Challenge list
Digital ForensicsLevel 2★★☆☆☆Find Process in Memory Dump
memory.dump is a simplified text of memory-analysis output (pslist / psscan / cmdline). Find the suspicious process…
General SkillsLevel 2★★☆☆☆Log Analysis - Find the Intruder
/app/auth.log contains authentication logs. Detect suspicious activity: - Identify the IP address with 10+ failed…
Digital ForensicsLevel 2★★☆☆☆Recover Deleted Files
Recover the deleted compressed file (ZIP) from the disk image and find the flag in the memo inside it. Learn how to…
General SkillsLevel 2★★☆☆☆Compression Maze - Nested Archives
/app/flag.tar.gz is a nested compressed file. Decompress step by step: flag.tar.gz → flag.tar → flag.zip.bz2.gz →…
General SkillsLevel 2★★☆☆☆Regex Master - Log File Analysis
The file /app/access.log contains thousands of access log entries. Extract all entries where the IP address starts…
General SkillsLevel 2★★☆☆☆Environment Variable Master - PATH Hijacking
There is a hidden command "getflag" in /app/secret_bin directory. However, this directory is not in PATH, so you…
Digital ForensicsLevel 2★★☆☆☆Message Hidden in Image LSB
Extract the message hidden in the LSB (Least Significant Bit) of a PNG file. Learn the basics of steganography…
Digital ForensicsLevel 3★★★☆☆Extract Session Cookies from Chrome
You are given `/challenge/Cookies` and `/challenge/History` (both SQLite) taken from a Linux Chrome profile. The…
Digital ForensicsLevel 3★★★☆☆Detect DNS Tunneling
Analyze the DNS query log `dns_queries.log` to detect data exfiltration via DNS tunneling. Find the host flooding a…
General SkillsLevel 3★★★☆☆Docker Forensics - Container Investigation
With no Docker daemon available, investigate the metadata of the image `registry.internal/kinoco-billing-api:2.4.1`:…
General SkillsLevel 3★★★☆☆Find the Deleted API Key in Git History
/app/repo is a Git repository. A developer accidentally committed an API_KEY and removed it in a later commit. Inspect…
LinuxLevel 3★★★☆☆Linux-Capabilities. Privilege Escalation Beyond SUID
A specific binary on this system has Linux capabilities assigned to it. Investigate a privilege escalation technique…
LinuxLevel 3★★★☆☆Linux-SUID Exploit. Escalating Privileges via the find Binary
A copy of the find command with the SUID bit set exists on this system. Use a well-known GTFOBins technique to obtain…
LinuxLevel 3★★★☆☆Linux-Proc Memory. Peeking at a Process's Environment
A daemon process runs continuously in the background, with the flag set as one of its environment variables.…
LinuxLevel 3★★★☆☆Linux-Strace. Tracing System Calls to Expose a File
A binary that leaves nothing in standard output or on disk is provided. It reads a key from a hidden file,…
LinuxLevel 3★★★☆☆Linux-Race Condition. Exploiting a TOCTOU Gap for Root Files
A cleanup script that root runs periodically has a gap (TOCTOU) between checking and acting on a file. Try exploiting…
Digital ForensicsLevel 3★★★☆☆Find Deleted File Traces in NTFS $MFT
You are given `/challenge/mft_records.txt`, the `$MFT` of the Windows machine `KINOCO-WS07` written out as per-record…
General SkillsLevel 3★★★☆☆Python Automation - REST API Data Collection
A paginated local API runs in the container at `http://127.0.0.1:8000/api/records?page=N`. Walk every page until…
General SkillsLevel 3★★★☆☆SQL Query Master - Complex Joins
The SQLite database `/challenge/company.db` has 3 tables: - employees (id, name, department_id, salary, email, note) -…
Digital ForensicsLevel 3★★★☆☆Detect Brute-Force Attack in Event Logs
Analyze the sshd authentication log `/challenge/auth.log` of the server `kinoco-srv01` and identify the session of the…
General SkillsLevel 3★★★☆☆System Call Tracing - strace Debugging
Analyze `/challenge/strace.log`, a strace recording of the source-less program `/app/mystery_program`. The program…
General SkillsLevel 3★★★☆☆System Log Analysis - journalctl Master
Analyze `/challenge/system.log`, a systemd journal exported in `journalctl -o short` style. Each line reads "timestamp…
General SkillsLevel 3★★★☆☆Network Master - Netcat Reverse Shell
Analyze the prerecorded artifacts/netcat/callback-transcript.log without connecting to any external host; no listener…
General SkillsLevel 3★★★☆☆Performance Analysis - Find the Resource Hog
Analyze the server snapshot `/challenge/metrics.log`. The first half is a top-style process table (%CPU is column 9,…