Challenge list
General SkillsLevel 5★★★★★Custom Malware - Stealth Techniques
No executable malware, injection, or evasion capability is included. Analyze the inert configuration sample…
General SkillsLevel 5★★★★★Cloud Pentesting - AWS Multi-Stage Attack
Do not use AWS credentials, a metadata endpoint, or Lambda. Analyze the local artifacts/aws/cloudtrail-chain.jsonl…
General SkillsLevel 5★★★★★Container Escape - Kubernetes Privilege Escalation
Do not use a Kubernetes API, host mount, privileged container, or escape. Read the static…
General SkillsLevel 5★★★★★Supply Chain Attack - Dependency Exploitation
Audit the dependency records of the Node.js app `kinoco-webapp`: `/challenge/dependencies.txt` (the dependencies…
Digital ForensicsLevel 5★★★★★Extract VM Information from Hypervisor Memory
Analyze the KVM host memory dump `/home/ctfuser/evidence/kvm_host.dump`. The guests are configured like AMD SEV, so…
General SkillsLevel 5★★★★★Pivoting - Multi-Tier Network Penetration
Analyze the prerecorded artifacts/pivot/topology.json without creating routes, tunnels, proxies, or remote services.…
General SkillsLevel 5★★★★★Fuzzing Basics - 0-day Discovery
Analyze the prerecorded crash set without running a fuzzer or target binary. artifacts/fuzzing/triage.csv lists each…
Digital ForensicsLevel 5★★★★★Detect Process Hollowing Attack
From the memory of a Windows host, the process list `process_list.txt` (the PEB view), the VAD list `vad_regions.txt`…
Digital ForensicsLevel 5★★★★★Detect Tampered Timestamps
`/challenge/mft_timeline.csv` is a timeline exported from the NTFS `$MFT`. It has the `$STANDARD_INFORMATION` (SI) and…
Digital ForensicsLevel 5★★★★★Decrypt Encrypted iOS Backup
Verify the password of an encrypted iOS backup with a safe iTunes metadata fixture. No real iPhone or backup is used.…
Digital ForensicsLevel 5★★★★★Create Memory Profile for Unknown Linux Kernel
Analyze `/home/ctfuser/evidence/custom_kernel.dump`, part of the physical memory of a server running an in-house…
Digital ForensicsLevel 5★★★★★Decode Custom Protocol C&C Communication
The egress proxy recorded the traffic of the compromised endpoint 10.20.4.88. In `/challenge/beacon.log`, each line is…