Cybersecurity CTF challenges
Choose a domain and difficulty, inspect the evidence, and verify each conclusion in a safe environment.
Linux Level 3 Linux-Race Condition. Exploiting a TOCTOU Gap for Root Files
A cleanup script that root runs periodically has a gap (TOCTOU) between checking and acting on a file. Try exploiting…
Forensics Level 3 Find Deleted File Traces in NTFS $MFT
Analyze `mft_records.txt`, a dump of the NTFS Master File Table, to recover information about deleted files. A…
General Skills Level 3 Python Automation - REST API Data Collection
A paginated local API runs in the container at `http://127.0.0.1:8000/api/records?page=N`. Walk every page until…
Programming Level 3 Python Automation - SQLite Database Analysis
data.db is a business SQLite database (users / orders / audit_log). The flag hides in the security_note of the single…
Programming Level 3 Python Automation - Custom Cipher Decryption
cipher.txt holds the flag encrypted with a custom cipher (hex). Encryption applies per byte: add (key), xor…
Programming Level 3 Python Automation - Encrypted ZIP Password Cracking
secret.zip is a ZIP encrypted with a weak password and contains flag.txt. Use the shipped wordlist.txt and Python's…
General Skills Level 3 SQL Query Master - Complex Joins
SQLite database /app/company.db has 3 tables: - employees (id, name, department_id, salary) - departments (id, name,…
Web Level 3 Web-21. Blind Injection in Secure User Search
This user search app only reports whether a username exists, without showing direct query results. Investigate whether…
Web Level 3 Web-22. CSP Bypass on the Secure Comment Board
This comment board is protected by a Content Security Policy restricting script execution to the site itself and a…
Web Level 3 Web-23. Type Juggling in the Secure Authentication System
This login portal supports form login, a JSON API login, and a verification-code check. The admin account's real…
Web Level 3 Web-24. Exploiting a Race Condition in Secure Bank
Secure Bank lets users spend a coin balance on shop prizes. If the balance check and the deduction happen as two…
Web Level 3 Web-25. SSTI in the Greeting Card Generator
This greeting card generator is built with Flask/Jinja2 and renders the user's message directly through the template…
Programming Level 3 Algorithms - BFS Shortest Path Through a Maze
Use BFS to find the shortest path from S to E in data.txt, then submit the UDLR move sequence to challenge.py. A…
Forensics Level 3 Detect Brute-Force Attack in Event Logs
Analyze the authentication log `auth.log` to find traces of a brute-force attack. Aggregate failed logins per source…
General Skills Level 3 System Call Tracing - strace Debugging
Analyze `/challenge/strace.log`, a recorded trace of the source-less program `/app/mystery_program`. Find where it…
General Skills Level 3 System Log Analysis - journalctl Master
Analyze `/challenge/system.log`, an exported systemd journal. Exactly one log line is from the authentication service…
General Skills Level 3 Network Master - Netcat Reverse Shell
Analyze a prerecorded callback transcript without connecting to any external host. No listener or shell is started.…
Network Level 3 Network Analysis - SNMP Information Leak
A device speaking SNMPv2c with a weak community string (public) was captured returning a GetResponse. Download the…
Network Level 3 Network Analysis - SSL Strip Clear-text Credentials
An SSL Strip attack downgraded HTTPS to HTTP, so the victim's credentials traveled in clear text and were captured.…
Network Level 3 Network Analysis - Custom Protocol Decoding
Traffic from a system using a small custom binary protocol was captured. Download the packet capture (traffic.pcap),…
General Skills Level 3 Performance Analysis - Find the Resource Hog
Analyze the recorded performance metrics in `/challenge/metrics.log`. Identify the single process that is an outlier…
Programming Level 3 Programming - SQLite Evidence Database
evidence.db is generated from the FLAG injected at startup. JOIN users/access_log and Base64-decode the top…
Programming Level 3 Programming - Web Scraping Graph Traversal
site.json is generated from the FLAG injected at startup. Follow ordered link-graph comments and join Base64 fragments…
Programming Level 3 Programming - ZIP Password Recovery
archive.json is generated from the FLAG injected at startup. Find the wordlist password matching password_sha256 and…