Challenge list
Digital ForensicsLevel 2★★☆☆☆Identify Intrusion Time from File Timestamps
Analyze the modification times of the files in evidence/ to identify when the intrusion occurred and which hidden…
ProgrammingLevel 2★★☆☆☆Programming - Bash Job Log Analysis
/challenge/jobs.log is a nightly batch log that is regenerated with random data every time the container starts. Each…
ProgrammingLevel 2★★☆☆☆Programming - PIN Brute Force
/challenge/vault.json is a vault record that is regenerated with random data every time the container starts. It…
ProgrammingLevel 2★★☆☆☆Programming - Hash Verification and Decryption
Analyze the evidence file artifact-manifest.json, which is generated randomly at every start. Each artifact…
ProgrammingLevel 2★★☆☆☆Programming - Binary TLV Parsing
/challenge/capture.bin is a custom binary file that is regenerated with random data every time the container starts.…
Digital ForensicsLevel 2★★☆☆☆Find Process in Memory Dump
memory.dump is a simplified text of memory-analysis output (pslist / psscan / cmdline). Find the suspicious process…
Digital ForensicsLevel 2★★☆☆☆Recover Deleted Files
Recover the deleted compressed file (ZIP) from the disk image and find the flag in the memo inside it. Learn how to…
ProgrammingLevel 2★★☆☆☆Regular Expressions - The One-Time Golden Glyph
Extract every KINO-four-digits-four-uppercase glyph from data.txt, identify the one occurring once, and submit it to…
Digital ForensicsLevel 2★★☆☆☆Message Hidden in Image LSB
Extract the message hidden in the LSB (Least Significant Bit) of a PNG file. Learn the basics of steganography…
Digital ForensicsLevel 3★★★☆☆Extract Session Cookies from Chrome
You are given `/challenge/Cookies` and `/challenge/History` (both SQLite) taken from a Linux Chrome profile. The…
Digital ForensicsLevel 3★★★☆☆Detect DNS Tunneling
Analyze the DNS query log `dns_queries.log` to detect data exfiltration via DNS tunneling. Find the host flooding a…
LinuxLevel 3★★★☆☆Linux-Capabilities. Privilege Escalation Beyond SUID
A specific binary on this system has Linux capabilities assigned to it. Investigate a privilege escalation technique…
LinuxLevel 3★★★☆☆Linux-SUID Exploit. Escalating Privileges via the find Binary
A copy of the find command with the SUID bit set exists on this system. Use a well-known GTFOBins technique to obtain…
LinuxLevel 3★★★☆☆Linux-Proc Memory. Peeking at a Process's Environment
A daemon process runs continuously in the background, with the flag set as one of its environment variables.…
LinuxLevel 3★★★☆☆Linux-Strace. Tracing System Calls to Expose a File
A binary that leaves nothing in standard output or on disk is provided. It reads a key from a hidden file,…
LinuxLevel 3★★★☆☆Linux-Race Condition. Exploiting a TOCTOU Gap for Root Files
A cleanup script that root runs periodically has a gap (TOCTOU) between checking and acting on a file. Try exploiting…
Digital ForensicsLevel 3★★★☆☆Find Deleted File Traces in NTFS $MFT
You are given `/challenge/mft_records.txt`, the `$MFT` of the Windows machine `KINOCO-WS07` written out as per-record…
ProgrammingLevel 3★★★☆☆Python Automation - SQLite Database Analysis
Examine data.db (SQLite: users / orders / audit_log), created at every start. Aggregate orders per user_id with…
ProgrammingLevel 3★★★☆☆Python Automation - Custom Cipher Decryption
cipher.txt holds the flag encrypted with a custom cipher (hex). Encryption applies per byte: add (key), xor…
ProgrammingLevel 3★★★☆☆Python Automation - Encrypted ZIP Password Cracking
A new /challenge/secret.zip is created at every start. It contains flag.txt and readme.txt, encrypted with ZipCrypto.…
Web SecurityLevel 3★★★☆☆Web-21. Blind Injection in Secure User Search
This user search app only reports whether a username exists, without showing direct query results. Investigate whether…
Web SecurityLevel 3★★★☆☆Web-22. CSP Bypass on the Secure Comment Board
This comment board is protected by a Content Security Policy restricting script execution to the site itself and a…
Web SecurityLevel 3★★★☆☆Web-23. Type Juggling in the Secure Authentication System
This login portal supports form login, a JSON API login, and a verification-code check. The admin account's real…
Web SecurityLevel 3★★★☆☆Web-24. Exploiting a Race Condition in Secure Bank
Secure Bank lets users spend a coin balance on shop prizes. If the balance check and the deduction happen as two…