Challenge list
General SkillsLevel 1★☆☆☆☆01. First Steps - Binary and Hexadecimal
In the security world, binary and hexadecimal are commonly used. In this challenge, convert hexadecimal to ASCII…
Web SecurityLevel 1★☆☆☆☆05. HTML Source Code Secret
Web pages contain a lot of information that isn't visible on the surface. Looking at HTML source code, you can often…
Web SecurityLevel 1★☆☆☆☆06. JavaScript Password Check
This page has a password-protected area. However, because the password check is done in JavaScript, you can find the…
Web SecurityLevel 1★☆☆☆☆07. Peek at Cookies
Websites use a mechanism called cookies to store information in your browser. They're used for managing login states,…
General SkillsLevel 1★☆☆☆☆10. Security Basics - Ethics and Rules
To become a white hat hacker, knowledge of ethics and laws is just as important as technical skills. In this…
Digital ForensicsLevel 1★☆☆☆☆12. Identify File Signatures
Files contain identification information called "magic bytes" at the beginning. Even if the extension is disguised,…
Digital ForensicsLevel 1★☆☆☆☆13. Hidden Metadata in Images
Photos and images contain metadata called EXIF. This metadata records shooting date, camera info, GPS coordinates,…
Digital ForensicsLevel 1★☆☆☆☆15. Extract Strings from Binary
Binary files (executables, etc.) contain human-readable strings. Passwords, URLs, error messages, and other hints can…
Web SecurityLevel 1★☆☆☆☆SQL Injection 101
This login form has an SQL Injection vulnerability. Log in as admin without proper credentials and retrieve the flag.
Web SecurityLevel 1★☆☆☆☆Web-04. The robots.txt Trap
Websites often serve a robots.txt file for crawlers. In this challenge, check whether a file that robots.txt tells…
Web SecurityLevel 1★☆☆☆☆Web-05. Directory Listing Trap
When an Nginx server has directory index listing (autoindex) enabled, anyone can browse the full file listing of a…
Web SecurityLevel 1★☆☆☆☆Web-06. Forging HTTP Headers
This application grants access based on the value of a specific HTTP header. Even values the browser never sends by…
Web SecurityLevel 1★☆☆☆☆Web-07. Tampering with URL Parameters
This web application checks the value of the GET parameter key on the server side. The required parameter name and…
Web SecurityLevel 1★☆☆☆☆Web-08. Tampering with POST Data
The login form contains a hidden input field that is invisible in the rendered page. Inspect it with developer tools…
Web SecurityLevel 1★☆☆☆☆Web-09. The Weak Basic Auth Trap
A protected area is guarded by HTTP Basic Authentication, but the developer accidentally left the credentials in an…
Web SecurityLevel 1★☆☆☆☆Web-10. Peeking Behind a Redirect
Accessing a certain page immediately redirects you elsewhere. Browsers automatically follow redirects, so think about…
Web SecurityLevel 1★☆☆☆☆XSS Basics - Guestbook
This web application has a basic XSS vulnerability. Find where input is reflected in the guestbook. The flag is at an…