WEBآلة حيّةمجانية
تحدٍّ
Cipher Lounge
A members-only club with a rushed launch left its staging build exposed. Get off the floor, past the velvet rope, and into the keeper's vault.
متوسط200 نقطة 15 د
الغرف
دروس موجّهة وتحديات تطبيقية على أجهزة حقيقية. اقرأ وتدرّب وأجب واكسب النقاط.
الفئة
الصعوبة
الوصول
الجهاز
النوع
مختارة
غرف جديدة
Penetration Testingآلة حيّةبريميوم
درس وتحدٍّ
Launch Day — غرفة مميّزة (Premium)
A full boot-to-root against a startup's rushed deploy: a command-injection web foothold, a reused DB password that is also the ops SSH password (lateral move), and a writable root job for the final escalation. Multi-stage, per-instance secrets.
صعب450 نقطة 75 د
Linux Privilege Escalationآلة حيّةمجانية
درس وتحدٍّ
Root of the Problem
You're handed a low-privilege SSH foothold. Enumerate the box, find a world-writable script that a root maintenance job executes on a schedule, hijack it, and escalate to real in-container root to read the flag.
متوسط225 نقطة 40 د
Cloudآلة حيّةبريميوم
درس وتحدٍّ
The Leaky Tenant — غرفة مميّزة (Premium)
A startup's public CDN bucket is a little too public. Enumerate it anonymously, find a backup export that leaks over-privileged access keys, and use them to reach a restricted vault bucket and its flag — all against a real, self-contained S3-compatible store.
متوسط275 نقطة 40 د
Cryptographyآلة حيّةبريميوم
درس وتحدٍّ
The Padded Room — غرفة مميّزة (Premium)
A perfect cipher, broken by one leaked bit. Use an AES-CBC padding oracle to recover a block's intermediate value and forge an 'admin' token (CBC-R) — no key required — then open the vault and read the flag.
متوسط300 نقطة 60 د
كل الغرف
25 غرفة
Penetration Testingآلة حيّةبريميوم
درس وتحدٍّ
Launch Day — غرفة مميّزة (Premium)
A full boot-to-root against a startup's rushed deploy: a command-injection web foothold, a reused DB password that is also the ops SSH password (lateral move), and a writable root job for the final escalation. Multi-stage, per-instance secrets.
صعب450 نقطة 75 د
Linux Privilege Escalationآلة حيّةمجانية
درس وتحدٍّ
Root of the Problem
You're handed a low-privilege SSH foothold. Enumerate the box, find a world-writable script that a root maintenance job executes on a schedule, hijack it, and escalate to real in-container root to read the flag.
متوسط225 نقطة 40 د
Cloudآلة حيّةبريميوم
درس وتحدٍّ
The Leaky Tenant — غرفة مميّزة (Premium)
A startup's public CDN bucket is a little too public. Enumerate it anonymously, find a backup export that leaks over-privileged access keys, and use them to reach a restricted vault bucket and its flag — all against a real, self-contained S3-compatible store.
متوسط275 نقطة 40 د
Cryptographyآلة حيّةبريميوم
درس وتحدٍّ
The Padded Room — غرفة مميّزة (Premium)
A perfect cipher, broken by one leaked bit. Use an AES-CBC padding oracle to recover a block's intermediate value and forge an 'admin' token (CBC-R) — no key required — then open the vault and read the flag.
متوسط300 نقطة 60 د
Binary Exploitationآلة حيّةمجانية
درس وتحدٍّ
Ghost in the Stack
A step up from ret2win: there is no win() function. Use a libc pointer the service leaks to defeat ASLR, then build a ret2libc ROP chain (pop rdi; /bin/sh; system) to pop a shell and read the flag. The binary and its libc are provided.
متوسط275 نقطة 60 د
Binary Exploitationآلة حيّةمجانية
درس وتحدٍّ
Return to Sender
The classic first step into binary exploitation: overflow a stack buffer on a tiny TCP service and overwrite the saved return address to call a win() function that prints the flag. The binary is yours to analyse.
سهل150 نقطة 45 د
OSINT & Reconnaissanceآلة حيّةمجانية
درس وتحدٍّ
The Vanishing Intern
A summer intern left NimbusForge Robotics — and left a few things running. Pivot across the company site, the intern's profile, and a photo's metadata to find a service they forgot to switch off.
