Cybersecurity CTF challenges
Choose a domain and difficulty, inspect the evidence, and verify each conclusion in a safe environment.
Programming Level 4 Advanced Python - Custom VM Bytecode Execution
program.kvm is bytecode for a custom four-register VM. Implement an interpreter in Python from the instruction…
Forensics Level 4 Decrypt TLS-Encrypted HTTPS Traffic
Analyze a safe TLS-forensics fixture. traffic.pcap is a text representation of one TLS application-data capture and…
Web Level 4 Web-26. Prototype Pollution in User Profile Manager
In this Node.js/Express app, a logged-in user can update their own profile. Check whether the recursive merge function…
Web Level 4 Web-27. GraphQL Introspection Leak
This GraphQL API exposes a schema of User objects with introspection enabled. Investigate whether undocumented queries…
Web Level 4 Web-28. Hijacking an OAuth Authorization Code
This OAuth 2.0 authorization provider offers a login flow, but its redirect_uri validation may be weak. Investigate…
Web Level 4 Web-29. NoSQL Injection in a MongoDB Login Form
This login portal is backed by MongoDB and builds its query directly from raw JSON username/password input.…
Web Level 4 Web-30. Insecure Deserialization in KinoVault
A legacy backup system codenamed KinoVault reportedly serializes user session objects with Python's pickle module and…
General Skills Level 4 Custom Tool Development - Web Directory Scanner
Analyze a locally generated directory-scanner report instead of scanning a live website. Recover the payload on the…
General Skills Level 4 Network Tunneling - SSH Port Forwarding
Practice SSH local port forwarding inside one container. The SSH jump role is 127.0.0.1:22 and the internal service…
Network Level 4 Network Analysis - TCP Retransmission Covert Channel
capture.pcap contains TCP retransmissions with duplicate sequence numbers. Extract retransmissions whose payload…
Programming Level 4 Binary Repair - Firmware Header and CRC32
Repair firmware.bin by writing KINO at bytes 0-3 and the little-endian CRC32 of bytes 12+ at bytes 8-11. Submit the…
Programming Level 4 Programming - C2 Traffic Analysis
beacon.log is generated from the FLAG injected at startup. Join Base64 payloads by seq and repeat-XOR with the first…
Programming Level 4 Programming - Buffer Overflow Crash Analysis
crash-report.txt is generated from the FLAG injected at startup. Select the SIGSEGV/fault_offset record and…
Programming Level 4 Programming - Fuzzing Result Analysis
fuzz-results.log is generated from the FLAG injected at startup. Select the SIGSEGV input and XOR-decrypt it with…
Programming Level 4 Programming - Blockchain Event Reassembly
blocks.json is generated from the FLAG injected at startup. Filter FlagFragment events with topic 0xfeedface, order by…
Programming Level 4 Programming - Rootkit View Diffing
proc_ps.txt and proc_kernel.txt are generated from the FLAG injected at startup. Diff process views and ROT13-decode…
Programming Level 4 Programming - Anomaly Detection
requests.csv is generated from the FLAG injected at startup. Select the highest-signal payload, Base85-decode, then…
Programming Level 4 Programming - Pentest Finding Analysis
findings.json is generated from the FLAG injected at startup. Locate the reachable critical finding and reverse…
Programming Level 4 Programming - Async Scan Result Analysis
scan.json is generated from the FLAG injected at startup. Select the verification host with open 443/tcp and…
Forensics Level 4 Extract Malware Payload from Memory
Analyze the recovered memory-string record `memstrings.txt` and reconstruct the obfuscated second-stage payload.…
Forensics Level 4 Detect Hidden Kernel Module in Memory
Compare `modules_list.txt` and `sysfs_modules.txt`, two reconstructed views of Linux kernel modules, to identify the…
Forensics Level 4 Decode Multi-Stage Steganography
Follow the three-stage data trail hidden in `cover.png` and `notes.txt`: decode the PNG pixel-LSB message, the Base64…
Forensics Level 4 Recover Fragmented JPEG File
Analyze the fragments and `.meta` sidecars under `fragments/` to reconstruct a fragmented JPEG. Determine the order…
General Skills Level 4 Encrypted Communication - GPG Public Key Cryptography
Practice GnuPG decryption. Import every private key under `/challenge/keys/` and decrypt each ciphertext under…