Cybersecurity CTF challenges
Choose a domain and difficulty, inspect the evidence, and verify each conclusion in a safe environment.
Linux Level 1 Linux-Process Basics. Checking a sleep Command's Arguments
Find the process with the target command-line argument among several processes running in the background. This…
Linux Level 1 Linux-Deep Search. Discovering a Deeply Nested File
A single file containing the flag is hidden deep inside many nested directories. Use the find command to locate the…
Linux Level 1 Linux-Environment Variable Basics. Checking Shell Startup Variables
One of the environment variables set when the shell starts holds the flag. Check it with the env command or echo…
Linux Level 1 Linux Basics - Permissions and SUID
Learn basic Linux commands and file permissions. Use hints to find SUID and retrieve the flag.
Web Level 1 SQL Injection 101
This login form has an SQL Injection vulnerability. Log in as admin without proper credentials and retrieve the flag.
Web Level 1 Web-04. The robots.txt Trap
Websites often serve a robots.txt file for crawlers. In this challenge, check whether a file that robots.txt tells…
Web Level 1 Web-05. Directory Listing Trap
When an Nginx server has directory index listing (autoindex) enabled, anyone can browse the full file listing of a…
Web Level 1 Web-06. Forging HTTP Headers
This application grants access based on the value of a specific HTTP header. Even values the browser never sends by…
Web Level 1 Web-07. Tampering with URL Parameters
This page checks a URL GET parameter's value using client-side JavaScript and reveals a flag when the condition is…
Web Level 1 Web-08. Tampering with POST Data
The login form contains a hidden input field that is invisible in the rendered page. Inspect it with developer tools…
Web Level 1 Web-09. The Weak Basic Auth Trap
A protected area is guarded by HTTP Basic Authentication, but the developer accidentally left the credentials in an…
Web Level 1 Web-10. Peeking Behind a Redirect
Accessing a certain page immediately redirects you elsewhere. Browsers automatically follow redirects, so think about…
Web Level 1 XSS Basics - Guestbook
This web application has a basic XSS vulnerability. Find where input is reflected in the guestbook and retrieve the…
Cryptography Level 2 AES-ECB Mode Weakness
ECB leaks repeated block patterns. This introductory task first checks the difference between encryption and encoding.…
Programming Level 2 API Requests - Find the Highest-Profit Trade
Start the stock API on localhost:9102, find the transaction with the largest sell_price - buy_price across all…
Forensics Level 2 Find Attack in Apache Logs
Analyze Apache access.log to find traces of SQL injection attacks. Learn log analysis and pattern matching. Provided…
General Skills Level 2 Bash Scripting - Power of Automation
/app/numbers.txt contains numbers from 1 to 1000, one per line. Extract all numbers that satisfy these conditions and…
Forensics Level 2 Flag Hidden in Excel Macro
Analyze the macro code embedded in the Excel file to find the flag. Learn how to analyze Office document macros.…
General Skills Level 2 Git Detective - Lost Commit
/app/repo is a Git repository. A developer accidentally deleted a commit containing important information. Use git…
General Skills Level 2 JSON Master - Data Extraction
/app/users.json contains information of 100 users in JSON format. Extract users that meet these conditions: - age…
Linux Level 2 Linux-02. Privilege Escalation via a Sudo-Allowed Vim
Check which commands a regular user can run via sudo without a password. A well-known GTFOBins technique can let you…
Linux Level 2 Linux-03. Reading Cron Configuration Files
This system has several cron configurations (/etc/cron.d, /etc/crontab, user crontabs, and more). Inspect each…
Linux Level 2 Linux-Cron Privesc. Hijacking a Writable Root Script
Check the permissions of a cron script that root executes periodically. If a regular user can write to it, think about…
Linux Level 2 Linux-Systemd. Checking a Service Unit's Environment Variable
A systemd unit file can set environment variables in its [Service] section. Inspect the registered service definition…