Browse Scenarios

Explore 200+ hands-on cybersecurity challenges built around real-world scenarios and skills.

Showing 49–60 of 100 scenarios

MalMusic

HardMalware Reverse Engineering

A suspicious audio file was reported after a user executed a seemingly harmless command from a browser prompt. Shortly after, abnormal system activity and outbound connections were observed. Your task is to analyze the provided artifact and determine what data was ultimately exfiltrated during execution. Flag format: flag{(c2_ip_address)}

DecompilerStatic AnalysisDynamic AnalysisObfuscationC2 Communication

ILoveBigCats

MediumMobile Security

An Android application and a companion data file were recovered during an investigation. The app appears to rely on a custom client-side framework and contains heavily obfuscated frontend logic responsible for processing user input in a non-standard format. Your task is to unpack the application, understand how its internal logic transforms input data, and analyze the relationship between the app’s runtime behavior and the provided encoded artifact. Careful inspection of the bundled JavaScript and reverse engineering of the transformation logic will be required to recover the original information.

Apk AnalysisReverse EngineeringObfuscationNative LibraryAndroid

gg

EasyMalware Reverse Engineering

A suspicious binary and an accompanying audio file were recovered during a forensic investigation. The executable appears to process data in a non-standard way and produces an output that is not immediately human-readable. Your task is to analyze how the binary generates or interacts with the audio artifact and determine what information was encoded into it. This will require reverse engineering the executable to understand its use of external libraries, followed by extracting the hidden data embedded within the resulting signal.

AssemblyIda ProDisassemblerStatic AnalysisSteganography

Ducky

MediumDigital Forensics

A USB device was plugged into a workstation after being found unattended. Shortly after, abnormal system activity was observed, suggesting that the device emulated user input rather than acting as a standard storage medium. Your task is to analyze a USB capture of the session and reconstruct what was executed on the machine. The evidence is embedded in low-level USB HID communication, where keyboard events were transmitted as raw input data. By interpreting this interaction, you can recover the sequence of actions performed and identify the external endpoint involved in the attack chain. Flag format: flag{*******.******.**}

Network ForensicsPacket CaptureWiresharkUsb Device HistoryOs Artifacts

Bulk Dumper

EasyDigital Forensics

A USB capture was collected from a workstation after a suspected data theft incident. The traffic contains a large volume of bulk transfer operations, suggesting that a file was moved directly through a connected device rather than standard file sharing methods. Your task is to analyze the capture, understand how the transferred data is structured across packets, and recover the original file from the raw communication stream. Careful inspection of packet contents and reconstruction of the transferred payload will be required to retrieve the missing artifact.

File CarvingNetwork ForensicsPacket CaptureWiresharkData RecoveryUsb Device HistoryDead Box Forensics

Acrobatics

EasyDigital Forensics

This PDF file was sent through a phishing email, and the machine was hacked. Extract the shellcode from it and obtain its MD5 hash. It was opened with Adobe Acrobat Reader DC 2020.013.20074. flag format: flag{shellcode_md5_hash}

Malware AnalysisShellcodeObfuscationCryptorUnpackingStatic Analysis

UnsecureStorage

EasySecure Coding

Visit /challenge/ to access a machine containing the source code of an application located in the src directory. Your task is to fix the code to retrieve the flag. Make sure to read the rules before you begin.

Prototype PollutionInput ValidationSanitizationDefensive ProgrammingSecure By Design

Traversal

MediumWeb Security

SCENARIO A note-taking app with a personal touch. Pick a thumbnail, write your thoughts, and keep everything secure behind JWT-authenticated sessions. The developer put real thought into the authentication system and is confident your notes stay private. You have full access to the source code. There is more than one vulnerability here, and none of them are enough on their own. Read carefully, connect the dots, and chain what you find. Flag format: flag{} Infrastructure - Docker Container — HTTP on port 5000 Provided Files - Traversal.zip (1.0 MB)

Sql InjectionJwtBroken Access ControlDirectory TraversalOwasp Top 10

SecureStorage

EasyWeb Security

SCENARIO A file storage system that hashes your filenames, locks down your storage, and makes bold promises about keeping users within their boundaries. The developer was even generous enough to throw in some extra features to make things convenient. You have full access to the source code. Read through how the application handles files and objects, understand how JavaScript resolves properties, and find a way to step outside the boundaries the developer was so confident about. Flag format: flag{} Infrastructure - Docker Container — HTTP on port 8000 Provided Files - SecureStorage.zip (3.0 KB)

Prototype PollutionDirectory TraversalBroken Access ControlJavascriptServer Misconfiguration

promise

EasyMalware Reverse Engineering

A Node.js project was recently deployed as part of an internal development workflow. Shortly after execution, unusual outbound traffic and unexpected system behavior were reported. Your task is to review the project, understand how it behaves at runtime, and determine what data was ultimately sent outside the environment. flag format: flag{discord_webhook_id}

Malware AnalysisC2 CommunicationApi CallsBehavioral AnalysisSpyware

Pear

EasyWeb Security

SCENARIO A developer built a PHP application with a file inclusion feature and decided to lock it down themselves. Common wrappers blocked, file uploads disabled, error display turned off. They are convinced there is nothing left to exploit. You have full access to the source code. Read through what the developer blocked, think about what they missed, and find your way to the flag. Flag format: flag{} Infrastructure - Docker Container — HTTP on port 80 Provided Files - pear.zip (1.8 KB)

LfiRcePhpWebshellInput Validation

Ninja

MediumWeb Security

SCENARIO SecureCorp just shipped a new internal portal complete with a user activity dashboard and an admin reporting system. The development team is proud of their work and confident in their security posture. Their reasoning? They use Jinja2 for templating, and Jinja2 handles XSS automatically. Nothing to worry about. You have full access to the source code. Look closely at how the application decides which template to render, and ask yourself whether the team's confidence is actually warranted. Flag format: flag{} Infrastructure - Docker Container — HTTP on port 5000 Provided Files - Ninja.zip (116.3 KB)

XssSstiInput ValidationBroken Access ControlPython