Challenge list
Digital ForensicsLevel 3★★★☆☆Extract Session Cookies from Chrome
You are given `/challenge/Cookies` and `/challenge/History` (both SQLite) taken from a Linux Chrome profile. The…
Digital ForensicsLevel 3★★★☆☆Detect DNS Tunneling
Analyze the DNS query log `dns_queries.log` to detect data exfiltration via DNS tunneling. Find the host flooding a…
LinuxLevel 3★★★☆☆Linux-Capabilities. Privilege Escalation Beyond SUID
A specific binary on this system has Linux capabilities assigned to it. Investigate a privilege escalation technique…
LinuxLevel 3★★★☆☆Linux-SUID Exploit. Escalating Privileges via the find Binary
A copy of the find command with the SUID bit set exists on this system. Use a well-known GTFOBins technique to obtain…
LinuxLevel 3★★★☆☆Linux-Proc Memory. Peeking at a Process's Environment
A daemon process runs continuously in the background, with the flag set as one of its environment variables.…
LinuxLevel 3★★★☆☆Linux-Strace. Tracing System Calls to Expose a File
A binary that leaves nothing in standard output or on disk is provided. It reads a key from a hidden file,…
LinuxLevel 3★★★☆☆Linux-Race Condition. Exploiting a TOCTOU Gap for Root Files
A cleanup script that root runs periodically has a gap (TOCTOU) between checking and acting on a file. Try exploiting…
Digital ForensicsLevel 3★★★☆☆Find Deleted File Traces in NTFS $MFT
You are given `/challenge/mft_records.txt`, the `$MFT` of the Windows machine `KINOCO-WS07` written out as per-record…
ProgrammingLevel 3★★★☆☆Python Automation - SQLite Database Analysis
Examine data.db (SQLite: users / orders / audit_log), created at every start. Aggregate orders per user_id with…
ProgrammingLevel 3★★★☆☆Python Automation - Custom Cipher Decryption
cipher.txt holds the flag encrypted with a custom cipher (hex). Encryption applies per byte: add (key), xor…
ProgrammingLevel 3★★★☆☆Python Automation - Encrypted ZIP Password Cracking
A new /challenge/secret.zip is created at every start. It contains flag.txt and readme.txt, encrypted with ZipCrypto.…
Web SecurityLevel 3★★★☆☆Web-21. Blind Injection in Secure User Search
This user search app only reports whether a username exists, without showing direct query results. Investigate whether…
Web SecurityLevel 3★★★☆☆Web-22. CSP Bypass on the Secure Comment Board
This comment board is protected by a Content Security Policy restricting script execution to the site itself and a…
Web SecurityLevel 3★★★☆☆Web-23. Type Juggling in the Secure Authentication System
This login portal supports form login, a JSON API login, and a verification-code check. The admin account's real…
Web SecurityLevel 3★★★☆☆Web-24. Exploiting a Race Condition in Secure Bank
Secure Bank lets users spend a coin balance on shop prizes. If the balance check and the deduction happen as two…
Web SecurityLevel 3★★★☆☆Web-25. SSTI in the Greeting Card Generator
This greeting card generator is built with Flask/Jinja2 and renders the user's message directly through the template…
ProgrammingLevel 3★★★☆☆Algorithms - BFS Shortest Path Through a Maze
Use BFS to find the shortest path from S to E in data.txt, then submit the UDLR move sequence to challenge.py. A…
Digital ForensicsLevel 3★★★☆☆Detect Brute-Force Attack in Event Logs
Analyze the sshd authentication log `/challenge/auth.log` of the server `kinoco-srv01` and identify the session of the…
ProgrammingLevel 3★★★☆☆Programming - SQLite Evidence Database
evidence.db is a SQLite database built from random data at every start (in /challenge, with the tables users /…
ProgrammingLevel 3★★★☆☆Programming - Web Scraping Graph Traversal
site.json is a crawl result built from random data at every start (in /challenge). It holds the start and target URLs…
ProgrammingLevel 3★★★☆☆Programming - ZIP Password Recovery
secret.zip is a ZIP encrypted with ZipCrypto (the traditional PKWARE cipher), created at every start (in /challenge,…
ProgrammingLevel 3★★★☆☆Programming - Packet Log Analysis
capture.txt is a packet log created at every start (in /challenge). Each line is one flow of the form flow=<name>…
ProgrammingLevel 3★★★☆☆Programming - Multithreaded Result Reassembly
Analyze the parallel-job result log worker-results.jsonl, which is generated randomly at every start. Each slot was…
ProgrammingLevel 3★★★☆☆Programming - Memory Dump Analysis
Analyze the synthetic memory image memory.img, which is generated randomly at every start. In the heap table at the…