Cybersecurity CTF challenges
Choose a domain and difficulty, inspect the evidence, and verify each conclusion in a safe environment.
Cryptography Level 4 Cryptanalysis - DSA Nonce Reuse Key Recovery
signatures.json contains two DSA signatures that reused the same nonce. Recover nonce k and private key x from the…
Forensics Level 4 Recover Damaged RAID5 Array
Reconstruct a three-disk RAID5 scenario as a safe file-level parity fixture. No block device, mdadm, or loop device is…
General Skills Level 4 Vulnerability Scanning - Advanced Nmap NSE
Analyze the vulnerability-scan report `scan_results/nmap_scan.nmap`. Most Nmap NSE `vuln` results are `NOT VULNERABLE`…
Forensics Level 4 Reconstruct Attack Scenario from Multiple Logs
Correlate `web.log`, `auth.log`, and `db.log` by session ID to reconstruct the intrusion from the web attack through…
General Skills Level 4 Static Analysis - Code Vulnerability Scanning
`/challenge/src/` contains the Python source of a web application. Use static analysis (`bandit`, `semgrep`) to…
General Skills Level 5 APT Simulation - Full Breach Scenario
This is not an attack exercise but a blue-team task of reading the logs of an incident that already happened. Analyze…
Forensics Level 5 Reconstruct Full APT Attack Stages
Correlate `edr_process.log`, `proxy_http.log`, `dns_queries.log`, and `dlp_transfer.log` on their shared campaign ID…
Forensics Level 5 Crack BitLocker Encrypted Drive
Learn BitLocker recovery-key verification with a safe metadata fixture. bitlocker.img is not a real volume. Match a…
Forensics Level 5 Extract Message Hidden in Bitcoin Transaction
Analyze a Bitcoin OP_RETURN using a safe offline transaction fixture. transaction.json is a recorded artefact that…
General Skills Level 5 Bug Bounty Practice - Vulnerability Discovery Master
Analyze a fixed bug-bounty triage report instead of testing a live application. Recover the proof attached to the…
Forensics Level 5 Extract Secret Key from IoT Device Firmware
Learn IoT firmware extraction using a safe tar-formatted rootfs fixture. firmware.bin is not a real device image.…
Linux Level 5 Linux-eBPF Rootkit. Unmasking a Hidden Process
This challenge safely recreates eBPF-rootkit investigation as offline evidence analysis. Without loading eBPF or…
Linux Level 5 Linux-Kernel Exploit. Rewriting a Read-Only File with Dirty COW
This challenge models mmap, MAP_PRIVATE, and madvise—the ingredients used by Dirty COW (CVE-2016-5195)—as a safe,…
Programming Level 5 Advanced Python - Concurrent Event DAG Correlation
events.jsonl interleaves randomly ordered events from many services and traces. Starting from the marked auth.failed…
General Skills Level 5 Red Teaming - Custom C2 Framework
No C2 server, agent, socket communication, or command execution is started. Analyze the analysis-result record in the…
General Skills Level 5 Anti-Forensics - Evidence Elimination
After intrusion the attacker tried to cover their tracks, truncating part of `/challenge/auth_syslog.log` and clearing…
General Skills Level 5 Custom Malware - Stealth Techniques
No executable malware, injection, or evasion capability is included. Analyze an inert configuration sample and recover…
General Skills Level 5 Cloud Pentesting - AWS Multi-Stage Attack
Do not use AWS credentials, a metadata endpoint, or Lambda. Analyze the local simulated CloudTrail chain and recover…
General Skills Level 5 Container Escape - Kubernetes Privilege Escalation
Do not use a Kubernetes API, host mount, privileged container, or escape. Read the static privileged-mount audit and…
General Skills Level 5 Supply Chain Attack - Dependency Exploitation
Analyze the dependency records of a Node.js app (`package.json`, `dependencies.txt`, `install.log`). Identify the…
Network Level 5 Network Analysis - IPv4 Overlapping Fragment Reassembly
The UDP datagram with IPv4 ID 0xbeef in fragments.pcap contains overlapping fragments that overwrite earlier bytes.…
Forensics Level 5 Extract VM Information from Hypervisor Memory
Analyze KVM hypervisor guest state using a safe text VMCS/guest-memory fixture. Without starting or acquiring a VM,…
General Skills Level 5 Pivoting - Multi-Tier Network Penetration
Analyze a prerecorded offline routing topology without creating routes, tunnels, proxies, or remote services. Recover…
General Skills Level 5 Fuzzing Basics - 0-day Discovery
Analyze a pre-minimized safe crash artifact without running a fuzzer or target binary. Recover the flag from the…