Challenge list
Web SecurityLevel 4★★★★☆Web-26. Prototype Pollution in User Profile Manager
In this Node.js/Express app, a logged-in user can update their own profile. Check whether the recursive merge function…
Web SecurityLevel 4★★★★☆Web-27. GraphQL Introspection Leak
This GraphQL API exposes a schema of User objects with introspection enabled. Investigate whether undocumented queries…
Web SecurityLevel 4★★★★☆Web-28. Hijacking an OAuth Authorization Code
This OAuth 2.0 authorization provider offers a login flow, but its redirect_uri validation may be weak. Investigate…
Web SecurityLevel 4★★★★☆Web-29. NoSQL Injection in a MongoDB Login Form
This login portal is backed by MongoDB and builds its query directly from raw JSON username/password input.…
Web SecurityLevel 4★★★★☆Web-30. Insecure Deserialization in KinoVault
A legacy backup system codenamed KinoVault reportedly serializes user session objects with Python's pickle module and…
Network SecurityLevel 4★★★★☆Network Analysis - Rebuilding Chunked gzip HTTP from TCP
capture.pcap records two HTTP exchanges over one TCP connection. The server's segments are reordered and some are…
Network SecurityLevel 4★★★★☆Network Analysis - TCP Retransmission Covert Channel
capture.pcap contains TCP retransmissions with duplicate sequence numbers. Extract retransmissions whose payload…
Digital ForensicsLevel 4★★★★☆Extract Malware Payload from Memory
`/challenge/memstrings.txt` holds the strings extracted from the address space of a suspicious process, and the…
Digital ForensicsLevel 4★★★★☆Detect Hidden Kernel Module in Memory
From the memory of a Linux host suspected of an LKM rootkit infection, three sets of module information were…
Digital ForensicsLevel 4★★★★☆Decode Multi-Stage Steganography
Three stages of steganography are planted in `/challenge/cover.png` and `/challenge/notes.txt`. Each stage holds the…
Digital ForensicsLevel 4★★★★☆Recover Fragmented JPEG File
`/challenge/fragments/` holds 256-byte clusters (`clus_NNNN.bin`) recovered from the unallocated space of a memory…
CryptographyLevel 4★★★★☆Cryptanalysis - DSA Nonce Reuse Key Recovery
/challenge/signatures.json, created with fresh keys at every start, holds the DSA public parameters (p of 1024 bits, q…
CryptographyLevel 4★★★★☆Cryptanalysis - Wiener's Attack on RSA
An embedded-device team made the RSA private exponent d very small to speed up decryption. The public exponent e in…
CryptographyLevel 4★★★★☆Cryptanalysis - Recovering an LCG's Hidden Parameters
A service generated both session tokens and an encryption keystream from a linear congruential generator x_{k+1} =…
Digital ForensicsLevel 4★★★★☆Recover Damaged RAID5 Array
The RAID5 array `/dev/md0` (4 members) on the file server fs01 no longer assembles after the member sdd failed.…
Digital ForensicsLevel 4★★★★☆Reconstruct Attack Scenario from Multiple Logs
`/challenge/web.log`, `/challenge/auth.log` and `/challenge/db.log` record the same intrusion among a lot of…
Digital ForensicsLevel 5★★★★★Reconstruct Full APT Attack Stages
Four logs, `/challenge/edr_process.log`, `proxy_http.log`, `dns_queries.log` and `dlp_transfer.log`, hold an APT…
Digital ForensicsLevel 5★★★★★Crack BitLocker Encrypted Drive
Learn BitLocker recovery-key verification with a safe metadata fixture. bitlocker.img is not a real volume. Identify…
Digital ForensicsLevel 5★★★★★Extract Message Hidden in Bitcoin Transaction
The victim paid the ransom to the Bitcoin address `bc1qr4nsmw4r3pay7hzfx0d9cq3vkt8e6m5ljgs2ua`.…
Digital ForensicsLevel 5★★★★★Extract Secret Key from IoT Device Firmware
Analyze the update file `/home/ctfuser/evidence/firmware.bin` of the network camera KNC-CAM-2000 (do not connect to a…
LinuxLevel 5★★★★★Linux-eBPF Rootkit. Unmasking a Hidden Process
This challenge safely recreates eBPF-rootkit investigation as offline evidence analysis. Without loading eBPF, tell…
LinuxLevel 5★★★★★Linux-Kernel Exploit. Rewriting a Read-Only File with Dirty COW
This challenge models mmap, MAP_PRIVATE, and madvise—the ingredients used by Dirty COW (CVE-2016-5195)—as a safe,…
Network SecurityLevel 5★★★★★Network Analysis - IPv4 Overlapping Fragment Reassembly
The UDP datagram with IPv4 ID 0xbeef in fragments.pcap contains overlapping fragments that overwrite earlier bytes.…
Digital ForensicsLevel 5★★★★★Extract VM Information from Hypervisor Memory
Analyze the KVM host memory dump `/home/ctfuser/evidence/kvm_host.dump`. The guests are configured like AMD SEV, so…