HackerDNA CTF challenges are bite-sized, capture-the-flag puzzles covering cryptography, digital forensics, reverse engineering, web security, OSINT and steganography. Each challenge has a single flag to find, so you get fast, focused practice on one skill at a time.
New challenges are added regularly and range from beginner-friendly to genuinely hard. Sign up free to submit flags, earn XP and see how you rank against ethical hackers worldwide.
Lab
XP
Success Rate
Players
Challenge
XOR Reuse
Guess how the message starts and use it to recover the repeating XOR key.
Cryptography
Cryptography XOR Known-Plaintext Attack
Challenge
Token Trust
Grab leaked OAuth secrets and mint yourself an admin token.
Web & API Security
OAuth 2.0 API Security JWT
Challenge
Quick win
Fine Print
Change how the page renders and read the memo hidden in the CSS.
Digital Forensics & IR
CSS Media Queries Web Forensics
Challenge
Phantom Text
Reveal invisible Unicode characters hidden in an ordinary blog post.
Digital Forensics & IR
Unicode Steganography Web Forensics
Challenge
Quick win
Linux Fundamentals Practice
Navigate directories, grep and find your way to hidden files.
Security Fundamentals
Linux Command Line File System Navigation
Challenge
Shadow Cracker
Crack stolen Linux password hashes with a wordlist and recover the logins.
Cryptography
Password Cracking Linux Security John the Ripper
Challenge
Windows Password Cracker
Crack a batch of NTLM password hashes using a wordlist.
Cryptography
Password Cracking Windows Security NTLM
Challenge
Office Password Cracker
Pull the hash from a locked document and crack it offline.
Cryptography
Password Cracking Office Security Hash Extraction
Challenge
Regex Bypass to SQLi
Slip past a weak input filter and pull data with a UNION query.
Web & API Security
SQL Injection Regex Bypass Input Validation
Challenge
Git Exposed
Download the leaked repo and bring deleted files back to life.
Digital Forensics & IR
Git Version Control Source Code Analysis
Challenge
Backup Hunter
Find the backup file a careless admin left lying on the web server.
Web & API Security
Web Enumeration File Discovery Reconnaissance
Challenge
Quick win
Type Juggling Bypass
Exploit loose PHP comparison to log in without a password.
Web & API Security
Web Security PHP Type Juggling
Challenge
Quick win
Crack SHA1 Hash
Feed a hash to a wordlist and recover the password behind it.
Cryptography
Cryptography Hash Cracking Password Analysis
Challenge
Free
SQL Injection Test
Slip SQL into a login form and sign in without knowing the password.
Web & API Security
SQL Injection Web Security Database Security
Challenge
Free
Hack This Site
Unscramble the page JavaScript and find the way past the login.
Reverse Engineering & Binary Exploitation
JavaScript Deobfuscation Client-Side Security
Challenge
Quick win
HTTP Smuggling
Read the captured traffic and spot the request hiding inside another.
Digital Forensics & IR
HTTP Protocol Request Smuggling Network Forensics
Challenge
Email Header Forensics
Read the hidden mail headers and trace where the phish began.
Digital Forensics & IR
Email Forensics Header Analysis Phishing Detection
Challenge
Quick win
SSRF Validator
Trick the server into fetching internal pages its URL filter should block.
Web & API Security
SSRF Web Security URL Manipulation
Challenge
Vigenere Stego Hunt
Find the key hidden in an image, then crack a classic cipher.
Digital Forensics & IR
Cryptography Steganography Classical Ciphers
Challenge
Quick win
Simple Directory Traversal
Climb out of the web folder with ../ and read files you should not see.
Web & API Security
Directory Traversal Path Injection File System Security
Challenge
YAML Bomb
Upload a booby-trapped YAML config and make the parser run your code.
Web & API Security
YAML Deserialization PyYAML Exploitation Configuration Injection
Challenge
Quick win
WebDAV Explorer
Upload your own file to a wide open server and take over.
