Sambal

This challenge focuses on Windows digital forensics and incident response. Participants analyze Security, System, and Task Scheduler event logs to identify attacker activity, trace a persistence mechanism involving scheduled tasks and services, correlate user activity with logon sessions, and reconstruct the attack timeline.

This challenge focuses on network forensic analysis and investigating data exfiltration. Participants will use Wireshark to inspect a packet capture file, filter for HTTP traffic, and export transferred HTTP objects. The objective is to safely extract and analyze exfiltrated PDF documents to uncover a hidden flag.

This challenge provides a guided walkthrough of disk forensics and image analysis using Autopsy. Participants must load the forensic disk image, analyze web server logs to uncover malicious encoded payloads, identify anti-forensic techniques such as file extension mismatches, and perform file carving to recover deleted files.

As a cryptographic engineer at BrownLine IT Tech Solutions in Atlanta, your mission is to crack a vulnerable password-based authentication system created by a colleague. Use your skills to break the code, log in, and capture the flag.

This challenge focuses on web and service exploitation using various tools to identify and exploit vulnerabilities. You will enhance network scanning skills to gather critical target information and apply SSH cracking techniques to uncover and exploit weaknesses. The exercise emphasizes essential penetration testing methods, including credential brute-forcing and service misconfiguration analysis.

This challenge involves scanning and enumerating a ChatOps web app to find flaws. Intercept WebSocket traffic with Burp Suite, modify JSON payloads, and exploit a weak password reset to take over a supervisor account. Log in with elevated access and retrieve the flag.

This challenge involves cryptography and a creative Linux privilege escalation path. Participants must first decrypt a Vigenère cipher found on a web page to obtain SSH credentials for initial access. Privilege escalation is then achieved by exploiting a combination of sudo permissions for the reboot command and a user-writable systemd service file to trigger a reverse shell upon reboot.

This challenge involves decoding a Base64 string from a WordPress site to get a hint, then exploiting a Local File Inclusion (LFI) vulnerability in a plugin to read a password file. After gaining initial access, participants escalate privileges by cracking the root password hash found using John the Ripper.