Challenge list
Web SecurityLevel 1★☆☆☆☆Web-04. The robots.txt Trap
Websites often serve a robots.txt file for crawlers. In this challenge, check whether a file that robots.txt tells…
Web SecurityLevel 1★☆☆☆☆Web-05. Directory Listing Trap
When an Nginx server has directory index listing (autoindex) enabled, anyone can browse the full file listing of a…
Web SecurityLevel 1★☆☆☆☆Web-06. Forging HTTP Headers
This application grants access based on the value of a specific HTTP header. Even values the browser never sends by…
Web SecurityLevel 1★☆☆☆☆Web-07. Tampering with URL Parameters
This web application checks the value of the GET parameter key on the server side. The required parameter name and…
Web SecurityLevel 1★☆☆☆☆Web-08. Tampering with POST Data
The login form contains a hidden input field that is invisible in the rendered page. Inspect it with developer tools…
Web SecurityLevel 1★☆☆☆☆Web-09. The Weak Basic Auth Trap
A protected area is guarded by HTTP Basic Authentication, but the developer accidentally left the credentials in an…
Web SecurityLevel 1★☆☆☆☆Web-10. Peeking Behind a Redirect
Accessing a certain page immediately redirects you elsewhere. Browsers automatically follow redirects, so think about…
Web SecurityLevel 1★☆☆☆☆XSS Basics - Guestbook
This web application has a basic XSS vulnerability. Find where input is reflected in the guestbook. The flag is at an…
CryptographyLevel 2★★☆☆☆AES-ECB Mode Weakness
ECB leaks repeated block patterns. This introductory task first checks the difference between encryption and encoding.…
General SkillsLevel 2★★☆☆☆Bash Scripting - Power of Automation
/app/numbers.txt contains numbers from 1 to 1000, one per line. Extract all numbers that satisfy these conditions and…
General SkillsLevel 2★★☆☆☆Git Detective - Lost Commit
/app/repo is a Git repository. A developer accidentally deleted a commit containing important information. Use git…
General SkillsLevel 2★★☆☆☆JSON Master - Data Extraction
/app/users.json contains information of 100 users in JSON format. Extract users that meet these conditions: - age…
LinuxLevel 2★★☆☆☆Linux-02. Privilege Escalation via a Sudo-Allowed Vim
Check which commands a regular user can run via sudo without a password. A well-known GTFOBins technique can let you…
LinuxLevel 2★★☆☆☆Linux-03. Reading Cron Configuration Files
This system has several cron configurations (/etc/cron.d, /etc/crontab, user crontabs, and more). Inspect each…
LinuxLevel 2★★☆☆☆Linux-Cron Privesc. Hijacking a Writable Root Script
Check the permissions of a cron script that root executes periodically. If a regular user can write to it, think about…
LinuxLevel 2★★☆☆☆Linux-Systemd. Checking a Service Unit's Environment Variable
A systemd unit file can set environment variables in its [Service] section. Inspect the registered service definition…
LinuxLevel 2★★☆☆☆Linux-Symlink Maze. Navigating a Branching Path
Several directories are connected in a tangled web of symbolic links. Without being misled by decoy hint files, follow…
LinuxLevel 2★★☆☆☆Linux-Script Debug. Fixing a Broken Bash Script
This script has several intentional bugs (typos, syntax mistakes) and fails to run to completion. Use bash's debugging…
LinuxLevel 2★★☆☆☆Linux-Network Basics. Connecting to a Listening Port
A background service on this system is listening on a specific port. Identify the port with ss/netstat and connect to…
LinuxLevel 2★★☆☆☆Linux-Backup Finder. Spotting the Real Temp File
The project directory contains several decoy backup/temp files ending in .bak, .tmp, or ~. The real flag is hidden…
LinuxLevel 2★★☆☆☆Linux-Pipeline. Narrowing Down Logs with grep and awk
The access log contains many entries. One IP address generated a burst of 404s, and stitching together the paths of…
LinuxLevel 2★★☆☆☆Linux-Package Info. Inspecting Installed Package Details
A custom-built deb package is installed on this system. Use dpkg or apt to inspect the package's details and find…
LinuxLevel 2★★☆☆☆Linux-Process Hunting. Tracking Down a Running Process
Among several background processes, one has the flag embedded in its command-line arguments. List them with ps and…
LinuxLevel 2★★☆☆☆Linux-User Investigation. Filtering the Target User with awk
Several users are registered on this system. Parse /etc/passwd with awk to find the one matching a specific condition,…