Challenge list
General SkillsLevel 3★★★☆☆Docker Forensics - Container Investigation
With no Docker daemon available, investigate the metadata of the image `registry.internal/kinoco-billing-api:2.4.1`:…
General SkillsLevel 3★★★☆☆Find the Deleted API Key in Git History
/app/repo is a Git repository. A developer accidentally committed an API_KEY and removed it in a later commit. Inspect…
General SkillsLevel 3★★★☆☆Python Automation - REST API Data Collection
A paginated local API runs in the container at `http://127.0.0.1:8000/api/records?page=N`. Walk every page until…
General SkillsLevel 3★★★☆☆SQL Query Master - Complex Joins
The SQLite database `/challenge/company.db` has 3 tables: - employees (id, name, department_id, salary, email, note) -…
Web SecurityLevel 3★★★☆☆Web-21. Blind Injection in Secure User Search
This user search app only reports whether a username exists, without showing direct query results. Investigate whether…
Web SecurityLevel 3★★★☆☆Web-22. CSP Bypass on the Secure Comment Board
This comment board is protected by a Content Security Policy restricting script execution to the site itself and a…
Web SecurityLevel 3★★★☆☆Web-23. Type Juggling in the Secure Authentication System
This login portal supports form login, a JSON API login, and a verification-code check. The admin account's real…
Web SecurityLevel 3★★★☆☆Web-24. Exploiting a Race Condition in Secure Bank
Secure Bank lets users spend a coin balance on shop prizes. If the balance check and the deduction happen as two…
Web SecurityLevel 3★★★☆☆Web-25. SSTI in the Greeting Card Generator
This greeting card generator is built with Flask/Jinja2 and renders the user's message directly through the template…
General SkillsLevel 3★★★☆☆System Call Tracing - strace Debugging
Analyze `/challenge/strace.log`, a strace recording of the source-less program `/app/mystery_program`. The program…
General SkillsLevel 3★★★☆☆System Log Analysis - journalctl Master
Analyze `/challenge/system.log`, a systemd journal exported in `journalctl -o short` style. Each line reads "timestamp…
General SkillsLevel 3★★★☆☆Network Master - Netcat Reverse Shell
Analyze the prerecorded artifacts/netcat/callback-transcript.log without connecting to any external host; no listener…
General SkillsLevel 3★★★☆☆Performance Analysis - Find the Resource Hog
Analyze the server snapshot `/challenge/metrics.log`. The first half is a top-style process table (%CPU is column 9,…
General SkillsLevel 3★★★☆☆Regex Expert - Data Validation
/challenge/data.txt holds 400 contact records. Each line contains an email address, a phone number, an IP address and…
General SkillsLevel 3★★★☆☆Advanced Automation - Directory Monitor
`/challenge/logs/` holds access logs from four web front ends (combined log format, 60 files, over 100k lines). The…