Challenge list
ProgrammingLevel 2★★☆☆☆Python Automation - Bulk Base64 Decoding
Every line of data.txt (about 150 lines, created at every start) is Base64. Decode line by line; when the result…
ProgrammingLevel 2★★☆☆☆Python Automation - CSV Sales Filtering
data.txt, created at every start, is a sales CSV (transaction_id,date,product_id,amount,status,ref,notes). Several…
ProgrammingLevel 2★★☆☆☆Python Automation - JSON User Query
Examine the JSON data.txt ({"users": [...]}) created at every start. Each user has id, name, email, role, active and…
ProgrammingLevel 2★★☆☆☆Python Automation - Access Log Parsing
data.txt (about 1,300 lines, created at every start) is a web server access log. Extract only the requests from…
ProgrammingLevel 2★★☆☆☆Python Automation - Password Hash Cracking
Examine data.txt (a list of SHA-256 digests) and wordlist.txt (800 four-character lowercase alphanumeric tokens), both…
Web SecurityLevel 2★★☆☆☆Web-11. SQL Injection into the Employee Portal
KinoGadget's internal "Employee Access Portal" runs on a legacy authentication system. The lead developer is rumored…
Web SecurityLevel 2★★☆☆☆Web-12. Reflected XSS in BlogSearch
BlogSearch is a simple search engine for blog articles. The search query is embedded into the results page as-is…
Web SecurityLevel 2★★☆☆☆Web-13. Bypassing File Upload Checks in ImageVault
ImageVault is an image hosting service that accepts JPG, PNG, and GIF uploads. If its validation only checks the end…
Web SecurityLevel 2★★☆☆☆Web-14. Command Injection in a Network Diagnostic Tool
This app is a diagnostic tool that runs ping against a host you supply. If the host input is passed straight into a…
Web SecurityLevel 2★★☆☆☆Web-15. IDOR in the UserProfile Service
The UserProfile Service exposes an API that returns profile information for a given user ID. Check whether the service…
Web SecurityLevel 2★★☆☆☆Web-16. Weak JWT Secret in the CHIMERA Research Lab
Clues found after breaching the employee portal point to an isolated research lab system codenamed CHIMERA. It…
Web SecurityLevel 2★★☆☆☆Web-17. Path Traversal in FileShare
FileShare lets users list and download files from a shared folder. Check whether the filename parameter passed to the…
Web SecurityLevel 2★★☆☆☆Web-18. XXE Attack via a Contact Form
This contact form serializes its input as XML and sends it to the server, which parses it and echoes the result.…
Web SecurityLevel 2★★☆☆☆Web-19. CSRF Transfer in a Banking App
This banking app lets a logged-in user transfer money. Check whether CSRF protections exist by seeing if a separate…
Web SecurityLevel 2★★☆☆☆Web-20. SSRF via the URL Fetcher
This URL Fetcher service retrieves and displays the content of any URL a user provides. Check whether it can be…
General SkillsLevel 2★★☆☆☆Text Processing Master - sed & awk
/app/data.csv contains CSV data. Perform these operations: 1. Extract only rows where column 2 (price) >= 1000 2.…
ProgrammingLevel 2★★☆☆☆Programming - Bash Job Log Analysis
/challenge/jobs.log is a nightly batch log that is regenerated with random data every time the container starts. Each…
ProgrammingLevel 2★★☆☆☆Programming - PIN Brute Force
/challenge/vault.json is a vault record that is regenerated with random data every time the container starts. It…
ProgrammingLevel 2★★☆☆☆Programming - Hash Verification and Decryption
Analyze the evidence file artifact-manifest.json, which is generated randomly at every start. Each artifact…
ProgrammingLevel 2★★☆☆☆Programming - Binary TLV Parsing
/challenge/capture.bin is a custom binary file that is regenerated with random data every time the container starts.…
General SkillsLevel 2★★☆☆☆Process Hunter - Hidden Process
A process named "secret_service" is running in the background. Find this process and get the following information: 1.…
General SkillsLevel 2★★☆☆☆Log Analysis - Find the Intruder
/app/auth.log contains authentication logs. Detect suspicious activity: - Identify the IP address with 10+ failed…
General SkillsLevel 2★★☆☆☆Compression Maze - Nested Archives
/app/flag.tar.gz is a nested compressed file. Decompress step by step: flag.tar.gz → flag.tar → flag.zip.bz2.gz →…
ProgrammingLevel 2★★☆☆☆Regular Expressions - The One-Time Golden Glyph
Extract every KINO-four-digits-four-uppercase glyph from data.txt, identify the one occurring once, and submit it to…