Web & API Security
WebDAV Exploitation File Upload Directory Traversal
Challenge
Prototype Pollution Hunter
Poison a JavaScript object prototype and grant yourself new powers.
Web & API Security
Prototype Pollution Node.js Security API Security
Challenge
Race Condition Hunter
Fire requests in parallel and spend the same money twice.
Web & API Security
Race Conditions Timing Attacks Concurrent Exploitation
Challenge
Quick win
IDOR Explorer
Change one number in the link and open files that are not yours.
Web & API Security
IDOR Parameter Manipulation Web Application Security
Challenge
Quick win
Header Hijacker
Rewrite your request headers and walk past the access check.
Web & API Security
HTTP Headers Security Bypass Web Application Security
Challenge
Quick win
Corporate Directory Hunt
Dig through hidden folders to find the admin panel.
Web & API Security
Directory Enumeration Web Reconnaissance Administrative Panel Discovery
Challenge
File Include Bypass
Slip past the filter with LFI and read what is locked away.
Web & API Security
Local File Inclusion Filter Bypass Apache Authentication
Challenge
Cookie Forge
Tamper with your session token and log in as the admin.
Web & API Security
JWT Cookie Manipulation Authentication Bypass
Challenge
Button Activator
Open DevTools, wake up the disabled button and grab the flag.
Web & API Security
JavaScript Browser DevTools DOM Manipulation
Challenge
GraphQL Gateway
Ask the API to describe itself, then query what you should not see.
Web & API Security
GraphQL API Security Schema Introspection
Challenge
DNS Tunneling Detective
Spot the covert channel in the traffic and rebuild the stolen data.
Digital Forensics & IR
Network Forensics DNS Analysis Data Exfiltration
Challenge
Caesar Shift Decoder
Shift the alphabet until the scrambled text makes sense again.
Cryptography
Cryptography Classical Ciphers Frequency Analysis
Challenge
Quick win
Registry Hijacker
Bypass the login on a container registry and take over its images.
Cloud Security
Docker Registry API Authentication Bypass Container Security
Challenge
SUID Privilege Hunter
Spot a program with extra powers and ride it up to root.
Privilege Escalation & Post-Exploitation
SUID Binaries Privilege Escalation Command Injection
Challenge
Quick win
MongoDB Injector
Slip a query operator into the login form and skip the password.
Web & API Security
NoSQL Injection MongoDB Authentication Bypass
Challenge
Redis Cache Poisoner
Inject line breaks into a note and send your own commands to the cache.
Web & API Security
CRLF Injection Redis Command Injection Cache Poisoning
Challenge
Quick win
LDAP Injector
Inject an LDAP filter and log in as the admin without a password.
Web & API Security
LDAP Injection Authentication Bypass Directory Services
Challenge
Template Injector
Break a search box and turn its template engine into a shell.
Web & API Security
Server-Side Template Injection Flask Security Jinja2 Exploitation
Challenge
IP Spoofing Admin
Make the portal think you connect from inside and get admin access.
Web & API Security
Web Security HTTP Headers IP Spoofing
Challenge
WEP Cracker
Gather enough wireless packets and let the math reveal the key.
Digital Forensics & IR
Wireless Security WEP Cracking RC4 Analysis
Challenge
Quick win
Registry Hunter
Trace how malware survives reboots on Windows and decode what it hides.
Reverse Engineering & Binary Exploitation
Digital Forensics Windows Registry Persistence Analysis
Challenge
WiFi Password Cracker
Capture the handshake and run a wordlist to crack the WiFi password.
Digital Forensics & IR
WiFi Security WPA Cracking Dictionary Attacks
Challenge
Book Cipher Challenge
Match numbers to words in a text and read the hidden message.
Cryptography
Cryptography Classical Ciphers Pattern Recognition
Challenge
Quick win
Admin Portal Breach
Dig through the page source, crack an MD5 hash, and log in as admin.
