Cybersecurity CTF challenges
Choose a domain and difficulty, inspect the evidence, and verify each conclusion in a safe environment.
WebLevel 2Web-11. SQL Injection into the Employee Portal
KinoGadget's internal "Employee Access Portal" runs on a legacy authentication system. The lead developer is rumored…
WebLevel 2Web-12. Reflected XSS in BlogSearch
BlogSearch is a simple search engine for blog articles. The search query is reflected back on the results page — check…
WebLevel 2Web-13. Bypassing File Upload Checks in ImageVault
ImageVault is an image hosting service that accepts JPG, PNG, and GIF uploads. If its validation only checks the end…
WebLevel 2Web-14. Command Injection in a Network Diagnostic Tool
This app is a diagnostic tool that runs ping against a host you supply. If the host input is passed straight into a…
WebLevel 2Web-15. IDOR in the UserProfile Service
The UserProfile Service exposes an API that returns profile information for a given user ID. Check whether the service…
WebLevel 2Web-16. Weak JWT Secret in the CHIMERA Research Lab
Clues found after breaching the employee portal point to an isolated research lab system codenamed CHIMERA. It…
WebLevel 2Web-17. Path Traversal in FileShare
FileShare lets users list and download files from a shared folder. Check whether the filename parameter passed to the…
WebLevel 2Web-18. XXE Attack via a Contact Form
This contact form serializes its input as XML and sends it to the server, which parses it and echoes the result.…
WebLevel 2Web-19. CSRF Transfer in a Banking App
This banking app lets a logged-in user transfer money. Check whether CSRF protections exist by seeing if a separate…
WebLevel 2Web-20. SSRF via the URL Fetcher
This URL Fetcher service retrieves and displays the content of any URL a user provides. Check whether it can be…
ForensicsLevel 2Find USB History in Windows Registry
Analyze the SYSTEM file to retrieve connected USB device information and the hidden flag. Learn the basics of Windows…
General SkillsLevel 2Text Processing Master - sed & awk
/app/data.csv contains CSV data. Perform these operations: 1. Extract only rows where column 2 (price) >= 1000 2.…
ForensicsLevel 2Find Secret File in Disk Image
Inspect the ext4 filesystem disk image `disk.img` and read the hidden secret file from the filesystem to recover the…
NetworkLevel 2Network Analysis - DNS Zone Transfer Leak
An unauthenticated DNS zone transfer (AXFR) against a misconfigured authoritative server was captured. Download the…
NetworkLevel 2Network Analysis - SMB Share Enumeration Leak
An attacker enumerating SMB shares on the network was captured. Download the packet capture (traffic.pcap), follow the…
NetworkLevel 2Network Analysis - Telnet Credentials
A legacy server was administered over Telnet in clear text. Download the packet capture (traffic.pcap), follow the…
NetworkLevel 2Network Analysis - Anonymous FTP Transfer
An anonymous FTP session was captured in clear text. Download the packet capture (traffic.pcap), follow the FTP data…
NetworkLevel 2Network Analysis - Clear-text HTTP Credentials
Analyze traffic intercepted on public Wi-Fi where someone logged in over plain HTTP. Download the packet capture…
CryptographyLevel 2Finding Hash Collisions
MD5 collisions are practical. Hashes with broken collision resistance must not be used for security-sensitive…
CryptographyLevel 2Hash Length Extension Attack
Simple signatures such as hash(secret || message) can be vulnerable to length extension attacks with Merkle-Damgard…
ForensicsLevel 2Find Password in Packet Capture
Clear-text HTTP traffic from a shop's internal network was captured. Among many requests, exactly one is the…
CryptographyLevel 2Padding Oracle Basics
Padding oracle attacks use error differences as a plaintext recovery signal. This introductory task decodes leaked…
ForensicsLevel 2Identify Intrusion Time from File Timestamps
Analyze timestamps of multiple files to identify when the intrusion occurred and which hidden log is related to it.…
ProgrammingLevel 2Programming - Bash Job Log Analysis
jobs.log is generated from the FLAG injected at startup. Filter successful archive jobs, order parts, reverse values,…