` record the same intrusion among a lot of…