Challenge list
Network Analysis - Unmasking WebSocket Frames
capture.pcap records WebSocket traffic between a browser and a chat server. Every client-to-server frame is masked…
Network Analysis - Custom Protocol Decoding
Traffic from a system using a small custom binary protocol was captured. Download the packet capture (traffic.pcap),…
Performance Analysis - Find the Resource Hog
Analyze the server snapshot `/challenge/metrics.log`. The first half is a top-style process table (%CPU is column 9,…
Find Suspicious Network Connections in Memory
From the memory image of the compromised host `kinoco-app03`, the socket table `/challenge/netstat_dump.txt` and the…
Recover Executed Commands from Memory
Analyze the memory-string record `memdump.txt` to recover the executed command history. Decode the Base64 strings and…
Recover Deleted SQLite Records
You are given the SQLite database `/challenge/app.db` of the internal chat tool "kinoco-msg". The body of a message…
Decompress Multi-Layer Archive
`/challenge/artifact.xz` is a file an attacker tried to take out, wrapped many times in gzip, bzip2, xz, zip and tar.…
Decrypt Encrypted Disk
`/challenge/secret_disk.img` is a genuine LUKS2 container. Its data area holds a backup (a tar archive). The…
Regex Expert - Data Validation
/challenge/data.txt holds 400 contact records. Each line contains an email address, a phone number, an IP address and…
Data Hidden in Audio File
`hidden.wav` hides a message encoded with on-off keying (OOK). Turn the tone on/off slots into bits and decode them to…
Advanced Automation - Directory Monitor
`/challenge/logs/` holds access logs from four web front ends (combined log format, 60 files, over 100k lines). The…