Challenge list
Web SecurityLevel 1★☆☆☆☆Web-05. Directory Listing Trap
When an Nginx server has directory index listing (autoindex) enabled, anyone can browse the full file listing of a…
Web SecurityLevel 1★☆☆☆☆Web-06. Forging HTTP Headers
This application grants access based on the value of a specific HTTP header. Even values the browser never sends by…
Web SecurityLevel 1★☆☆☆☆Web-07. Tampering with URL Parameters
This web application checks the value of the GET parameter key on the server side. The required parameter name and…
Web SecurityLevel 1★☆☆☆☆Web-08. Tampering with POST Data
The login form contains a hidden input field that is invisible in the rendered page. Inspect it with developer tools…
Web SecurityLevel 1★☆☆☆☆Web-09. The Weak Basic Auth Trap
A protected area is guarded by HTTP Basic Authentication, but the developer accidentally left the credentials in an…
Web SecurityLevel 1★☆☆☆☆Web-10. Peeking Behind a Redirect
Accessing a certain page immediately redirects you elsewhere. Browsers automatically follow redirects, so think about…
Web SecurityLevel 1★☆☆☆☆XSS Basics - Guestbook
This web application has a basic XSS vulnerability. Find where input is reflected in the guestbook. The flag is at an…
ProgrammingLevel 2★★☆☆☆API Requests - Find the Highest-Profit Trade
When the container starts, a stock API begins running on http://localhost:9102 (you do not need to start server.py).…
Digital ForensicsLevel 2★★☆☆☆Find Attack in Apache Logs
Analyze the Apache access.log (common format) to find traces of SQL injection. Tell which attacks succeeded and which…
Digital ForensicsLevel 2★★☆☆☆Flag Hidden in Excel Macro
Analyze the macro code embedded in the Excel workbook and find the hidden authentication code (the flag). Learn how to…
LinuxLevel 2★★☆☆☆Linux-02. Privilege Escalation via a Sudo-Allowed Vim
Check which commands a regular user can run via sudo without a password. A well-known GTFOBins technique can let you…
LinuxLevel 2★★☆☆☆Linux-03. Reading Cron Configuration Files
This system has several cron configurations (/etc/cron.d, /etc/crontab, user crontabs, and more). Inspect each…
LinuxLevel 2★★☆☆☆Linux-Cron Privesc. Hijacking a Writable Root Script
Check the permissions of a cron script that root executes periodically. If a regular user can write to it, think about…
LinuxLevel 2★★☆☆☆Linux-Systemd. Checking a Service Unit's Environment Variable
A systemd unit file can set environment variables in its [Service] section. Inspect the registered service definition…
LinuxLevel 2★★☆☆☆Linux-Symlink Maze. Navigating a Branching Path
Several directories are connected in a tangled web of symbolic links. Without being misled by decoy hint files, follow…
LinuxLevel 2★★☆☆☆Linux-Script Debug. Fixing a Broken Bash Script
This script has several intentional bugs (typos, syntax mistakes) and fails to run to completion. Use bash's debugging…
LinuxLevel 2★★☆☆☆Linux-Network Basics. Connecting to a Listening Port
A background service on this system is listening on a specific port. Identify the port with ss/netstat and connect to…
LinuxLevel 2★★☆☆☆Linux-Backup Finder. Spotting the Real Temp File
The project directory contains several decoy backup/temp files ending in .bak, .tmp, or ~. The real flag is hidden…
LinuxLevel 2★★☆☆☆Linux-Pipeline. Narrowing Down Logs with grep and awk
The access log contains many entries. One IP address generated a burst of 404s, and stitching together the paths of…
LinuxLevel 2★★☆☆☆Linux-Package Info. Inspecting Installed Package Details
A custom-built deb package is installed on this system. Use dpkg or apt to inspect the package's details and find…
LinuxLevel 2★★☆☆☆Linux-Process Hunting. Tracking Down a Running Process
Among several background processes, one has the flag embedded in its command-line arguments. List them with ps and…
LinuxLevel 2★★☆☆☆Linux-User Investigation. Filtering the Target User with awk
Several users are registered on this system. Parse /etc/passwd with awk to find the one matching a specific condition,…
LinuxLevel 2★★☆☆☆Linux-Log Rotation. Searching Compressed Historical Logs
Some older log files have been gzip-compressed by log rotation. Use a command that searches inside compressed files…
LinuxLevel 2★★☆☆☆Linux-Log Explorer. Digging the Flag Out of Multiple Logs
Multiple application and system log files are provided. The flag is embedded in a single DEBUG-level line — narrow it…