Domains
Preview mode is live.
Browse the catalog and inspect challenge scenarios now. Create an account to submit flags, reveal hints, and save progress.
Showing 56 challenges
Sign in to track completions
Port Scan Primer
Analyze an nmap scan output to identify an unexpected exposed service.
Packet Carver
Reconstruct an exfiltration event from HTTP artifact logs to identify the filename.
ARP Poison MITM
Analyze an ARP poisoning attack to extract captured cleartext credentials.
VLAN Hopping
Exploit double-encapsulation VLAN hopping to understand its prerequisite.
SMB Relay
Understand NTLM hash indicators in an SMB relay attack outcome.
TCP Session Injection
Calculate the correct TCP sequence number needed for a session hijack injection.
IDS Fragmentation Evasion
Calculate the IP fragmentation offset to evade an IDS signature.
BGP Hijack Analysis
Identify the routing principle exploited in a BGP prefix hijack attack.
Email Format Recon
Determine a company's email format convention using known examples.
SPF Record Analysis
Identify a company's email provider from DNS SPF record data.
Certificate Transparency Hunt
Use certificate transparency logs to find a high-risk subdomain running EOL software.
PDF Metadata Extraction
Extract the Windows username of the document author from PDF ExifTool output.
GitHub Secret Exposure
Identify what type of AWS credential is indicated by the AKIA prefix in a leaked key.
Shodan Discovery
Locate an unauthenticated MongoDB instance exposed via Shodan.
Passive DNS Pivot
Identify a threat actor's phishing infrastructure subnet from a passive DNS investigation.
Google Dorking
Identify the Google dork operator used to filter search results by file extension.
Binary String Hunt
Extract the hardcoded C2 endpoint from a malware binary's strings output.
Decompiled License Check
Extract the hardcoded license key from a decompiled function.
XOR Key Recovery
Recover the single-byte XOR key used to encode a malware string.
Anti-Debug Bypass
Identify the x86 instruction patch to invert an IsDebuggerPresent anti-debug check.
PowerShell Decode
Decode an obfuscated Base64 PowerShell command to identify the dropped filename.
Reverse the Dropper
Decode a ROT-13 obfuscated C2 URL extracted from a malware dropper.
Shadow File Hash Algorithm
Identify the password hashing algorithm from a /etc/shadow hash prefix.
Packer Identification
Identify the packer and the CLI command to unpack a malware sample.
Process Anomaly Detection
Identify the suspicious parent-child process relationship that reveals malware.
Beacon Interval
Extract the C2 beacon interval from an automated sandbox analysis report.
WMI Persistence
Identify which persistence mechanism survives a full registry and task cleanup.
C2 Framework Identification
Identify the C2 framework from extracted beacon configuration artifacts.
Ransomware Decryption Key
Identify the cryptographic material needed to decrypt ransomware-encrypted files without paying.
Linux Rootkit Detection
Identify the syscall hooking technique used by a Linux rootkit to evade detection.
Kerberoasting Attack
Identify the Active Directory attack technique used to obtain service account credentials.
Polymorphic Malware Detection
Identify the detection methodology best suited to polymorphic malware.
Reflected XSS
Craft a basic reflected XSS payload for an unescaped search parameter.
SQL Injection Auth Bypass
Construct a SQL injection payload to bypass a login form.
IDOR Access Control
Identify the correct HTTP response code for unauthorized access to another user's resource.
JWT Algorithm None
Identify the target role value in a JWT algorithm-none privilege escalation attack.
CSRF Session Binding
Identify the CSRF weakness where any valid token is accepted regardless of session.
OS Command Injection
Craft a command injection payload to read /etc/passwd through a network diagnostic tool.
JWT RS256 to HS256 Confusion
Identify the JWT claim to modify in an RS256-to-HS256 algorithm confusion attack.
SSRF to Cloud Metadata
Identify the AWS IMDS IP address exploited via SSRF to steal IAM credentials.
S3 Bucket Listing
Identify the S3 URL query parameter that reveals an exposed bucket listing.
IAM Privilege Escalation
Identify the IAM permission abused to create admin-level access keys.
EC2 UserData Secrets
Extract the hardcoded database password from an EC2 UserData bootstrap script.
Lambda Credential Theft
Identify which Lambda environment variable provides AWS credentials for privilege escalation.
Privileged Container Escape
Identify the Docker flag that enables a container escape via host filesystem access.
Kubernetes Secret Exfiltration
Identify the overpermissioned RBAC grant that enabled cluster admin access from a pod.
CloudTrail Blind Spot
Identify the AWS service that detects CloudTrail being disabled.
Cross-Account Role Pivot
Identify the AWS STS API call used to assume a role in another account.
Hash Algorithm Identification
Identify the hashing algorithm from a 32-character hex hash.
SHA-1 Hash Cracking
Recover the plaintext from an unsalted SHA-1 hash.
Weak JWT Secret
Identify the weak HMAC signing secret discovered through brute force.
OAuth Redirect URI Bypass
Identify the OAuth vulnerability class arising from improper redirect_uri validation.
AES-CBC Padding Oracle
Identify the cryptographic attack class exploited via CBC padding error messages.
JWT Algorithm None Bypass
Identify the JWT algorithm value that disables signature verification in vulnerable libraries.
Timing Side-Channel Fix
Identify the secure coding approach that fixes timing-based password comparison attacks.
bcrypt Cost Factor Analysis
Extract the bcrypt cost factor from a hash and identify the security implication.