Browse Scenarios
Explore 200+ hands-on cybersecurity challenges built around real-world scenarios and skills.
Showing 13–24 of 100 scenarios
It takes one
A target believed that encrypting their data twice using the same weak key would provide enhanced security against brute-force attacks. You have been tasked with demonstrating that this naive cryptographic implementation fails to increase the effective keyspace. OBJECTIVE Exploit the cryptographic flaw of repeated encryption with a single weak key, develop a script to brute-force the limited keyspace, and automate the decryption process to recover the plaintext flag. Flag format: FLAG{} Infrastructure: None Provided Files: Python script, ciphertext
SideSign
SCENARIO A file download service that gates access behind a signature check. The flag is sitting at /flag , and the only thing standing between you and it is producing the correct signature. No source code is given. Figure out how the verification works and find a way to recover the signature. Flag format: flag{} Infrastructure - Docker Container — HTTP on port 5000 Provided Files - None (BlackBox Challenge)
Gone
SCENARIO A cloned filesystem from a target device. The sensitive documents inside have been redacted, and whoever handed this over is confident nothing useful remains. Take a closer look. The files are there, the data appears gone, but filesystems have a habit of holding onto things longer than people expect. Flag format: FLAG{} Infrastructure - Downloadable File Provided Files - Gone.zip (102.3 KB)
HardSchema
Visit /challenge/ to access a machine containing the source code of an application located in the src directory. Your task is to fix the code to retrieve the flag. Make sure to read the rules before you begin.
ReqProcessor
SCENARIO An invoice processing system with a public interface and an admin panel sitting right out in the open. The admin panel runs a custom request processor that handles sensitive operations, and it has its own authentication format. You have full access to the source code. Read how the request processor validates input, and ask yourself whether it actually does what it thinks it does. Flag format: flag{} Infrastructure - Docker Container — HTTP on port 3000 Provided Files - reqprocessor.zip (14.8 KB)
Spaced
SCENARIO I've been working as a satellite communications engineer for years now, and honestly, it's been pretty smooth sailing. Setting up ground-to-space uplinks? Easy. Managing telemetry streams? A piece of cake. I've handled thousands of packets flowing through our gateway without breaking a sweat. But today something weird showed up in our monitoring system. The ops team flagged some unusual behavior in the command stream, and now they're handing me this massive PCAP file. I mean, there's like over a thousand packets in here - tons of normal telemetry, telecommands, and a bunch of background noise from other subsystems. flag format: flag{} Infrastructure - Downloadable File Provided Files - spaced.zip (38.9 KB)
The Forest
SCENARIO A legacy file-transfer server has been running quietly on the network for years. Nothing about it looks unusual. The traffic it generates follows standard protocol, the commands are formatted correctly, and the exchanges complete without errors. During routine monitoring, this packet capture was collected. At first glance, it is exactly what you would expect from a file-transfer system doing its job. But someone with a reason to look closer flagged it for review. Your job is to go through the capture, understand what the system is doing at the protocol level, and figure out whether something is being communicated that was never meant to be visible. The answer is in the traffic. You just have to know what to look for. Flag format: flag{} Infrastructure - Downloadable File Provided Files - The_Forest (54.9 KB)
Total
SCENARIO A beginner developer built a simple color palette generator. Visit the page, pick a background color, pick a text color, and watch the interface update. There are no user accounts, no file uploads, no database queries, and no complex business logic. Just colors. The developer is confident that an application this simple could not possibly have any serious security issues worth worrying about. You have full access to the source code. The application itself is minimal, and most of what it does is straightforward. But simplicity in application logic does not always mean simplicity in attack surface. Before you focus on what the code does, take a close look at what it is built on. The choice of framework and the specific version in use tells a story of its own. Read the dependencies, do your research, and figure out how a color palette generator ends up being more dangerous than it looks. Flag format: flag{} Infrastructure - Docker Container — HTTP on port 8000 Provided Files - total.zip (6.7 KB)
VirtualEscape
SCENARIO You've been granted access to a web application that renders custom templates. It looks simple. The developers were careful they read the right articles and put protections in place. They were almost right. Somewhere between what the application accepts and what it ultimately executes, there is a gap. Not in a library, not in the server but in the developer's mental model of their own defenses. Trace the journey your input takes from entry to output. Somewhere along that path, the rules break down. The flag is on the server. The key is hiding in plain sight. Flag format: flag{} Infrastructure - Docker Container — HTTP on port 3000 Provided Files - virtualescape-2069.zip (4.8 KB)
Lost in traffic
We have determined that we are currently under attack. By collecting and analyzing data from multiple sources, we identified that the attacker is consistently using RC4 encryption. This information may assist you in your investigation. Your task is to analyze the network traffic and determine whether the attacker wrote any data to disk, including identifying the secret file name and its contents. Flag{content_writen|file_name|file_content}
Universal Bus
SCENARIO This morning, someone left something behind on one of the seats. A small flash drive, unmarked, sitting right where the new IT contractor usually sits. Someone from facilities found it, figured it belonged to IT, and helpfully plugged it into an office workstation to check what was on it. Just trying to return it to its owner, right? By lunch, the SOC dashboard lights up. Nothing dramatic — just a few anomalies buried under thousands of routine log entries. A file copied to an odd location. A process spawning from a temp directory. An outbound connection to an IP nobody recognizes. Most analysts would scroll right past it. But you are not most analysts. Something rode that Universal Bus into your network, and now it is your job to figure out what. Flag format: FLAG{} Infrastructure - Docker Container — HTTP on port 5000 Provided Files - No External Files Provided
RawAsICan
S C E N A R I O A Linux machine is exposed with limited initial access. At first glance, the system appears minimal and does not reveal obvious misconfigurations or sensitive data. However, deeper inspection shows that core system components may not be up to date. One critical component, responsible for privilege management, is running an outdated version. This introduces potential risks related to privilege escalation vulnerabilities that could allow an attacker to gain full control of the system. The environment is intentionally simple, but subtle weaknesses may lead to complete compromise if properly identified and leveraged. O B J E C T I V E Perform system enumeration to identify outdated or vulnerable components. Analyze the system for known privilege escalation vectors and leverage them to gain elevated access. Once full privileges are obtained, retrieve the flag. Infrastructure Web Terminal Provided Files Remote machine access Flag Format Flag{}