Cybersecurity CTF challenges
Choose a domain and difficulty, inspect the evidence, and verify each conclusion in a safe environment.
Programming Level 3 Programming - Packet Log Analysis
capture.txt is generated from the FLAG injected at startup. Select flow=exfil payload_hex and XOR-decrypt with 0x5A to…
Programming Level 3 Programming - Multithreaded Result Reassembly
worker-results.jsonl is generated from the FLAG injected at startup. Base64-decode results, XOR with worker SHA-1, and…
Programming Level 3 Programming - Memory Dump Analysis
memory.img is generated from the FLAG injected at startup. Extract the ALLOC:0x4040 little-endian region and…
Programming Level 3 Programming - Known-Plaintext Attack
known.txt and ciphertext.b64 are generated from the FLAG injected at startup. Derive the repeating XOR keystream from…
Programming Level 3 Programming - Custom Protocol Parsing
protocol.bin is generated from the FLAG injected at startup. Walk length-prefixed KINO frames and XOR-decrypt type=3…
Programming Level 3 Programming - Image Steganography
image.pgm is generated from the FLAG injected at startup. Read pixel LSBs in 8-bit groups until NUL to recover the flag.
Forensics Level 3 Find Suspicious Network Connections in Memory
Analyze the network-connection record `netstat_dump.txt` to identify the suspicious C&C connection. The single…
Forensics Level 3 Recover Executed Commands from Memory
Analyze the memory-string record `memdump.txt` to recover the executed command history. Decode the Base64 strings and…
Forensics Level 3 Recover Deleted SQLite Records
Recover the deleted record from the SQLite database `app.db` to obtain the flag. Deleted rows persist in the freelist,…
Forensics Level 3 Decompress Multi-Layer Archive
Decompress a file that has been compressed multiple times with different formats (zip, tar, gzip, bzip2). Learn to…
Forensics Level 3 Decrypt Encrypted Disk
`secret_disk.img` is a genuine LUKS2 container. Brute-force `wordlist.txt` to find the weak passphrase, then decrypt…
General Skills Level 3 Regex Expert - Data Validation
/app/data.txt contains various data formats. Extract lines that satisfy ALL conditions: 1. Contains email format…
Forensics Level 3 Data Hidden in Audio File
`hidden.wav` hides a message encoded with on-off keying (OOK). Turn the tone on/off slots into bits and decode them to…
General Skills Level 3 Advanced Automation - Directory Monitor
`/challenge/logs/` holds a large set of access logs. Aggregate status-404 requests per source IP and identify the…
General Skills Level 4 AWS CLI - S3 Bucket Investigation
Analyze the S3 configuration audit under `/challenge/s3_audit/`. Inspect each bucket's `*_acl.json`, `*_policy.json`,…
Forensics Level 4 Extract Secret Key from Android App
Extract a safe ZIP-formatted APK fixture and analyze the API secret recorded in its Android resources. No real device…
General Skills Level 4 Ansible Automation - Server Configuration Management
Analyze a generated vault export without running Ansible or touching a server. Recover the encoded payload recorded…
General Skills Level 4 CI/CD Security - GitHub Actions Vulnerability
Investigate the GitHub Actions workflows under `/challenge/repo/.github/workflows/` and the run logs under…
Forensics Level 4 Detect Unauthorized Access in CloudTrail Logs
Analyze AWS CloudTrail logs to detect unauthorized IAM access and data exfiltration. Learn cloud forensics. Provided…
Forensics Level 4 Extract Secrets from Docker Image Layers
The startup-generated `image/` directory is a `docker save`-style image layer layout. Analyze its `layer.tar` files…
General Skills Level 4 Infrastructure as Code - Terraform Security
Analyze a generated tfstate artifact without initializing a Terraform provider. Recover the flag from the audit_only…
General Skills Level 4 Kubernetes Basics - Cluster Investigation
Investigate a Pod snapshot artifact without connecting to a Kubernetes cluster. Recover the encoded value in the…
Linux Level 4 Linux-Kernel Module. Gaining Root via a Vulnerable Driver
This challenge analyzes a vulnerable kernel module with a /proc interface as a safe user-space simulation. Find the…
Linux Level 4 Linux-Buffer Overflow. Exploiting a gets() Vulnerability
A vulnerable SUID C binary with protections disabled is provided. Exploit its buffer overflow to redirect control flow…