Browse Scenarios
Explore 200+ hands-on cybersecurity challenges built around real-world scenarios and skills.
Showing 37–48 of 100 scenarios
RunMy
S C E N A R I O A Linux server has been deployed with a backup mechanism that can be executed with elevated privileges. The system appears to be properly configured at first glance, but subtle misconfigurations in how commands are executed may introduce security risks. Your goal is to assess the system, understand how privileged operations are handled, and determine whether it is possible to escalate privileges to root. O B J E C T I V E Enumerate the machine, analyze the privileged execution flow, and identify a way to gain root access. Infrastructure Linux Machine Infrastructure None (black-box testing) Flag Format Flag{}
SeCure lopp
S C E N A R I O A web application serves a blog platform where users can browse and search posts dynamically using JavaScript. While most user inputs are sanitized using DOMPurify, the application still relies on global browser objects to control certain UI behavior. The rendering logic introduces a dependency on a global variable ( window.defualt_rate ) to determine how UI elements are displayed. Under specific conditions, the browser’s DOM behavior may allow unexpected object substitution, leading to manipulation of client-side logic. O B J E C T I V E Analyze the frontend JavaScript, identify how global object resolution affects rendering logic, and determine how this behavior can be abused to influence DOM rendering flow and achieve script execution. Infrastructure Flask Web Application (Frontend-heavy) Provided Files secure_lopp.zip Flag Format Flag{}
Secureh
S C E N A R I O A PHP web application implements a simple internal routing mechanism that relies on HTTP headers to determine whether a request is allowed to access an internal service. The application attempts to restrict access by validating custom forwarded headers and enforcing domain suffix checks combined with hostname and port validation. However, due to insecure logic in header handling and weak SSRF protections, the system may allow attackers to manipulate forwarded values and bypass intended restrictions. O B J E C T I V E Analyze the PHP source code and identify weaknesses in the SSRF protection logic. Exploit improper validation of forwarded headers and hostname resolution to bypass access restrictions and retrieve the internal content. Visit /challenge/ to access a machine containing the source code of an application located in the src directory. Your task is to fix the code to retrieve the flag. Make sure to read the rules before you begin. Provided Files None (black-box testing) Infrastructure PHP Web Application (Internal Service Access Control Simulation) Flag Format Flag{}
SecureZip
S C E N A R I O A Flask-based web application provides a file upload feature that accepts ZIP archives and extracts them on the server. After extraction, the contents are displayed through a dynamically generated file tree interface. However, the extraction logic does not properly handle malicious archive structures, allowing attackers to abuse filesystem features such as symbolic links. This can potentially lead to unauthorized file access and sensitive data exposure if ZIP contents are not properly validated before or after extraction. O B J E C T I V E Analyze the Flask application source code and identify weaknesses in the ZIP extraction and file handling process. Implement secure validation to prevent symbolic link exploitation and ensure safe extraction of uploaded archives while ensuring proper retrieval of the flag. Go to /challenge/ and you will have access to a machine that has the source code of an app running in preview. Fix it to get the flag.Don't forget to read the rules. Flag Format : Flag{} Infrastructure Python / Flask Web Application (ZIP File Upload & Extraction Service) Provided Files SecureZip.tar.gz Flag Format Flag{}
Updater
S C E N A R I O A Linux server hosts a Node.js application designed to check installed Composer versions using live data from an external API. The application fetches version data, filters it using user-supplied JSONPath expressions, and compares semantic versions using the semver library. The system is exposed to privileged access, and a MySQL database leak has already allowed lateral movement to a user with sudo privileges. The final Node.js script is executed with elevated permissions, making it a critical target for exploitation. However, the application uses an unsafe JSONPath evaluation library (jsonpath-plus) that allows attacker-controlled expressions to reach dangerous evaluation contexts. This creates a potential code execution vector through crafted JSONPath queries. O B J E C T I V E Exploit unsafe JSONPath evaluation in a Node.js application to achieve arbitrary code execution. Leverage the vulnerability in jsonpath-plus to execute system commands and escalate privileges by modifying system binaries (e.g., setting SUID on /bin/bash). Finally, use elevated privileges to retrieve the flag. Flag Format: Flag{} Infrastructure Web Terminal Provided Files Acess to the machine Tools Linux Terminal, Hashcat, Browser Flag Format Flag{}
