Challenge list
Digital ForensicsLevel 3★★★☆☆Find Deleted File Traces in NTFS $MFT
You are given `/challenge/mft_records.txt`, the `$MFT` of the Windows machine `KINOCO-WS07` written out as per-record…
General SkillsLevel 3★★★☆☆Python Automation - REST API Data Collection
A paginated local API runs in the container at `http://127.0.0.1:8000/api/records?page=N`. Walk every page until…
General SkillsLevel 3★★★☆☆SQL Query Master - Complex Joins
The SQLite database `/challenge/company.db` has 3 tables: - employees (id, name, department_id, salary, email, note) -…
Digital ForensicsLevel 3★★★☆☆Detect Brute-Force Attack in Event Logs
Analyze the sshd authentication log `/challenge/auth.log` of the server `kinoco-srv01` and identify the session of the…
General SkillsLevel 3★★★☆☆System Call Tracing - strace Debugging
Analyze `/challenge/strace.log`, a strace recording of the source-less program `/app/mystery_program`. The program…
General SkillsLevel 3★★★☆☆System Log Analysis - journalctl Master
Analyze `/challenge/system.log`, a systemd journal exported in `journalctl -o short` style. Each line reads "timestamp…
General SkillsLevel 3★★★☆☆Network Master - Netcat Reverse Shell
Analyze the prerecorded artifacts/netcat/callback-transcript.log without connecting to any external host; no listener…
Network SecurityLevel 3★★★☆☆Network Analysis - 802.1Q VLAN Separated Traffic
capture.pcap was captured from a mirrored switch trunk port, so frames from several VLANs are mixed together with…
Network SecurityLevel 3★★★☆☆Network Analysis - SNMP Information Leak
A device speaking SNMPv2c with a weak community string (public) was captured returning a GetResponse. Download the…
Network SecurityLevel 3★★★☆☆Network Analysis - SSL Strip Clear-text Credentials
An SSL Strip attack downgraded HTTPS to HTTP, so the victim's credentials traveled in clear text and were captured.…
Network SecurityLevel 3★★★☆☆Network Analysis - Unmasking WebSocket Frames
capture.pcap records WebSocket traffic between a browser and a chat server. Every client-to-server frame is masked…
Network SecurityLevel 3★★★☆☆Network Analysis - Custom Protocol Decoding
Traffic from a system using a small custom binary protocol was captured. Download the packet capture (traffic.pcap),…
General SkillsLevel 3★★★☆☆Performance Analysis - Find the Resource Hog
Analyze the server snapshot `/challenge/metrics.log`. The first half is a top-style process table (%CPU is column 9,…
Digital ForensicsLevel 3★★★☆☆Find Suspicious Network Connections in Memory
From the memory image of the compromised host `kinoco-app03`, the socket table `/challenge/netstat_dump.txt` and the…
Digital ForensicsLevel 3★★★☆☆Recover Executed Commands from Memory
Analyze the memory-string record `memdump.txt` to recover the executed command history. Decode the Base64 strings and…
Digital ForensicsLevel 3★★★☆☆Recover Deleted SQLite Records
You are given the SQLite database `/challenge/app.db` of the internal chat tool "kinoco-msg". The body of a message…
Digital ForensicsLevel 3★★★☆☆Decompress Multi-Layer Archive
`/challenge/artifact.xz` is a file an attacker tried to take out, wrapped many times in gzip, bzip2, xz, zip and tar.…
Digital ForensicsLevel 3★★★☆☆Decrypt Encrypted Disk
`/challenge/secret_disk.img` is a genuine LUKS2 container. Its data area holds a backup (a tar archive). The…
General SkillsLevel 3★★★☆☆Regex Expert - Data Validation
/challenge/data.txt holds 400 contact records. Each line contains an email address, a phone number, an IP address and…
Digital ForensicsLevel 3★★★☆☆Data Hidden in Audio File
`hidden.wav` hides a message encoded with on-off keying (OOK). Turn the tone on/off slots into bits and decode them to…
General SkillsLevel 3★★★☆☆Advanced Automation - Directory Monitor
`/challenge/logs/` holds access logs from four web front ends (combined log format, 60 files, over 100k lines). The…
General SkillsLevel 4★★★★☆AWS CLI - S3 Bucket Investigation
An offline export of the S3 configuration is under `/challenge/s3_audit/` (`buckets.json` plus each bucket's…
Digital ForensicsLevel 4★★★★☆Extract Secret Key from Android App
Extract a safe ZIP-formatted APK fixture (evidence/app.apk) and analyze the encrypted API secret recorded in its…
General SkillsLevel 4★★★★☆Ansible Automation - Server Configuration Management
Analyze the generated run export artifacts/ansible/vault-export.yml without running Ansible or touching a server. It…