Challenge list
LinuxLevel 3★★★☆☆Linux-Capabilities. Privilege Escalation Beyond SUID
A specific binary on this system has Linux capabilities assigned to it. Investigate a privilege escalation technique…
LinuxLevel 3★★★☆☆Linux-SUID Exploit. Escalating Privileges via the find Binary
A copy of the find command with the SUID bit set exists on this system. Use a well-known GTFOBins technique to obtain…
LinuxLevel 3★★★☆☆Linux-Proc Memory. Peeking at a Process's Environment
A daemon process runs continuously in the background, with the flag set as one of its environment variables.…
LinuxLevel 3★★★☆☆Linux-Strace. Tracing System Calls to Expose a File
A binary that leaves nothing in standard output or on disk is provided. It reads a key from a hidden file,…
LinuxLevel 3★★★☆☆Linux-Race Condition. Exploiting a TOCTOU Gap for Root Files
A cleanup script that root runs periodically has a gap (TOCTOU) between checking and acting on a file. Try exploiting…
ProgrammingLevel 3★★★☆☆Python Automation - SQLite Database Analysis
Examine data.db (SQLite: users / orders / audit_log), created at every start. Aggregate orders per user_id with…
ProgrammingLevel 3★★★☆☆Python Automation - Custom Cipher Decryption
cipher.txt holds the flag encrypted with a custom cipher (hex). Encryption applies per byte: add (key), xor…
ProgrammingLevel 3★★★☆☆Python Automation - Encrypted ZIP Password Cracking
A new /challenge/secret.zip is created at every start. It contains flag.txt and readme.txt, encrypted with ZipCrypto.…
Web SecurityLevel 3★★★☆☆Web-21. Blind Injection in Secure User Search
This user search app only reports whether a username exists, without showing direct query results. Investigate whether…
Web SecurityLevel 3★★★☆☆Web-22. CSP Bypass on the Secure Comment Board
This comment board is protected by a Content Security Policy restricting script execution to the site itself and a…
Web SecurityLevel 3★★★☆☆Web-23. Type Juggling in the Secure Authentication System
This login portal supports form login, a JSON API login, and a verification-code check. The admin account's real…
Web SecurityLevel 3★★★☆☆Web-24. Exploiting a Race Condition in Secure Bank
Secure Bank lets users spend a coin balance on shop prizes. If the balance check and the deduction happen as two…
Web SecurityLevel 3★★★☆☆Web-25. SSTI in the Greeting Card Generator
This greeting card generator is built with Flask/Jinja2 and renders the user's message directly through the template…
ProgrammingLevel 3★★★☆☆Algorithms - BFS Shortest Path Through a Maze
Use BFS to find the shortest path from S to E in data.txt, then submit the UDLR move sequence to challenge.py. A…
Network SecurityLevel 3★★★☆☆Network Analysis - 802.1Q VLAN Separated Traffic
capture.pcap was captured from a mirrored switch trunk port, so frames from several VLANs are mixed together with…
Network SecurityLevel 3★★★☆☆Network Analysis - SNMP Information Leak
A device speaking SNMPv2c with a weak community string (public) was captured returning a GetResponse. Download the…
Network SecurityLevel 3★★★☆☆Network Analysis - SSL Strip Clear-text Credentials
An SSL Strip attack downgraded HTTPS to HTTP, so the victim's credentials traveled in clear text and were captured.…
Network SecurityLevel 3★★★☆☆Network Analysis - Unmasking WebSocket Frames
capture.pcap records WebSocket traffic between a browser and a chat server. Every client-to-server frame is masked…
Network SecurityLevel 3★★★☆☆Network Analysis - Custom Protocol Decoding
Traffic from a system using a small custom binary protocol was captured. Download the packet capture (traffic.pcap),…
ProgrammingLevel 3★★★☆☆Programming - SQLite Evidence Database
evidence.db is a SQLite database built from random data at every start (in /challenge, with the tables users /…
ProgrammingLevel 3★★★☆☆Programming - Web Scraping Graph Traversal
site.json is a crawl result built from random data at every start (in /challenge). It holds the start and target URLs…
ProgrammingLevel 3★★★☆☆Programming - ZIP Password Recovery
secret.zip is a ZIP encrypted with ZipCrypto (the traditional PKWARE cipher), created at every start (in /challenge,…
ProgrammingLevel 3★★★☆☆Programming - Packet Log Analysis
capture.txt is a packet log created at every start (in /challenge). Each line is one flow of the form flow=<name>…
ProgrammingLevel 3★★★☆☆Programming - Multithreaded Result Reassembly
Analyze the parallel-job result log worker-results.jsonl, which is generated randomly at every start. Each slot was…