Challenge list
Digital ForensicsLevel 5★★★★★Extract Message Hidden in Bitcoin Transaction
The victim paid the ransom to the Bitcoin address `bc1qr4nsmw4r3pay7hzfx0d9cq3vkt8e6m5ljgs2ua`.…
Digital ForensicsLevel 5★★★★★Extract Secret Key from IoT Device Firmware
Analyze the update file `/home/ctfuser/evidence/firmware.bin` of the network camera KNC-CAM-2000 (do not connect to a…
LinuxLevel 5★★★★★Linux-eBPF Rootkit. Unmasking a Hidden Process
This challenge safely recreates eBPF-rootkit investigation as offline evidence analysis. Without loading eBPF, tell…
LinuxLevel 5★★★★★Linux-Kernel Exploit. Rewriting a Read-Only File with Dirty COW
This challenge models mmap, MAP_PRIVATE, and madvise—the ingredients used by Dirty COW (CVE-2016-5195)—as a safe,…
Digital ForensicsLevel 5★★★★★Extract VM Information from Hypervisor Memory
Analyze the KVM host memory dump `/home/ctfuser/evidence/kvm_host.dump`. The guests are configured like AMD SEV, so…
Digital ForensicsLevel 5★★★★★Detect Process Hollowing Attack
From the memory of a Windows host, the process list `process_list.txt` (the PEB view), the VAD list `vad_regions.txt`…
Digital ForensicsLevel 5★★★★★Detect Tampered Timestamps
`/challenge/mft_timeline.csv` is a timeline exported from the NTFS `$MFT`. It has the `$STANDARD_INFORMATION` (SI) and…
Digital ForensicsLevel 5★★★★★Decrypt Encrypted iOS Backup
Verify the password of an encrypted iOS backup with a safe iTunes metadata fixture. No real iPhone or backup is used.…
Digital ForensicsLevel 5★★★★★Create Memory Profile for Unknown Linux Kernel
Analyze `/home/ctfuser/evidence/custom_kernel.dump`, part of the physical memory of a server running an in-house…
Digital ForensicsLevel 5★★★★★Decode Custom Protocol C&C Communication
The egress proxy recorded the traffic of the compromised endpoint 10.20.4.88. In `/challenge/beacon.log`, each line is…