Hands-On CTF Challenges

The following message was intercepted: UF{ebg_guvegrra_vf_abg_frpher}. Decode it to find the flag. Note: the flag format is HS{...}

The following message was intercepted: UF{ebg_guvegrra_vf_abg_frpher}. Decode it to find the flag. Note: the flag format is HS{...}

The following message was intercepted: UF{ebg_guvegrra_vf_abg_frpher}. Decode it to find the flag. Note: the flag format is HS{...}

The following message was intercepted: UF{ebg_guvegrra_vf_abg_frpher}. Decode it to find the flag. Note: the flag format is HS{...}

A login form on port 80 accepts any username. The admin account was set up with a very obvious password. Find it and submit the flag found in the /admin panel.

A PCAP file has been captured from a compromised network segment. Analyze the traffic and find the plaintext credentials being transmitted. The flag is the password.

A PCAP file has been captured from a compromised network segment. Analyze the traffic and find the plaintext credentials being transmitted. The flag is the password.

A login form on port 80 accepts any username. The admin account was set up with a very obvious password. Find it and submit the flag found in the /admin panel.

A PCAP file has been captured from a compromised network segment. Analyze the traffic and find the plaintext credentials being transmitted. The flag is the password.

A login form on port 80 accepts any username. The admin account was set up with a very obvious password. Find it and submit the flag found in the /admin panel.

A login form on port 80 accepts any username. The admin account was set up with a very obvious password. Find it and submit the flag found in the /admin panel.

A PCAP file has been captured from a compromised network segment. Analyze the traffic and find the plaintext credentials being transmitted. The flag is the password.

The search function on this vulnerable app passes user input directly to a SQL query. Extract the hidden flag from the database using SQL injection.

The search function on this vulnerable app passes user input directly to a SQL query. Extract the hidden flag from the database using SQL injection.

The search function on this vulnerable app passes user input directly to a SQL query. Extract the hidden flag from the database using SQL injection.

The search function on this vulnerable app passes user input directly to a SQL query. Extract the hidden flag from the database using SQL injection.

The comment section of this blog is vulnerable to XSS. Inject a script that reads document.cookie and displays it in an alert. The flag is embedded in the admin cookie.

An image file named evidence.jpg was recovered from a suspect's computer. The flag is hidden inside. Use steganography tools to extract it.

The comment section of this blog is vulnerable to XSS. Inject a script that reads document.cookie and displays it in an alert. The flag is embedded in the admin cookie.

The comment section of this blog is vulnerable to XSS. Inject a script that reads document.cookie and displays it in an alert. The flag is embedded in the admin cookie.

An image file named evidence.jpg was recovered from a suspect's computer. The flag is hidden inside. Use steganography tools to extract it.

An image file named evidence.jpg was recovered from a suspect's computer. The flag is hidden inside. Use steganography tools to extract it.

The comment section of this blog is vulnerable to XSS. Inject a script that reads document.cookie and displays it in an alert. The flag is embedded in the admin cookie.

An image file named evidence.jpg was recovered from a suspect's computer. The flag is hidden inside. Use steganography tools to extract it.

A threat actor posted on a public forum using the handle "h0r1z0n_hax0r". Find their GitHub account, locate a repository they created in 2024, and find the flag hidden in the commit history.

A threat actor posted on a public forum using the handle "h0r1z0n_hax0r". Find their GitHub account, locate a repository they created in 2024, and find the flag hidden in the commit history.

Three hashes were recovered from a database dump. Crack them all: 5f4dcc3b5aa765d61d8327deb882cf99, 482c811da5d5b4bc6d497ffa98491e38, 21232f297a57a5a743894a0e4a801fc3

Three hashes were recovered from a database dump. Crack them all: 5f4dcc3b5aa765d61d8327deb882cf99, 482c811da5d5b4bc6d497ffa98491e38, 21232f297a57a5a743894a0e4a801fc3

A threat actor posted on a public forum using the handle "h0r1z0n_hax0r". Find their GitHub account, locate a repository they created in 2024, and find the flag hidden in the commit history.

A threat actor posted on a public forum using the handle "h0r1z0n_hax0r". Find their GitHub account, locate a repository they created in 2024, and find the flag hidden in the commit history.

Three hashes were recovered from a database dump. Crack them all: 5f4dcc3b5aa765d61d8327deb882cf99, 482c811da5d5b4bc6d497ffa98491e38, 21232f297a57a5a743894a0e4a801fc3

Three hashes were recovered from a database dump. Crack them all: 5f4dcc3b5aa765d61d8327deb882cf99, 482c811da5d5b4bc6d497ffa98491e38, 21232f297a57a5a743894a0e4a801fc3

You have a low-privilege shell on a Linux server. The kernel version is 4.4.0-21. Escalate to root and read /root/flag.txt.

You have a low-privilege shell on a Linux server. The kernel version is 4.4.0-21. Escalate to root and read /root/flag.txt.

You have a low-privilege shell on a Linux server. The kernel version is 4.4.0-21. Escalate to root and read /root/flag.txt.

You have a low-privilege shell on a Linux server. The kernel version is 4.4.0-21. Escalate to root and read /root/flag.txt.

A WPA2 handshake was captured: target.hccapx. The network name is "CyberLab-5G". Crack the passphrase using rockyou.txt. The flag is HS{passphrase}.

A WPA2 handshake was captured: target.hccapx. The network name is "CyberLab-5G". Crack the passphrase using rockyou.txt. The flag is HS{passphrase}.

A WPA2 handshake was captured: target.hccapx. The network name is "CyberLab-5G". Crack the passphrase using rockyou.txt. The flag is HS{passphrase}.

A WPA2 handshake was captured: target.hccapx. The network name is "CyberLab-5G". Crack the passphrase using rockyou.txt. The flag is HS{passphrase}.

A memory dump was captured from a suspected compromised workstation. Use Volatility to analyze it. The malware's C2 server IP is the key — format: HS{ip_address_no_dots}.

A memory dump was captured from a suspected compromised workstation. Use Volatility to analyze it. The malware's C2 server IP is the key — format: HS{ip_address_no_dots}.

A memory dump was captured from a suspected compromised workstation. Use Volatility to analyze it. The malware's C2 server IP is the key — format: HS{ip_address_no_dots}.

A memory dump was captured from a suspected compromised workstation. Use Volatility to analyze it. The malware's C2 server IP is the key — format: HS{ip_address_no_dots}.

A vulnerable C program accepts user input without bounds checking. Overflow the buffer to overwrite the return address and redirect execution to the win() function at 0x0804848b.

A vulnerable C program accepts user input without bounds checking. Overflow the buffer to overwrite the return address and redirect execution to the win() function at 0x0804848b.

A vulnerable C program accepts user input without bounds checking. Overflow the buffer to overwrite the return address and redirect execution to the win() function at 0x0804848b.

A vulnerable C program accepts user input without bounds checking. Overflow the buffer to overwrite the return address and redirect execution to the win() function at 0x0804848b.