Challenge list

Python Practice - Bulk Base64 Stream Decoding

Every line of data.txt (about 150 lines, created at every start) is Base64. Decode line by line; when the result…

Python Practice - Conditional CSV Sales Filtering

data.txt, created at every start, is a sales CSV (transaction_id,date,product_id,amount,status,ref,notes). Several…

Python Practice - Compound JSON User Query

Examine the JSON data.txt ({"users": [...]}) created at every start. Each user has id, name, email, role, active and…

Python Practice - Target-IP Access Log Tracing

data.txt (about 1,300 lines, created at every start) is a web server access log. Extract only the requests from…

Python Automation - Bulk Base64 Decoding

Every line of data.txt (about 150 lines, created at every start) is Base64. Decode line by line; when the result…

Python Automation - CSV Sales Filtering

data.txt, created at every start, is a sales CSV (transaction_id,date,product_id,amount,status,ref,notes). Several…

45 ptsOpen challenge

Python Automation - JSON User Query

Examine the JSON data.txt ({"users": [...]}) created at every start. Each user has id, name, email, role, active and…

45 ptsOpen challenge

Python Automation - Access Log Parsing

data.txt (about 1,300 lines, created at every start) is a web server access log. Extract only the requests from…

Python Automation - Password Hash Cracking

Examine data.txt (a list of SHA-256 digests) and wordlist.txt (800 four-character lowercase alphanumeric tokens), both…

CryptographyLevel 2★★☆☆☆

RC4 Stream Cipher Weakness

RC4 was once widely used but is now deprecated. This introductory task focuses on recognizing the provided data…

75 ptsOpen challenge

CryptographyLevel 2★★☆☆☆

Vigenere Cipher Decryption

Decrypt a Vigenere cipher when the key length is known and retrieve the flag. Ciphertext:…

Web-11. SQL Injection into the Employee Portal

KinoGadget's internal "Employee Access Portal" runs on a legacy authentication system. The lead developer is rumored…

Web-12. Reflected XSS in BlogSearch

BlogSearch is a simple search engine for blog articles. The search query is embedded into the results page as-is…

Web-13. Bypassing File Upload Checks in ImageVault

ImageVault is an image hosting service that accepts JPG, PNG, and GIF uploads. If its validation only checks the end…

Web-14. Command Injection in a Network Diagnostic Tool

This app is a diagnostic tool that runs ping against a host you supply. If the host input is passed straight into a…

Web-15. IDOR in the UserProfile Service

The UserProfile Service exposes an API that returns profile information for a given user ID. Check whether the service…

Web-16. Weak JWT Secret in the CHIMERA Research Lab

Clues found after breaching the employee portal point to an isolated research lab system codenamed CHIMERA. It…

60 ptsOpen challenge

Web-17. Path Traversal in FileShare

FileShare lets users list and download files from a shared folder. Check whether the filename parameter passed to the…

Web-18. XXE Attack via a Contact Form

This contact form serializes its input as XML and sends it to the server, which parses it and echoes the result.…

Web-19. CSRF Transfer in a Banking App

This banking app lets a logged-in user transfer money. Check whether CSRF protections exist by seeing if a separate…

Web-20. SSRF via the URL Fetcher

This URL Fetcher service retrieves and displays the content of any URL a user provides. Check whether it can be…