Challenge list
General SkillsLevel 4★★★★☆AWS CLI - S3 Bucket Investigation
An offline export of the S3 configuration is under `/challenge/s3_audit/` (`buckets.json` plus each bucket's…
General SkillsLevel 4★★★★☆Ansible Automation - Server Configuration Management
Analyze the generated run export artifacts/ansible/vault-export.yml without running Ansible or touching a server. It…
General SkillsLevel 4★★★★☆CI/CD Security - GitHub Actions Vulnerability
Audit the 20 GitHub Actions workflows under `/challenge/repo/.github/workflows/`. Many steps carry a `# audit-ticket:…
General SkillsLevel 4★★★★☆Infrastructure as Code - Terraform Security
Analyze the generated terraform/terraform.tfstate without initializing a Terraform provider. The output…
General SkillsLevel 4★★★★☆Kubernetes Basics - Cluster Investigation
Investigate the two snapshots in artifacts/kubernetes/ (pod-snapshot.yaml and secret-snapshot.yaml) without connecting…
LinuxLevel 4★★★★☆Linux-Kernel Module. Gaining Root via a Vulnerable Driver
This challenge analyzes a vulnerable character-device driver as a safe user-space simulation. No real kernel module is…
LinuxLevel 4★★★★☆Linux-Buffer Overflow. Exploiting a gets() Vulnerability
A vulnerable SUID C binary with protections disabled is provided. Exploit its buffer overflow to redirect control flow…
General SkillsLevel 4★★★★☆Custom Tool Development - Web Directory Scanner
Analyze the locally generated artifacts/scanner/directory-report.ndjson instead of scanning a live website. The…
General SkillsLevel 4★★★★☆Network Tunneling - SSH Port Forwarding
Practice SSH local port forwarding inside one container. SSH listens on 127.0.0.1:22 and the internal service uses…
Network SecurityLevel 4★★★★☆Network Analysis - Rebuilding Chunked gzip HTTP from TCP
capture.pcap records two HTTP exchanges over one TCP connection. The server's segments are reordered and some are…
Network SecurityLevel 4★★★★☆Network Analysis - TCP Retransmission Covert Channel
capture.pcap contains TCP retransmissions with duplicate sequence numbers. Extract retransmissions whose payload…
General SkillsLevel 4★★★★☆Encrypted Communication - GPG Public Key Cryptography
Practice GnuPG decryption. Import every private key under `/challenge/keys/` and decrypt each ciphertext under…
CryptographyLevel 4★★★★☆Cryptanalysis - DSA Nonce Reuse Key Recovery
/challenge/signatures.json, created with fresh keys at every start, holds the DSA public parameters (p of 1024 bits, q…
CryptographyLevel 4★★★★☆Cryptanalysis - Wiener's Attack on RSA
An embedded-device team made the RSA private exponent d very small to speed up decryption. The public exponent e in…
CryptographyLevel 4★★★★☆Cryptanalysis - Recovering an LCG's Hidden Parameters
A service generated both session tokens and an encryption keystream from a linear congruential generator x_{k+1} =…
General SkillsLevel 4★★★★☆Vulnerability Scanning - Advanced Nmap NSE
The results of running `nmap -sV -sC --script vuln` against the internal subnet `10.66.13.0/24` are in…
General SkillsLevel 4★★★★☆Static Analysis - Code Vulnerability Scanning
The Python source of an internal notes app is in `/challenge/src/`. The nine lines flagged by an earlier…