Web Screen
S C E N A R I O A web service allows users to submit a URL and receive a rendered screenshot of the requested webpage. The service operates by visiting the provided URL using a headless browser and returning the result. Initial testing shows that the service is capable of accessing internal resources, suggesting potential server-side request behavior. Further inspection reveals that the browser used by the service is running an outdated version, which may expose it to known vulnerabilities. This combination of server-side URL fetching and a vulnerable browser environment creates an opportunity to move beyond simple request manipulation and potentially compromise the underlying system. O B J E C T I V E Analyze the screenshot service to identify weaknesses in how it processes user-supplied URLs. Investigate the browser environment used by the service and determine how outdated components may introduce security risks. Leverage these findings to gain deeper access to the system and retrieve the flag. Infrastructure Web Screenshot Service using Headless Browser Provided Files None (black-box testing) Flag Format Flag{}
WebZip
S C E N A R I O A web service allows users to upload ZIP archives, which are automatically extracted on the server and displayed in a file listing interface. Each extracted file is rendered with a download link. The system is intended to safely preview user-uploaded archives, but improper handling of symbolic links during extraction introduces a critical vulnerability. An attacker previously exploited this service and successfully accessed /flag.txt . Your task is to understand how this was achieved and reproduce the attack. O B J E C T I V E Analyze the ZIP upload and extraction mechanism to identify insecure handling of symbolic links. Exploit ZIP symlink behavior to achieve local file read (LFI) and retrieve the contents of /flag.txt . Infrastructure Web Application with ZIP Upload and Extraction Feature Provided Files None (Live Web Service) Tools Browser, zip CLI Flag Format Flag{}
Certified Certification
A recognized organization has provided a cryptographic request file to assert their digital identity and authenticity. You have been tasked with auditing this file to verify their claims. OBJECTIVE Inspect the provided Certificate Signing Request (CSR) file, extract its embedded metadata, and uncover the hidden attributes to retrieve the flag. Flag format: FLAG{} Infrastructure: None Provided Files: Certificate Signing Request (.csr)
Click me, heh
A target web application employs a deeply nested structure of interconnected pages with dynamic URL chains. Manual navigation is deliberately inefficient to deter standard indexing and analysis. You must systematically map and traverse this structure to locate a specific hidden artifact. OBJECTIVE Develop an automated web scraper to programmatically navigate through a series of interconnected web pages and follow dynamic URL chains to uncover the hidden flag. Flag format: FLAG{} Infrastructure: web app Provided Files: None
Easiest flag
A data file has been intercepted that contains the flag, but it is deeply buried within a massive amount of extraneous text chunks, making manual extraction nearly impossible. OBJECTIVE Utilize command-line text processing tools to scan the file, filter out the surrounding noise, and successfully extract the flag. Flag format: FLAG{} Infrastructure: None Provided Files: text file
Postman
SCENARIO A translation service built for VIP users, complete with a role-based permission system backed by JWT tokens. Guests can create messages, VIPs can translate them, and the developer is confident no one is crossing that line. You have full access to the source code. Start as a guest, read the code carefully, and find a way to access what you are not supposed to reach. Login with guest:guest Flag format: flag{} Infrastructure - Docker Container — HTTP on port 8000 Provided Files - POSTMAN.zip (6.1 KB)
Polyglot
A suspicious file was recovered during an investigation involving an unknown execution chain. Initial analysis shows that the same artifact behaves differently depending on how it is interpreted by various runtimes, each revealing only part of the overall logic. Your task is to analyze both execution paths, understand how they interact, and recover the hidden data produced across them. Flag format: flag{...}