Challenge list
LinuxLevel 2★★☆☆☆Linux-02. Privilege Escalation via a Sudo-Allowed Vim
Check which commands a regular user can run via sudo without a password. A well-known GTFOBins technique can let you…
LinuxLevel 2★★☆☆☆Linux-03. Reading Cron Configuration Files
This system has several cron configurations (/etc/cron.d, /etc/crontab, user crontabs, and more). Inspect each…
LinuxLevel 2★★☆☆☆Linux-Cron Privesc. Hijacking a Writable Root Script
Check the permissions of a cron script that root executes periodically. If a regular user can write to it, think about…
LinuxLevel 2★★☆☆☆Linux-Systemd. Checking a Service Unit's Environment Variable
A systemd unit file can set environment variables in its [Service] section. Inspect the registered service definition…
LinuxLevel 2★★☆☆☆Linux-Symlink Maze. Navigating a Branching Path
Several directories are connected in a tangled web of symbolic links. Without being misled by decoy hint files, follow…
LinuxLevel 2★★☆☆☆Linux-Script Debug. Fixing a Broken Bash Script
This script has several intentional bugs (typos, syntax mistakes) and fails to run to completion. Use bash's debugging…
LinuxLevel 2★★☆☆☆Linux-Network Basics. Connecting to a Listening Port
A background service on this system is listening on a specific port. Identify the port with ss/netstat and connect to…
LinuxLevel 2★★☆☆☆Linux-Backup Finder. Spotting the Real Temp File
The project directory contains several decoy backup/temp files ending in .bak, .tmp, or ~. The real flag is hidden…
LinuxLevel 2★★☆☆☆Linux-Pipeline. Narrowing Down Logs with grep and awk
The access log contains many entries. One IP address generated a burst of 404s, and stitching together the paths of…
LinuxLevel 2★★☆☆☆Linux-Package Info. Inspecting Installed Package Details
A custom-built deb package is installed on this system. Use dpkg or apt to inspect the package's details and find…
LinuxLevel 2★★☆☆☆Linux-Process Hunting. Tracking Down a Running Process
Among several background processes, one has the flag embedded in its command-line arguments. List them with ps and…
LinuxLevel 2★★☆☆☆Linux-User Investigation. Filtering the Target User with awk
Several users are registered on this system. Parse /etc/passwd with awk to find the one matching a specific condition,…
LinuxLevel 2★★☆☆☆Linux-Log Rotation. Searching Compressed Historical Logs
Some older log files have been gzip-compressed by log rotation. Use a command that searches inside compressed files…
LinuxLevel 2★★☆☆☆Linux-Log Explorer. Digging the Flag Out of Multiple Logs
Multiple application and system log files are provided. The flag is embedded in a single DEBUG-level line — narrow it…
LinuxLevel 2★★☆☆☆Linux-Environment Secrets. Finding the Variable Named FLAG
Several environment variables, including some dummy credentials, are set on this system. List them with env and find…
Web SecurityLevel 2★★☆☆☆Web-11. SQL Injection into the Employee Portal
KinoGadget's internal "Employee Access Portal" runs on a legacy authentication system. The lead developer is rumored…
Web SecurityLevel 2★★☆☆☆Web-12. Reflected XSS in BlogSearch
BlogSearch is a simple search engine for blog articles. The search query is embedded into the results page as-is…
Web SecurityLevel 2★★☆☆☆Web-13. Bypassing File Upload Checks in ImageVault
ImageVault is an image hosting service that accepts JPG, PNG, and GIF uploads. If its validation only checks the end…
Web SecurityLevel 2★★☆☆☆Web-14. Command Injection in a Network Diagnostic Tool
This app is a diagnostic tool that runs ping against a host you supply. If the host input is passed straight into a…
Web SecurityLevel 2★★☆☆☆Web-15. IDOR in the UserProfile Service
The UserProfile Service exposes an API that returns profile information for a given user ID. Check whether the service…
Web SecurityLevel 2★★☆☆☆Web-16. Weak JWT Secret in the CHIMERA Research Lab
Clues found after breaching the employee portal point to an isolated research lab system codenamed CHIMERA. It…
Web SecurityLevel 2★★☆☆☆Web-17. Path Traversal in FileShare
FileShare lets users list and download files from a shared folder. Check whether the filename parameter passed to the…
Web SecurityLevel 2★★☆☆☆Web-18. XXE Attack via a Contact Form
This contact form serializes its input as XML and sends it to the server, which parses it and echoes the result.…
Web SecurityLevel 2★★☆☆☆Web-19. CSRF Transfer in a Banking App
This banking app lets a logged-in user transfer money. Check whether CSRF protections exist by seeing if a separate…