Browse Scenarios
Explore 200+ hands-on cybersecurity challenges built around real-world scenarios and skills.
Showing 25–36 of 100 scenarios
Uzumaki
A Python-based ransomware sample is provided alongside captured network traffic from its operation. At first glance, the execution flow is fragmented across dynamically reconstructed components, with critical logic distributed between runtime memory assembly and external HTTP responses. Your task is to analyze how the program reconstructs its execution environment and how network-delivered fragments contribute to its final behavior. The challenge focuses on understanding deterministic reordering, bytecode execution in memory, and correlating network captures with runtime reconstruction to recover the original payload. flag format: flag{}
Big The bank
S C E N A R I O A forensic image of a bank administrator's mobile device has been acquired, but the most critical data appears to be locked behind a custom encryption layer. The application, com.example.bigthebank , uses a non-standard storage mechanism: instead of relying solely on the Android Keystore, it programmatically encrypts its Shared Preferences into a file with a .esh extension. Initial analysis shows that while the encryption routine is complex—involving multiple rounds of hashing and iterative AES transformations—the underlying key derivation logic relies on a small, predictable seed. Your mission is to reverse-engineer the APK, identify the flaws in the "15-round" encryption algorithm, and develop a decryption tool to recover the administrator's plain-text credentials. O B J E C T I V E Decompile the provided APK using jadx-gui to map out the shared_preferences_handler logic. Identify how the encryption key is derived from a 3-byte hash seed. Use the provided .ab backup and the .esh file to brute-force the initial key state, reverse the 15 rounds of encryption, and extract the username and password from the resulting XML. Infrastructure Downloadable archive Provided Files bigthebank.tar.gz (contains backup.ab and com.example.bigthebank.apk ) Flag Format Flag{username:password}
Camarin
S C E N A R I O A mobile application built using Xamarin is deployed as a “secure offline token checker.” The app is distributed as an Android APK and contains multiple .NET assemblies inside its package. Users are required to input a token, which is validated locally within the application. The validation logic is heavily obfuscated but ultimately relies on multiple cryptographic checks, string transformations, and MD5 comparisons. The core security logic is implemented inside a Xamarin DLL, making it a strong candidate for reverse engineering. However, the token validation process contains weaknesses in its design, including predictable transformations, MD5 hash checks, and reversible AES encryption, allowing the full token to be reconstructed through static analysis. O B J E C T I V E Reverse engineer the Xamarin Android application, analyze the embedded .NET assemblies, and reconstruct a valid token by bypassing or reversing all validation functions. Extract the final token that satisfies all MD5, AES, and structural constraints to retrieve the flag. Provided Files camarin.tar.gz Infrastructure Downloadable archive Flag Format Flag{...}
DesAdmin
S C E N A R I O Welcome to E-commerce , a newly launched online shopping platform built rapidly to meet high demand. The application includes basic authentication and a user profile system. User identity is managed using a client-side cookie that stores serialized PHP objects, which are Base64 encoded before being sent to the browser. However, the application directly trusts and unserializes this cookie without proper validation, making it vulnerable to insecure deserialization. This allows attackers to manipulate object properties and escalate privileges by crafting malicious serialized payloads. O B J E C T I V E Analyze the application’s cookie handling mechanism and exploit insecure PHP object deserialization to impersonate an administrator account. Modify the serialized object structure to escalate privileges and retrieve the flag. Infrastructure Web Application (PHP) Provided Files None (black-box testing) Tools Required Web Browser, Burp Suite, Local PHP CLI Flag Format Flag{...}
Escape_202
S C E N A R I O A lightweight web service has been deployed to help administrators search for files across the server. The application provides a simple interface where users can submit a filename and retrieve matching results from the underlying system. For transparency, the source code of the service is also available for review. While the functionality appears straightforward, the service interacts directly with the system environment to perform its operations. Somewhere on the server, a sensitive file exists following a specific naming pattern. Your task is to explore the application’s behavior and determine whether its implementation properly enforces input handling. O B J E C T I V E Analyze the application and retrieve the contents of the hidden flag file. Infrastructure Web Application (HTTP) Provided Files source code via web interface Flag Format FLAG{...}
