Browse Scenarios

Explore 200+ hands-on cybersecurity challenges built around real-world scenarios and skills.

Showing 73–84 of 100 scenarios

Free Nitro

EasyMalware Reverse Engineering

we have a suspected malware related to discord, can you get the discord webhook id? archive password: infected flag format: flag{DISCORD_WEBHOOK_ID}

Static AnalysisMalware AnalysisPackerDecompilerC2 Communication

Freakancy

MediumCryptography

A text file is provided containing a heavily encoded message where each character has been replaced by a numeric symbol. At first glance, the structure appears irregular, but it follows consistent linguistic patterns that suggest a systematic substitution rather than random noise. Your task is to analyze the encoded data, identify how characters map to numbers, and reconstruct the original message. Solving the challenge requires combining frequency analysis with contextual language patterns and iterative refinement to recover the underlying plaintext. flag format: flag{}

Frequency AnalysisSubstitution CipherCryptanalysisCiphertextDecryption

F for electron

EasyMalware Reverse Engineering

An Electron-based desktop application is provided for analysis. At first glance, the main executable appears to contain no meaningful logic, suggesting that the actual functionality is not located in the native binary itself. Your task is to investigate how the application is structured, identify where the runtime code is stored, and extract the hidden components responsible for its behavior. The challenge focuses on understanding Electron application packaging and locating sensitive data embedded within bundled resources rather than compiled code. flag format: flag{***_****_*****_******}

Static AnalysisMalware AnalysisTriageUnpackingStrings

Darwin

EasyMalware Reverse Engineering

A Windows MSI installer contains embedded components that are executed through internal installation logic rather than traditional execution flow. At first inspection, standard extraction tools provide incomplete or misleading outputs, requiring deeper analysis of installer tables and runtime behavior. Your task is to investigate how the installer deploys its payload during execution, identify artifacts dropped during installation, and analyze the resulting binaries to understand their exported functionality. The challenge focuses on tracing installation-time behavior and extracting meaningful components from a seemingly benign setup process. DO NOT RUN THE FILE ON YOUR MACHINE, USE A VM archive password: infected flag format: flag{XX_XXXXXXXX}

Static AnalysisDynamic AnalysisPe HeaderBehavioral AnalysisUnpacking

Buffer Overflow II

EasySecure Coding

This code is not following the C Secure Coding Standard; fix the vulnerability to get the flag.

Buffer HandlingMemory SafetyBoundary CheckingDefensive ProgrammingCode Review

Buffer Overflow I

EasySecure Coding

This code is not following the C Secure Coding Standard; fix the vulnerability to get the flag. flag format: flag{***********************************}

Buffer HandlingMemory SafetyBoundary CheckingDefensive ProgrammingCode Review

It is over 8000

MediumCryptography

An intercepted communication from a dark web forum contains a cryptic message. While initially suspected to be Chinese characters, linguistic analysis indicates otherwise. The intercepted ciphertext is: 籏籕籊籐粄籝籱簼籼簼籨籌籱簺簼籼簼籨籭簺籭籨簺籽籨籉籰籉簺籷粆 OBJECTIVE Identify the extended rotation cipher applied to the Unicode character set, decrypt the ciphertext, and recover the hidden flag. Flag format: FLAG{} Infrastructure: None Provided Files: None

EncryptionCiphertextRot8000Old CipherSubstitution Cipher

Secret info

MediumNetwork Security

S C E N A R I O A network capture reveals suspicious DNS activity originating from an internal host. While normal DNS traffic is expected in such environments, certain queries appear unusually structured and repetitive. The captured traffic suggests that an attacker is using DNS requests to covertly transmit data to an external domain. The data appears to be processed through multiple stages, including compression, encryption, and encoding, before being split into chunks and embedded within DNS queries. Multiple files have been exfiltrated using this technique. However, only one file is of interest — it contains the keyword “secret” in its name, although its full name is unknown. O B J E C T I V E Analyze the provided network capture, identify the malicious DNS traffic, reconstruct the exfiltrated files, and recover the contents of the file containing “secret” in its name to obtain the flag. Infrastructure Downloadable archive Provided Files secret_info.tar.gz Flag Format Flag{}

Packet AnalysisPcapWiresharkProtocol AnalysisLayer 7 AttacksDns

Doodle

EasyDigital Forensics

A suspicious file has been discovered that appears to be more than just a standard compressed archive. Initial analysis suggests it contains specialized data structures. You must investigate the true nature of this file and extract the hidden flag. OBJECTIVE Analyze the provided .tar archive to identify it as an offline Docker image. Import the image, inspect its underlying layers and container configurations, and uncover the hidden flag. Flag format: FLAG{} Infrastructure: None Provided Files: Suspicious Archive (.tar)

Data RecoveryMetadataDocker ContainerCompressed Files

ChildGPT

EasyDigital Forensics

A supposedly hand-drawn image has been submitted for review, but there are strong suspicions that it was actually generated by an AI model. You have been tasked with investigating the image's provenance to verify its true origin. OBJECTIVE Analyze the image to identify the specific AI model used to generate it and determine the full name of the protocol used to digitally sign and verify the image. Flag format: FLAG{Model name:the full name of the protocol used to verify this image} Infrastructure: None Provided Files: image (drawing.png)

Ai ForensicsMetadataSteganalysisDigital SignatureExif Tool

Whites Only

MediumMalware Reverse Engineering

A Go-based chess application processes a partially recorded PGN file where only White’s moves are provided. The program reconstructs game state using a third-party chess library and derives a decryption key from the full move history, which is then used to unlock embedded data inside the binary. Your task is to analyze the execution flow, understand how the move sequence is transformed into a cryptographic key, and determine how the missing game state affects the final output. Solving the challenge requires combining binary analysis with chess state reconstruction and constrained move validation to recover the intended result. Flag format: flag{********_****_****}

Ida ProStatic AnalysisAssemblyDisassemblerOpcodesBrute Force

Wavy

MediumMalware Reverse Engineering

A Go-based binary generates a WAV file by encoding input text into a synthetic audio signal. The program hides its transformation logic behind stripped symbols and compiled runtime artifacts, making static analysis non-trivial at first glance. Your task is to analyze how input data is converted into audio samples and understand how the resulting waveform encodes information. The challenge requires tracing arithmetic and floating-point operations in the binary, then interpreting the generated signal to recover the original message from the provided WAV file. flag format: flag{}

Ida ProStatic AnalysisSteganographyDisassemblerMalware Analysis