متوسط250 نقطة 45 د
Networkingمجانية
درس وتحدٍّ
Crossed Wires
A workstation on the finance VLAN uploaded something it shouldn't have. You have the capture. Reassemble the TCP stream, pull the exfiltrated object back off the wire, and read what left the building.
متوسط225 نقطة 40 د
Forensicsمجانية
درس وتحدٍّ
The Last Login
A public web host fired an alert for a rogue root cron job. Work a real triage archive — auth logs, shell history, cron drop-ins, SSH keys — rebuild the intrusion timeline, and recover the token the attacker's persistence left behind.
متوسط150 نقطة 40 د
Steganographyمجانية
تحدٍّ
The Polyglot
A staff ID badge image hides more than it shows. Learn to spot a polyglot file, carve the archive appended to an innocent-looking PNG, and decode what's inside.
سهل125 نقطة 20 د
Miscآلة حيّةمجانية
درس وتحدٍّ
Jail Break-in
A sandbox that runs your Python — as long as it can't tell what you're really doing.
متوسط280 نقطة 35 د
Forensicsآلة حيّةمجانية
درس وتحدٍّ
Silent Witness
A quiet web host that started whispering to a stranger — listen to what it left behind.
متوسط250 نقطة 35 د
WEBآلة حيّةمجانية
درس وتحدٍّ
GraphQL Labyrinth
A SecOps GraphQL API that maps itself for you — then trusts the wrong resolver.
متوسط220 نقطة 30 د
WEBآلة حيّةبريميوم
درس وتحدٍّ
Template Trap — غرفة مميّزة (Premium)
A quarterly-report studio with one field too clever — and a firewall that only watches the front door.
صعب350 نقطة 40 د
WEBآلة حيّةبريميوم
درس وتحدٍّ
Deserialized Dreams — غرفة مميّزة (Premium)
A dreamy little journaling app with one URL too many — follow the loopback into its unguarded inner life.
صعب400 نقطة 45 د
WEBآلة حيّةمجانية
درس وتحدٍّ
WEBآلة حيّةمجانية
درس وتحدٍّ
Broken Ledger
invoice holds an internal reconciliation token you were never meant to see.
سهل150 نقطة 20 د
Forensicsآلة حيّةمجانية
تحدٍّ
Memory of a Ghost
The SOC flagged this Linux host after anomalous outbound traffic and pulled it offline for you.
متوسط250 نقطة 30 د
Reverse Engineeringبريميوم
تحدٍّ
VM Whisperer — غرفة مميّزة (Premium)
The flag check doesn't run on your CPU — it runs on a tiny virtual machine hidden inside this binary, executing its own bytecode. Decode the machine's instruction set, lift its program, and make it whisper.
صعب550 نقطة 75 د
Reverse Engineeringبريميوم
تحدٍّ
License to Krackle — غرفة مميّزة (Premium)
"Krackle Synth v3.1" is nagware — it wants a license key before it hands over your reward. There's exactly one serial it will accept, and it's hiding in plain sight inside the binary. Don't just patch the check; it won't be enough.
متوسط300 نقطة 35 د
Networkingبريميوم
تحدٍّ
Exfil Over DNS — غرفة مميّزة (Premium)
Our EDR flagged strange DNS from a workstation and grabbed a capture. Something is sneaking data out over the one protocol nobody blocks. Follow the queries and rebuild what left the network.
متوسط275 نقطة 25 د
Steganographyمجانية
تحدٍّ
Spectrogram Secrets
We intercepted a transmission. Played back it's just hiss — but the sender didn't hide the message in what you hear. Look at it the right way.
سهل100 نقطة 10 د
Forensicsمجانية
تحدٍّ
Deleted Diaries
A thumb drive from case 4471. The owner insists it was wiped — but the last diary entry, which hides a deposit-box combination, was only deleted. Recover what was thrown away.
سهل100 نقطة 20 د
Cryptographyمجانية
تحدٍّ
XOR Café
An intercepted log from the XOR Café, where every secret is "protected" with the same short roast, poured again and again. One regular left a tip under the saucer. message.enc holds the hex ciphertext — recover the plaintext and read what they left behind.
سهل75 نقطة 15 د