Challenge list
General SkillsLevel 5★★★★★APT Simulation - Full Breach Scenario
This is not an attack exercise but a blue-team task of reading the logs of an incident that already happened. From the…
General SkillsLevel 5★★★★★Bug Bounty Practice - Vulnerability Discovery Master
Analyze the fixed artifacts/bug-bounty/triage-report.json instead of testing a live application. A chained report has…
General SkillsLevel 5★★★★★Red Teaming - Custom C2 Framework
No C2 server, agent, socket communication, or command execution is started. Analyze the local…
General SkillsLevel 5★★★★★Anti-Forensics - Evidence Elimination
After the intrusion the attacker covered their tracks: they cut a time window out of `/challenge/auth_syslog.log` (the…
General SkillsLevel 5★★★★★Custom Malware - Stealth Techniques
No executable malware, injection, or evasion capability is included. Analyze the inert configuration sample…
General SkillsLevel 5★★★★★Cloud Pentesting - AWS Multi-Stage Attack
Do not use AWS credentials, a metadata endpoint, or Lambda. Analyze the local artifacts/aws/cloudtrail-chain.jsonl…
General SkillsLevel 5★★★★★Container Escape - Kubernetes Privilege Escalation
Do not use a Kubernetes API, host mount, privileged container, or escape. Read the static…
General SkillsLevel 5★★★★★Supply Chain Attack - Dependency Exploitation
Audit the dependency records of the Node.js app `kinoco-webapp`: `/challenge/dependencies.txt` (the dependencies…
Network SecurityLevel 5★★★★★Network Analysis - IPv4 Overlapping Fragment Reassembly
The UDP datagram with IPv4 ID 0xbeef in fragments.pcap contains overlapping fragments that overwrite earlier bytes.…
General SkillsLevel 5★★★★★Pivoting - Multi-Tier Network Penetration
Analyze the prerecorded artifacts/pivot/topology.json without creating routes, tunnels, proxies, or remote services.…
General SkillsLevel 5★★★★★Fuzzing Basics - 0-day Discovery
Analyze the prerecorded crash set without running a fuzzer or target binary. artifacts/fuzzing/triage.csv lists each…
CryptographyLevel 5★★★★★Cryptanalysis - RSA e=3 Broadcast Attack
broadcast.json contains the same plaintext encrypted with unpadded RSA e=3 under three pairwise-coprime moduli.…