CTF Practice Range
An always-open set of original challenges for learning. Each one ships with its own files, hints and a write-up you unlock after solving. Everything is synthetic — nothing targets a real system. This is a practice space, not a timed competition: there are no prizes.
A training company mirrored its staging website to a ZIP file before launch. The developers swear nothing sensitive is reachable....
The Acme portal e-mails password-reset links. A leaked debug log and part of the source code are all you have. Can you work out th...
A developer noticed a hard-coded API key and removed it in the latest commit — "problem solved". You received the repository as a...
A colleague shared a holiday photo for the newsletter. It looks harmless, but files carry more than pixels.
Investigators recovered a single blob from a suspect USB stick. The extension says .bin, but it behaves like more than one file.
The IT desk e-mailed you a code but wrapped it twice: first the old way, then the old-old way. Julius would be proud.
Two messages were XOR-encrypted with the same key stream. You know the first message — it is the standard banner: "ACCESS GRANTED...
A tiny service encrypts short secrets with textbook RSA using the small public exponent e = 3 and no padding. The modulus is 1024...
Meet "Mira", a fictional persona created for this exercise. Her exported social-media archive contains 70 posts. One of them was e...
You received an excerpt of a Linux server's file system as a tarball. One misconfigured script lets an unprivileged user escalate...
The SOC received an alert for web01. The SSH log shows a lot of noise. Build the attack timeline: who attacked, who got in, and wh...
A network tap captured a short session between an intern's workstation and an internal web server. Somebody used HTTP, not HTTPS.
A vendor "protects" its Python tool with home-made obfuscation. You have the script but not a licence key. Reverse it to get the a...
EDR flagged WS-117. You received the process list, a netstat snapshot and exported process-creation events. Find the malicious cha...
A cloud team shared some reports from an S3 bucket "temporarily". You received the bucket policy, an object listing and a CloudTra...
Your first flag. A volunteer left this note for new members, but it was encoded so it would not show up in a quick search: `Y3Nwa...
A message was scrambled in two steps: first the text was written backwards, then every letter was shifted 13 places (ROT13). Digit...