Help me
S C E N A R I O A Linux workstation used for database administration contains evidence of prior command-line activity. The system administrator previously interacted with a local MySQL service, but authentication details are no longer documented. However, operational shell usage may still contain residual traces of sensitive inputs. Your task is to analyze local user environment artifacts and determine whether any sensitive credentials can be recovered. O B J E C T I V E Investigate the system environment and identify previously used database credentials in order to access the MySQL service and retrieve the flag. Infrastructure Web Terminal Provided files direct access to the filesystem via web Flag Format Flag{...}
Iam here
S C E N A R I O A Linux environment has been populated with a large number of files as part of a simulated intrusion scenario. Among these artifacts, a single executable file contains relevant investigative data. The file is intentionally indistinguishable at first glance and can only be identified through structured filtering based on known metadata attributes. Your task is to investigate the system and isolate the relevant file. O B J E C T I V E Identify the target executable file using its known metadata properties and retrieve the flag contained within it. Infrastructure Web Terminal Provided Files challenge.md via web interface Flag Format Flag{...}
just_add
we just add so add as superman. Flag Format : Flag{}
pay_to_convert
S C E N A R I O A web-based SVG-to-PNG conversion service is under development and includes a payment gate before allowing image processing. The application incorrectly trusts client-side parameters during registration and uses a vulnerable SVG rendering library for file conversion. Due to insecure trust in frontend-controlled subscription values and a vulnerable SVG parsing engine, the system may allow bypass of payment restrictions and local file access through crafted SVG payloads. The service also hints that sensitive files are accessible on the server, including /flag.txt . O B J E C T I V E Analyze the application flow, bypass payment restrictions, identify the vulnerable SVG processing component, and exploit local file access to retrieve the flag from /flag.txt . Infrastructure Web Application (SVG Processing Service) Provided Files None (black-box testing) Flag Format Flag{}
PBatch
S C E N A R I O A Node.js application built with Express and Sequelize provides a product listing feature with search and filtering capabilities. Users can query products using search keywords and filter by seller. The application uses dynamic query construction with Sequelize operators and literal SQL fragments. The system relies on an older component configuration and unsafe query composition patterns that may introduce risks in how user input is processed inside database queries. In particular, certain query structures combined with replacements and logical operators can lead to unintended query behavior affecting data visibility. The challenge requires reviewing the source code and patching insecure query construction without upgrading dependencies, as external updates are restricted by the challenge rules. O B J E C T I V E Analyze the Express + Sequelize product query logic, identify unsafe query composition patterns, and fix the implementation to prevent SQL injection or logical query manipulation while preserving functionality. After securing the application, retrieve the flag from /flag . Flag Format: Flag{} Infrastructure Node.js / Express Application using Sequelize ORM Provided Files Express application source code via Web Flag Format Flag{}
PHP series 4
S C E N A R I O A PHP-based admin authentication system validates access using an MD5 hash combined with a static salt. The application checks whether the hash of a user-supplied token matches one of several precomputed values. However, the validation relies on loose comparison behavior, which may introduce unexpected weaknesses in how hashes are evaluated. Additionally, the application exposes its source code through a dedicated endpoint, giving insight into its internal logic. O B J E C T I V E Analyze the authentication mechanism, identify weaknesses in the validation logic, and gain admin access to retrieve the flag. Infrastructure PHP Web Application Provided Files Delivered via web interface Flag Format Flag{}
Signcraft
A Minecraft world save is provided containing a large and complex in-game environment. At first glance, it appears to be a standard world archive with typical region, entity, and player data structures, but additional inspection suggests intentionally placed in-world artifacts. Your task is to analyze the world data and systematically search through its spatial structure to locate hidden elements embedded within the environment. The challenge focuses on navigating hierarchical world formats, interpreting coordinate-based data, and extracting meaningful information distributed across a large area. The game is NOT required flag format: flag{}