Challenge list

05. HTML Source Code Secret

Web pages contain a lot of information that isn't visible on the surface. Looking at HTML source code, you can often…

06. JavaScript Password Check

This page has a password-protected area. However, because the password check is done in JavaScript, you can find the…

07. Peek at Cookies

Websites use a mechanism called cookies to store information in your browser. They're used for managing login states,…

Network SecurityLevel 1★☆☆☆☆

08. Network Basics - Learn Port Numbers

Networks use port numbers to identify services. For example, a web server (HTTP) usually uses port 80, and encrypted…

10 ptsOpen challenge

ProgrammingLevel 1★☆☆☆☆

09. Python Automation - File Reading

In security work, programming is essential for processing large amounts of data. In this challenge, you'll use Python…

General SkillsLevel 1★☆☆☆☆

10. Security Basics - Ethics and Rules

To become a white hat hacker, knowledge of ethics and laws is just as important as technical skills. In this…

SQL Injection 101

This login form has an SQL Injection vulnerability. Log in as admin without proper credentials and retrieve the flag.

45 ptsOpen challenge

Web-04. The robots.txt Trap

Websites often serve a robots.txt file for crawlers. In this challenge, check whether a file that robots.txt tells…

Web-05. Directory Listing Trap

When an Nginx server has directory index listing (autoindex) enabled, anyone can browse the full file listing of a…

Web-06. Forging HTTP Headers

This application grants access based on the value of a specific HTTP header. Even values the browser never sends by…

Web-07. Tampering with URL Parameters

This web application checks the value of the GET parameter key on the server side. The required parameter name and…

Web-08. Tampering with POST Data

The login form contains a hidden input field that is invisible in the rendered page. Inspect it with developer tools…

Web-09. The Weak Basic Auth Trap

A protected area is guarded by HTTP Basic Authentication, but the developer accidentally left the credentials in an…

Web-10. Peeking Behind a Redirect

Accessing a certain page immediately redirects you elsewhere. Browsers automatically follow redirects, so think about…

XSS Basics - Guestbook

This web application has a basic XSS vulnerability. Find where input is reflected in the guestbook. The flag is at an…

35 ptsOpen challenge

API Requests - Find the Highest-Profit Trade

When the container starts, a stock API begins running on http://localhost:9102 (you do not need to start server.py).…

Bash Scripting - Power of Automation

/app/numbers.txt contains numbers from 1 to 1000, one per line. Extract all numbers that satisfy these conditions and…

100 ptsOpen challenge

Git Detective - Lost Commit

/app/repo is a Git repository. A developer accidentally deleted a commit containing important information. Use git…

100 ptsOpen challenge

JSON Master - Data Extraction

/app/users.json contains information of 100 users in JSON format. Extract users that meet these conditions: - age…

100 ptsOpen challenge

OSINT Basics - Metadata Analysis

Files recovered from a departed employee's shared drive (photos `IMG_*.jpg` and Office documents) are in…

150 ptsOpen challenge

Python Practice - Bulk Base64 Stream Decoding

Every line of data.txt (about 150 lines, created at every start) is Base64. Decode line by line; when the result…

Python Practice - Conditional CSV Sales Filtering

data.txt, created at every start, is a sales CSV (transaction_id,date,product_id,amount,status,ref,notes). Several…

Python Practice - Compound JSON User Query

Examine the JSON data.txt ({"users": [...]}) created at every start. Each user has id, name, email, role, active and…