Domains
Preview mode is live.
Browse the catalog and inspect challenge scenarios now. Create an account to submit flags, reveal hints, and save progress.
Showing 8 challenges
Sign in to track completions
Hash Algorithm Identification
Identify the hashing algorithm from a 32-character hex hash.
SHA-1 Hash Cracking
Recover the plaintext from an unsalted SHA-1 hash.
Weak JWT Secret
Identify the weak HMAC signing secret discovered through brute force.
OAuth Redirect URI Bypass
Identify the OAuth vulnerability class arising from improper redirect_uri validation.
AES-CBC Padding Oracle
Identify the cryptographic attack class exploited via CBC padding error messages.
JWT Algorithm None Bypass
Identify the JWT algorithm value that disables signature verification in vulnerable libraries.
Timing Side-Channel Fix
Identify the secure coding approach that fixes timing-based password comparison attacks.
bcrypt Cost Factor Analysis
Extract the bcrypt cost factor from a hash and identify the security implication.