Challenge list
CryptographyLevel 2★★☆☆☆AES-ECB Mode Weakness
ECB leaks repeated block patterns. This introductory task first checks the difference between encryption and encoding.…
Digital ForensicsLevel 2★★☆☆☆Find Attack in Apache Logs
Analyze the Apache access.log (common format) to find traces of SQL injection. Tell which attacks succeeded and which…
Digital ForensicsLevel 2★★☆☆☆Flag Hidden in Excel Macro
Analyze the macro code embedded in the Excel workbook and find the hidden authentication code (the flag). Learn how to…
Digital ForensicsLevel 2★★☆☆☆Hidden PDF Streams
The PDF file contains compressed object streams. An internal note that is not shown on the page is hidden inside them.…
CryptographyLevel 2★★☆☆☆RC4 Stream Cipher Weakness
RC4 was once widely used but is now deprecated. This introductory task focuses on recognizing the provided data…
CryptographyLevel 2★★☆☆☆Vigenere Cipher Decryption
Decrypt a Vigenere cipher when the key length is known and retrieve the flag. Ciphertext:…
Web SecurityLevel 2★★☆☆☆Web-11. SQL Injection into the Employee Portal
KinoGadget's internal "Employee Access Portal" runs on a legacy authentication system. The lead developer is rumored…
Web SecurityLevel 2★★☆☆☆Web-12. Reflected XSS in BlogSearch
BlogSearch is a simple search engine for blog articles. The search query is embedded into the results page as-is…
Web SecurityLevel 2★★☆☆☆Web-13. Bypassing File Upload Checks in ImageVault
ImageVault is an image hosting service that accepts JPG, PNG, and GIF uploads. If its validation only checks the end…
Web SecurityLevel 2★★☆☆☆Web-14. Command Injection in a Network Diagnostic Tool
This app is a diagnostic tool that runs ping against a host you supply. If the host input is passed straight into a…
Web SecurityLevel 2★★☆☆☆Web-15. IDOR in the UserProfile Service
The UserProfile Service exposes an API that returns profile information for a given user ID. Check whether the service…
Web SecurityLevel 2★★☆☆☆Web-16. Weak JWT Secret in the CHIMERA Research Lab
Clues found after breaching the employee portal point to an isolated research lab system codenamed CHIMERA. It…
Web SecurityLevel 2★★☆☆☆Web-17. Path Traversal in FileShare
FileShare lets users list and download files from a shared folder. Check whether the filename parameter passed to the…
Web SecurityLevel 2★★☆☆☆Web-18. XXE Attack via a Contact Form
This contact form serializes its input as XML and sends it to the server, which parses it and echoes the result.…
Web SecurityLevel 2★★☆☆☆Web-19. CSRF Transfer in a Banking App
This banking app lets a logged-in user transfer money. Check whether CSRF protections exist by seeing if a separate…
Web SecurityLevel 2★★☆☆☆Web-20. SSRF via the URL Fetcher
This URL Fetcher service retrieves and displays the content of any URL a user provides. Check whether it can be…
Digital ForensicsLevel 2★★☆☆☆Find USB History in Windows Registry
Analyze the SYSTEM file (a text model of the USBSTOR part of the registry hive) to identify the USB device that was…
Digital ForensicsLevel 2★★☆☆☆Find Secret File in Disk Image
Inspect the ext4 filesystem disk image `disk.img`, find the secret backup hidden in the filesystem, and recover the…
CryptographyLevel 2★★☆☆☆Finding Hash Collisions
MD5 collisions are practical. Hashes with broken collision resistance must not be used for security-sensitive…
CryptographyLevel 2★★☆☆☆Hash Length Extension Attack
Simple signatures such as hash(secret || message) can be vulnerable to length extension attacks with Merkle-Damgard…
Digital ForensicsLevel 2★★☆☆☆Find Password in Packet Capture
Clear-text HTTP traffic from a shop's internal network was captured. Among many requests, exactly one is the…
CryptographyLevel 2★★☆☆☆Padding Oracle Basics
Padding oracle attacks use error differences as a plaintext recovery signal. This introductory task decodes leaked…
Digital ForensicsLevel 2★★☆☆☆Identify Intrusion Time from File Timestamps
Analyze the modification times of the files in evidence/ to identify when the intrusion occurred and which hidden…
Digital ForensicsLevel 2★★☆☆☆Find Process in Memory Dump
memory.dump is a simplified text of memory-analysis output (pslist / psscan / cmdline). Find the suspicious process…