Cybersecurity CTF challenges
Choose a domain and difficulty, inspect the evidence, and verify each conclusion in a safe environment.
ProgrammingLevel 2Programming - PIN Brute Force
vault.json is generated from the FLAG injected at startup. Brute-force the 0000–9999 PIN SHA-256 and XOR-decrypt with…
ProgrammingLevel 2Programming - Hash Verification and Decryption
artifact-manifest.json is generated from the FLAG injected at startup. Verify each data SHA-256, XOR-decrypt with…
ProgrammingLevel 2Programming - Binary TLV Parsing
capture.bin is generated from the FLAG injected at startup. Parse KBIN TLV records and XOR-decode type 0x42 with 0x5A…
General SkillsLevel 2Process Hunter - Hidden Process
A process named "secret_service" is running in the background. Find this process and get the following information: 1.…
ForensicsLevel 2Find Process in Memory Dump
Analyze the process list recorded in memory.dump and find the flag contained in the suspicious process name. Learn the…
CryptographyLevel 2Rainbow Table Attack
Unsalted fast password hashes can often be reversed with precomputed lookup databases. Reverse the given MD5 hash. MD5…
General SkillsLevel 2Log Analysis - Find the Intruder
/app/auth.log contains authentication logs. Detect suspicious activity: - Identify IP addresses with 10+ failed logins…
CryptographyLevel 2One-Time Pad Key Reuse Attack
A one-time pad is safe only when the key is used once. Reusing the key lets known plaintext recover other plaintexts.…
CryptographyLevel 2Predictable Randomness
Pseudo-random output with a fixed seed is reproducible and must not be used for cryptographic secrets. Flag generation…
ForensicsLevel 2Recover Deleted Files
Recover deleted text files from the disk image and find the flag. Learn how to use file carving tools to recover…
General SkillsLevel 2Compression Maze - Nested Archives
/app/flag.tar.gz is a nested compressed file. Decompress step by step: flag.tar.gz → flag.tar → flag.zip.bz2.gz →…
CryptographyLevel 2Breaking Small RSA Keys
Factor a tiny RSA modulus, recover the private exponent, and decrypt a list of ciphertext values. Public key and…
ProgrammingLevel 2Regular Expressions - The One-Time Golden Glyph
Extract every KINO-four-digits-four-uppercase glyph from data.txt, identify the one occurring once, and submit it to…
General SkillsLevel 2Regex Master - Log File Analysis
The file /app/access.log contains thousands of access log entries. Extract all entries where the IP address starts…
General SkillsLevel 2Environment Variable Master - PATH Hijacking
There is a hidden command "getflag" in /app/secret_bin directory. However, this directory is not in PATH, so you…
ForensicsLevel 2Message Hidden in Image LSB
Extract the message hidden in the LSB (Least Significant Bit) of a PNG file. Learn the basics of steganography…
ForensicsLevel 3Extract Session Cookies from Chrome
Analyze Chrome history database and Cookie file to retrieve session information for a specific site. Learn browser…
ForensicsLevel 3Detect DNS Tunneling
Analyze the DNS query log `dns_queries.log` to detect data exfiltration via DNS tunneling. Find the host flooding a…
General SkillsLevel 3Docker Forensics - Container Investigation
Investigate a `docker save`-style image record. The final `Config.Env` in `image_config.json` looks scrubbed, but…
General SkillsLevel 3Find the Deleted API Key in Git History
/app/repo is a Git repository. A developer accidentally committed an API_KEY and removed it in a later commit. Inspect…
LinuxLevel 3Linux-Capabilities. Privilege Escalation Beyond SUID
A specific binary on this system has Linux capabilities assigned to it. Investigate a privilege escalation technique…
LinuxLevel 3Linux-SUID Exploit. Escalating Privileges via the find Binary
A copy of the find command with the SUID bit set exists on this system. Use a well-known GTFOBins technique to obtain…
LinuxLevel 3Linux-Proc Memory. Peeking at a Process's Environment
A daemon process runs continuously in the background, with the flag set as one of its environment variables.…
LinuxLevel 3Linux-Strace. Tracing System Calls to Expose a File
A binary that prints nothing to standard output is provided. Trace its system calls with strace to determine which…