Challenge list
ProgrammingLevel 4★★★★☆Advanced Python - Custom VM Bytecode Execution
program.kvm is bytecode for a custom four-register VM. Implement an interpreter in Python from the instruction…
Web SecurityLevel 4★★★★☆Web-26. Prototype Pollution in User Profile Manager
In this Node.js/Express app, a logged-in user can update their own profile. Check whether the recursive merge function…
Web SecurityLevel 4★★★★☆Web-27. GraphQL Introspection Leak
This GraphQL API exposes a schema of User objects with introspection enabled. Investigate whether undocumented queries…
Web SecurityLevel 4★★★★☆Web-28. Hijacking an OAuth Authorization Code
This OAuth 2.0 authorization provider offers a login flow, but its redirect_uri validation may be weak. Investigate…
Web SecurityLevel 4★★★★☆Web-29. NoSQL Injection in a MongoDB Login Form
This login portal is backed by MongoDB and builds its query directly from raw JSON username/password input.…
Web SecurityLevel 4★★★★☆Web-30. Insecure Deserialization in KinoVault
A legacy backup system codenamed KinoVault reportedly serializes user session objects with Python's pickle module and…
General SkillsLevel 4★★★★☆Custom Tool Development - Web Directory Scanner
Analyze the locally generated artifacts/scanner/directory-report.ndjson instead of scanning a live website. The…
General SkillsLevel 4★★★★☆Network Tunneling - SSH Port Forwarding
Practice SSH local port forwarding inside one container. SSH listens on 127.0.0.1:22 and the internal service uses…
ProgrammingLevel 4★★★★☆Binary Repair - Firmware Header and CRC32
Repair firmware.bin by writing KINO at bytes 0-3 and the little-endian CRC32 of bytes 12+ at bytes 8-11. Submit the…
ProgrammingLevel 4★★★★☆Programming - C2 Traffic Analysis
Analyze the synthetic log beacon.log, which is generated randomly at every start (no network connection is needed).…
ProgrammingLevel 4★★★★☆Programming - Buffer Overflow Crash Analysis
Analyze the crash reports crash_01.txt to crash_06.txt, which are generated randomly at every start (they contain no…
ProgrammingLevel 4★★★★☆Programming - Fuzzing Result Analysis
Analyze the fuzzing result log fuzz-results.log, which is generated randomly at every start (inputs are merely stored;…
ProgrammingLevel 4★★★★☆Programming - Blockchain Event Reassembly
/challenge/blocks.json is a list of blocks from an offline development chain, regenerated with random data every time…
ProgrammingLevel 4★★★★☆Programming - Rootkit View Diffing
proc_ps.txt (the userland ps output) and proc_kernel.txt (the result of walking the kernel task list directly) are…
ProgrammingLevel 4★★★★☆Programming - Anomaly Detection
/challenge/requests.csv is a web API access log that is regenerated with random data every time the container starts…
ProgrammingLevel 4★★★★☆Programming - Pentest Finding Analysis
findings.json is a scan result built from random data at every start (in /challenge). It has entry (edge-gw),…
ProgrammingLevel 4★★★★☆Programming - Async Scan Result Analysis
/challenge/scan-events.jsonl is the event log of an asynchronous port scanner, regenerated with random data every time…
General SkillsLevel 4★★★★☆Encrypted Communication - GPG Public Key Cryptography
Practice GnuPG decryption. Import every private key under `/challenge/keys/` and decrypt each ciphertext under…
General SkillsLevel 4★★★★☆Vulnerability Scanning - Advanced Nmap NSE
The results of running `nmap -sV -sC --script vuln` against the internal subnet `10.66.13.0/24` are in…
General SkillsLevel 4★★★★☆Static Analysis - Code Vulnerability Scanning
The Python source of an internal notes app is in `/challenge/src/`. The nine lines flagged by an earlier…
General SkillsLevel 5★★★★★APT Simulation - Full Breach Scenario
This is not an attack exercise but a blue-team task of reading the logs of an incident that already happened. From the…
General SkillsLevel 5★★★★★Bug Bounty Practice - Vulnerability Discovery Master
Analyze the fixed artifacts/bug-bounty/triage-report.json instead of testing a live application. A chained report has…
LinuxLevel 5★★★★★Linux-eBPF Rootkit. Unmasking a Hidden Process
This challenge safely recreates eBPF-rootkit investigation as offline evidence analysis. Without loading eBPF, tell…
LinuxLevel 5★★★★★Linux-Kernel Exploit. Rewriting a Read-Only File with Dirty COW
This challenge models mmap, MAP_PRIVATE, and madvise—the ingredients used by Dirty COW (CVE-2016-5195)—as a safe,…