Challenge list
Digital ForensicsLevel 4★★★★☆Detect Unauthorized Access in CloudTrail Logs
Analyze the CloudTrail export `/challenge/cloudtrail.json` and trace the unauthorized use of a stolen access key and…
Digital ForensicsLevel 4★★★★☆Extract Secrets from Docker Image Layers
`/challenge/image/` is an unpacked `docker save` export (OCI layout). The layers are stored in `blobs/sha256/` as…
LinuxLevel 4★★★★☆Linux-Kernel Module. Gaining Root via a Vulnerable Driver
This challenge analyzes a vulnerable character-device driver as a safe user-space simulation. No real kernel module is…
LinuxLevel 4★★★★☆Linux-Buffer Overflow. Exploiting a gets() Vulnerability
A vulnerable SUID C binary with protections disabled is provided. Exploit its buffer overflow to redirect control flow…
Digital ForensicsLevel 4★★★★☆Decrypt TLS-Encrypted HTTPS Traffic
In `~/evidence/` there is a capture `traffic.pcap` (libpcap format) of HTTPS traffic from a client PC, and the TLS key…
Network SecurityLevel 4★★★★☆Network Analysis - Rebuilding Chunked gzip HTTP from TCP
capture.pcap records two HTTP exchanges over one TCP connection. The server's segments are reordered and some are…
Network SecurityLevel 4★★★★☆Network Analysis - TCP Retransmission Covert Channel
capture.pcap contains TCP retransmissions with duplicate sequence numbers. Extract retransmissions whose payload…
Digital ForensicsLevel 4★★★★☆Extract Malware Payload from Memory
`/challenge/memstrings.txt` holds the strings extracted from the address space of a suspicious process, and the…
Digital ForensicsLevel 4★★★★☆Detect Hidden Kernel Module in Memory
From the memory of a Linux host suspected of an LKM rootkit infection, three sets of module information were…
Digital ForensicsLevel 4★★★★☆Decode Multi-Stage Steganography
Three stages of steganography are planted in `/challenge/cover.png` and `/challenge/notes.txt`. Each stage holds the…
Digital ForensicsLevel 4★★★★☆Recover Fragmented JPEG File
`/challenge/fragments/` holds 256-byte clusters (`clus_NNNN.bin`) recovered from the unallocated space of a memory…
Digital ForensicsLevel 4★★★★☆Recover Damaged RAID5 Array
The RAID5 array `/dev/md0` (4 members) on the file server fs01 no longer assembles after the member sdd failed.…
Digital ForensicsLevel 4★★★★☆Reconstruct Attack Scenario from Multiple Logs
`/challenge/web.log`, `/challenge/auth.log` and `/challenge/db.log` record the same intrusion among a lot of…
Digital ForensicsLevel 5★★★★★Reconstruct Full APT Attack Stages
Four logs, `/challenge/edr_process.log`, `proxy_http.log`, `dns_queries.log` and `dlp_transfer.log`, hold an APT…
Digital ForensicsLevel 5★★★★★Crack BitLocker Encrypted Drive
Learn BitLocker recovery-key verification with a safe metadata fixture. bitlocker.img is not a real volume. Identify…
Digital ForensicsLevel 5★★★★★Extract Message Hidden in Bitcoin Transaction
The victim paid the ransom to the Bitcoin address `bc1qr4nsmw4r3pay7hzfx0d9cq3vkt8e6m5ljgs2ua`.…
Digital ForensicsLevel 5★★★★★Extract Secret Key from IoT Device Firmware
Analyze the update file `/home/ctfuser/evidence/firmware.bin` of the network camera KNC-CAM-2000 (do not connect to a…
LinuxLevel 5★★★★★Linux-eBPF Rootkit. Unmasking a Hidden Process
This challenge safely recreates eBPF-rootkit investigation as offline evidence analysis. Without loading eBPF, tell…
LinuxLevel 5★★★★★Linux-Kernel Exploit. Rewriting a Read-Only File with Dirty COW
This challenge models mmap, MAP_PRIVATE, and madvise—the ingredients used by Dirty COW (CVE-2016-5195)—as a safe,…
Network SecurityLevel 5★★★★★Network Analysis - IPv4 Overlapping Fragment Reassembly
The UDP datagram with IPv4 ID 0xbeef in fragments.pcap contains overlapping fragments that overwrite earlier bytes.…
Digital ForensicsLevel 5★★★★★Extract VM Information from Hypervisor Memory
Analyze the KVM host memory dump `/home/ctfuser/evidence/kvm_host.dump`. The guests are configured like AMD SEV, so…
Digital ForensicsLevel 5★★★★★Detect Process Hollowing Attack
From the memory of a Windows host, the process list `process_list.txt` (the PEB view), the VAD list `vad_regions.txt`…
Digital ForensicsLevel 5★★★★★Detect Tampered Timestamps
`/challenge/mft_timeline.csv` is a timeline exported from the NTFS `$MFT`. It has the `$STANDARD_INFORMATION` (SI) and…
Digital ForensicsLevel 5★★★★★Decrypt Encrypted iOS Backup
Verify the password of an encrypted iOS backup with a safe iTunes metadata fixture. No real iPhone or backup is used.…