Challenge list
Digital ForensicsLevel 3★★★☆☆Decrypt Encrypted Disk
`/challenge/secret_disk.img` is a genuine LUKS2 container. Its data area holds a backup (a tar archive). The…
Digital ForensicsLevel 3★★★☆☆Data Hidden in Audio File
`hidden.wav` hides a message encoded with on-off keying (OOK). Turn the tone on/off slots into bits and decode them to…
Digital ForensicsLevel 4★★★★☆Extract Secret Key from Android App
Extract a safe ZIP-formatted APK fixture (evidence/app.apk) and analyze the encrypted API secret recorded in its…
Digital ForensicsLevel 4★★★★☆Detect Unauthorized Access in CloudTrail Logs
Analyze the CloudTrail export `/challenge/cloudtrail.json` and trace the unauthorized use of a stolen access key and…
Digital ForensicsLevel 4★★★★☆Extract Secrets from Docker Image Layers
`/challenge/image/` is an unpacked `docker save` export (OCI layout). The layers are stored in `blobs/sha256/` as…
LinuxLevel 4★★★★☆Linux-Kernel Module. Gaining Root via a Vulnerable Driver
This challenge analyzes a vulnerable character-device driver as a safe user-space simulation. No real kernel module is…
LinuxLevel 4★★★★☆Linux-Buffer Overflow. Exploiting a gets() Vulnerability
A vulnerable SUID C binary with protections disabled is provided. Exploit its buffer overflow to redirect control flow…
Digital ForensicsLevel 4★★★★☆Decrypt TLS-Encrypted HTTPS Traffic
In `~/evidence/` there is a capture `traffic.pcap` (libpcap format) of HTTPS traffic from a client PC, and the TLS key…
Web SecurityLevel 4★★★★☆Web-26. Prototype Pollution in User Profile Manager
In this Node.js/Express app, a logged-in user can update their own profile. Check whether the recursive merge function…
Web SecurityLevel 4★★★★☆Web-27. GraphQL Introspection Leak
This GraphQL API exposes a schema of User objects with introspection enabled. Investigate whether undocumented queries…
Web SecurityLevel 4★★★★☆Web-28. Hijacking an OAuth Authorization Code
This OAuth 2.0 authorization provider offers a login flow, but its redirect_uri validation may be weak. Investigate…
Web SecurityLevel 4★★★★☆Web-29. NoSQL Injection in a MongoDB Login Form
This login portal is backed by MongoDB and builds its query directly from raw JSON username/password input.…
Web SecurityLevel 4★★★★☆Web-30. Insecure Deserialization in KinoVault
A legacy backup system codenamed KinoVault reportedly serializes user session objects with Python's pickle module and…
Network SecurityLevel 4★★★★☆Network Analysis - Rebuilding Chunked gzip HTTP from TCP
capture.pcap records two HTTP exchanges over one TCP connection. The server's segments are reordered and some are…
Network SecurityLevel 4★★★★☆Network Analysis - TCP Retransmission Covert Channel
capture.pcap contains TCP retransmissions with duplicate sequence numbers. Extract retransmissions whose payload…
Digital ForensicsLevel 4★★★★☆Extract Malware Payload from Memory
`/challenge/memstrings.txt` holds the strings extracted from the address space of a suspicious process, and the…
Digital ForensicsLevel 4★★★★☆Detect Hidden Kernel Module in Memory
From the memory of a Linux host suspected of an LKM rootkit infection, three sets of module information were…
Digital ForensicsLevel 4★★★★☆Decode Multi-Stage Steganography
Three stages of steganography are planted in `/challenge/cover.png` and `/challenge/notes.txt`. Each stage holds the…
Digital ForensicsLevel 4★★★★☆Recover Fragmented JPEG File
`/challenge/fragments/` holds 256-byte clusters (`clus_NNNN.bin`) recovered from the unallocated space of a memory…
Digital ForensicsLevel 4★★★★☆Recover Damaged RAID5 Array
The RAID5 array `/dev/md0` (4 members) on the file server fs01 no longer assembles after the member sdd failed.…
Digital ForensicsLevel 4★★★★☆Reconstruct Attack Scenario from Multiple Logs
`/challenge/web.log`, `/challenge/auth.log` and `/challenge/db.log` record the same intrusion among a lot of…
Digital ForensicsLevel 5★★★★★Reconstruct Full APT Attack Stages
Four logs, `/challenge/edr_process.log`, `proxy_http.log`, `dns_queries.log` and `dlp_transfer.log`, hold an APT…
Digital ForensicsLevel 5★★★★★Crack BitLocker Encrypted Drive
Learn BitLocker recovery-key verification with a safe metadata fixture. bitlocker.img is not a real volume. Identify…
Digital ForensicsLevel 5★★★★★Extract Message Hidden in Bitcoin Transaction
The victim paid the ransom to the Bitcoin address `bc1qr4nsmw4r3pay7hzfx0d9cq3vkt8e6m5ljgs2ua`.…