Hacks

#70 Today Decode the stored credential Privilege Escalation & Post-Exploitation Easy ~3 min Play #69 24 Aug Find the leaked AWS key OSINT Medium ~5 min Write-up #68 23 Aug Replay the withdrawal Cryptocurrency & Blockchain Security Medium ~5 min Write-up #67 22 Aug Who got root Privilege Escalation & Post-Exploitation Medium ~5 min Write-up #66 21 Aug Read the system prompt AI Security Medium ~5 min Write-up #65 20 Aug Reverse then ROT Reverse Engineering & Binary Exploitation Easy ~3 min Write-up #64 19 Aug ELF, not data Reverse Engineering & Binary Exploitation Easy ~3 min Write-up #63 18 Aug Forge the group claim Cloud Security Hard ~7 min Write-up #62 17 Aug The webview endpoint Mobile Security Easy ~3 min Write-up #61 16 Aug Find the reentrancy bug Cryptocurrency & Blockchain Security Hard ~7 min Write-up #60 15 Aug Two layers, one flag Cryptography Easy ~3 min Write-up #59 14 Aug SSRF to the internal KV store Network & Infrastructure Hard ~10 min Write-up #58 13 Aug Open the app sandbox Mobile Security Medium ~5 min Write-up #57 12 Aug Find the SQLi probe Web & API Security Medium ~5 min Write-up #56 11 Aug Find the employer Security Fundamentals Very Easy ~2 min Write-up #55 10 Aug Decrypt the ransom note Digital Forensics & IR Medium ~5 min Write-up #54 9 Aug The token names the host Network & Infrastructure Easy ~3 min Write-up #53 8 Aug Find the tool-exec RCE sink AI Security Medium ~5 min Write-up #52 7 Aug PNG, not TXT Digital Forensics & IR Easy ~3 min Write-up #51 6 Aug Find the hidden email OSINT Very Easy ~2 min Write-up #50 5 Aug Decode the beacon label Digital Forensics & IR Easy ~3 min Write-up #49 4 Aug SSRF the cloud metadata Cloud Security Medium ~5 min Write-up #48 3 Aug Loot the instance role Cloud Security Hard ~7 min Write-up #47 2 Aug Same handle everywhere OSINT Easy ~3 min Write-up #46 1 Aug CloudTrail anomaly Cloud Security Hard ~7 min Write-up #45 31 Jul Vigenere then base64 Cryptography Medium ~5 min Write-up #44 30 Jul Read the JWT claim Mobile Security Easy ~3 min Write-up #43 29 Jul Find the hardcoded API key Mobile Security Medium ~5 min Write-up #42 28 Jul The GPG blob Cryptography Medium ~5 min Write-up #41 27 Jul Hex back to text Security Fundamentals Easy ~3 min Write-up #40 26 Jul The hidden link Security Fundamentals Very Easy ~2 min Write-up #39 25 Jul Flip the debug flag AI Security Easy ~3 min Write-up #38 24 Jul Read the shell history Privilege Escalation & Post-Exploitation Easy ~3 min Write-up #37 23 Jul Geolocate the photo OSINT Easy ~3 min Write-up #36 22 Jul Trace the port scan Network & Infrastructure Medium ~5 min Write-up #35 21 Jul Unwrap the C2 beacon Network & Infrastructure Hard ~7 min Write-up #34 20 Jul Forge the tier AI Security Medium ~5 min Write-up #33 19 Jul Extract the XOR key Reverse Engineering & Binary Exploitation Medium ~5 min Write-up #32 18 Jul The DEX header Mobile Security Medium ~5 min Write-up #31 17 Jul The hidden system prompt AI Security Easy ~3 min Write-up #30 16 Jul Unshift the letters Security Fundamentals Very Easy ~2 min Write-up #29 15 Jul Mass assign yourself admin Privilege Escalation & Post-Exploitation Easy ~3 min Write-up #28 14 Jul Pivot three hops to the vault Network & Infrastructure Hard ~10 min Write-up #27 13 Jul Dox the domain owner OSINT Medium ~5 min Write-up #26 12 Jul Spot the exfil Digital Forensics & IR Easy ~3 min Write-up #25 11 Jul Decode the calldata Cryptocurrency & Blockchain Security Hard ~7 min Write-up #24 10 Jul The none algorithm Web & API Security Medium ~5 min Write-up #23 9 Jul Find the SQL injection sink Web & API Security Easy ~3 min Write-up #22 8 Jul ZIP in disguise Digital Forensics & IR Medium ~5 min Write-up #21 7 Jul The comment leak Web & API Security Easy ~3 min Write-up #20 6 Jul One tap of base64 Reverse Engineering & Binary Exploitation Very Easy ~2 min Write-up #19 5 Jul Pay your own price Web & API Security Easy ~3 min Write-up #18 4 Jul Leak the app admin token Web & API Security Medium ~5 min Write-up #17 3 Jul Check the history Privilege Escalation & Post-Exploitation Easy ~2 min Write-up #16 2 Jul Trace the phish OSINT Easy ~2 min Write-up #15 1 Jul Find the break-in Digital Forensics & IR Easy ~2 min Write-up #14 30 Jun Two-layer classic Cryptography Easy ~1 min Write-up #13 29 Jun Unwrap the config blob Reverse Engineering & Binary Exploitation Easy ~2 min Write-up #12 28 Jun Tamper the token Web & API Security Easy ~2 min Write-up #11 27 Jun Find the RCE sink Web & API Security Easy ~1 min Write-up #10 26 Jun Pivot to the database Network & Infrastructure Medium ~2 min Write-up #9 25 Jun Find the hidden admin page Security Fundamentals Medium ~2 min Write-up #8 24 Jun Forge the admin role Privilege Escalation & Post-Exploitation Medium ~2 min Write-up #7 23 Jun Reach the internal service Web & API Security Medium ~2 min Write-up #6 22 Jun Crack the reset token Cryptography Medium ~2 min Write-up #5 21 Jun Tamper the invoice ID Web & API Security Easy ~1 min Write-up #4 20 Jun What file is this, really? Digital Forensics & IR Easy ~1 min Write-up #3 19 Jun Peel the encoding Cryptography Very Easy ~1 min Write-up #2 18 Jun Spot the leak in the page Security Fundamentals Easy ~1 min Write-up #1 17 Jun Find the database password Privilege Escalation & Post-Exploitation Easy ~1 min Write-up