Challenge list
LinuxLevel 2★★☆☆☆Linux-Systemd. Checking a Service Unit's Environment Variable
A systemd unit file can set environment variables in its [Service] section. Inspect the registered service definition…
LinuxLevel 2★★☆☆☆Linux-Symlink Maze. Navigating a Branching Path
Several directories are connected in a tangled web of symbolic links. Without being misled by decoy hint files, follow…
LinuxLevel 2★★☆☆☆Linux-Script Debug. Fixing a Broken Bash Script
This script has several intentional bugs (typos, syntax mistakes) and fails to run to completion. Use bash's debugging…
LinuxLevel 2★★☆☆☆Linux-Network Basics. Connecting to a Listening Port
A background service on this system is listening on a specific port. Identify the port with ss/netstat and connect to…
LinuxLevel 2★★☆☆☆Linux-Backup Finder. Spotting the Real Temp File
The project directory contains several decoy backup/temp files ending in .bak, .tmp, or ~. The real flag is hidden…
LinuxLevel 2★★☆☆☆Linux-Pipeline. Narrowing Down Logs with grep and awk
The access log contains many entries. One IP address generated a burst of 404s, and stitching together the paths of…
LinuxLevel 2★★☆☆☆Linux-Package Info. Inspecting Installed Package Details
A custom-built deb package is installed on this system. Use dpkg or apt to inspect the package's details and find…
LinuxLevel 2★★☆☆☆Linux-Process Hunting. Tracking Down a Running Process
Among several background processes, one has the flag embedded in its command-line arguments. List them with ps and…
LinuxLevel 2★★☆☆☆Linux-User Investigation. Filtering the Target User with awk
Several users are registered on this system. Parse /etc/passwd with awk to find the one matching a specific condition,…
LinuxLevel 2★★☆☆☆Linux-Log Rotation. Searching Compressed Historical Logs
Some older log files have been gzip-compressed by log rotation. Use a command that searches inside compressed files…
LinuxLevel 2★★☆☆☆Linux-Log Explorer. Digging the Flag Out of Multiple Logs
Multiple application and system log files are provided. The flag is embedded in a single DEBUG-level line — narrow it…
LinuxLevel 2★★☆☆☆Linux-Environment Secrets. Finding the Variable Named FLAG
Several environment variables, including some dummy credentials, are set on this system. List them with env and find…
Digital ForensicsLevel 2★★☆☆☆Hidden PDF Streams
The PDF file contains compressed object streams. An internal note that is not shown on the page is hidden inside them.…
Digital ForensicsLevel 2★★☆☆☆Find USB History in Windows Registry
Analyze the SYSTEM file (a text model of the USBSTOR part of the registry hive) to identify the USB device that was…
Digital ForensicsLevel 2★★☆☆☆Find Secret File in Disk Image
Inspect the ext4 filesystem disk image `disk.img`, find the secret backup hidden in the filesystem, and recover the…
Network SecurityLevel 2★★☆☆☆Network Analysis - DNS Zone Transfer Leak
An unauthenticated DNS zone transfer (AXFR) against a misconfigured authoritative server was captured. Download the…
Network SecurityLevel 2★★☆☆☆Network Analysis - ICMP Data Exfiltration
Data was exfiltrated from the internal host 10.20.0.15 to the external host 203.0.113.66 disguised as ping (ICMP echo…
Network SecurityLevel 2★★☆☆☆Network Analysis - SMB Share Enumeration Leak
An attacker enumerating SMB shares on the network was captured. Download the packet capture (traffic.pcap), follow the…
Network SecurityLevel 2★★☆☆☆Network Analysis - Telnet Credentials
A legacy server was administered over Telnet in clear text. Download the packet capture (traffic.pcap), follow the…
Network SecurityLevel 2★★☆☆☆Network Analysis - Anonymous FTP Transfer
An anonymous FTP session was captured in clear text. Download the packet capture (traffic.pcap), follow the FTP data…
Network SecurityLevel 2★★☆☆☆Network Analysis - Clear-text HTTP Credentials
Analyze traffic intercepted on public Wi-Fi where someone logged in over plain HTTP. Download the packet capture…
Network SecurityLevel 2★★☆☆☆Network Analysis - Plaintext SMTP Attachment
The internal host 10.30.0.25 sent an email to port 25 of the mail server 10.30.0.10 without encryption. Download…
Digital ForensicsLevel 2★★☆☆☆Find Password in Packet Capture
Clear-text HTTP traffic from a shop's internal network was captured. Among many requests, exactly one is the…
Digital ForensicsLevel 2★★☆☆☆Identify Intrusion Time from File Timestamps
Analyze the modification times of the files in evidence/ to identify when the intrusion occurred and which hidden…