Web & API Security
Client-Side Security MD5 Cracking Source Code Analysis
Challenge
Git Secrets Hunter
Dig through old commits until a leaked secret turns up.
Digital Forensics & IR
Git Forensics Version Control Security Repository Analysis
Challenge
Corporate Backup Deserializer
Craft a pickle payload and run your code through a backup import.
Web & API Security
Python Pickle Enterprise Deserialization Corporate Backup Systems
Challenge
ZIP Cracker
Run a wordlist against a locked archive until it opens.
Cryptography
ZIP Password Cracking John the Ripper fcrackzip
Challenge
KeePass Breaker
Brute force a password vault when the usual cracking tools fall short.
Cryptography
KeePass 4.x Security Direct Brute Force Password Manager Assessment
Challenge
Template Injection
Slip code into a template and make the server run it for you.
Web & API Security
Server-Side Template Injection Jinja2 Flask Security
Challenge
PDF Password Cracker
Run a wordlist against a locked PDF until it opens.
Cryptography
PDF Security Password Cracking Dictionary Attacks
Challenge
Shell Command Scanner
Slip your own shell command into a scan tool and read the server files.
Web & API Security
Command Injection Web Security Shell Commands
Challenge
LFI Log Poison
Hide a payload in your user agent, then include the log to execute it.
Digital Forensics & IR
Local File Inclusion User-Agent Log Poisoning Remote Code Execution
Challenge
NoSQL Injection
Twist a database filter with operators to reveal hidden records.
Web & API Security
NoSQL Injection MongoDB Visibility Controls
Challenge
File Upload Bypass
Disguise a web shell as an image and run commands on the server.
Web & API Security
File Upload Web Security Bypass Techniques
Challenge
Quick win
URL Scanner
Trick a URL fetcher into handing you cloud credentials.
Cloud Security
SSRF Server-Side Request Forgery AWS Metadata
Challenge
CSRF Bank Transfer
Build a hidden form and make a victim send money for you.
Web & API Security
CSRF Cross-Site Request Forgery Session Security
Challenge
XSS Playground
Slip a script into the page and steal another user's session.
Web & API Security
XSS Cross-Site Scripting Stored XSS
Challenge
JWT Claims Manipulation
Crack the token secret, rewrite your role and expiry, then sign it again.
Web & API Security
JWT Claims Manipulation Privilege Escalation
Challenge
SQL Injection
Ask the database yes or no questions and rebuild its secrets one by one.
Web & API Security
SQL Injection Database Security Web Security
Challenge
XXE Exposed
Craft an XML entity that makes the server hand over its own files.
Web & API Security
XXE XML Security File Disclosure
Challenge
JWT Algo Confusion
Switch the token algorithm and sign it with the server's public key.
Web & API Security
JWT Algorithm Confusion RS256
Challenge
JWT Bypass
Tweak a login token so the server trusts you without a valid signature.
Web & API Security
JWT Web Security Token Authentication
Challenge
Free
Auth Bypass
Slip a SQL injection into the login form and enter without a password.
Web & API Security
SQL Injection Authentication Bypass Web Security
Challenge
Free
Ping Pwn
Slip a shell command into a ping tool and make the server run it.
Web & API Security
Command Injection Web Exploitation Service Discovery
Challenge
Free
Log Hunter
Search raw HTTP logs for the one request that gives the attacker away.
Digital Forensics & IR
Log Analysis Web Security Incident Response
Challenge
API Logic Flaw
Change one value in a request and slip past the login check of the API.
Web & API Security
API Security Logic Flaw Authentication Bypass
Challenge
Free
Path Traversal
Climb out of the web folder and read files you should never see.
Web & API Security
Path Traversal CGI Web Security
Challenge
Quick win
Flask Error
Trigger a crash and use the debug page to dig out the secret.
Web & API Security
Flask Debug Mode Python
Challenge
Quick win
Rail Fence
Undo a zigzag transposition cipher and read the scrambled message.
Cryptography
Cryptography Transposition Cipher Rail Fence
Challenge
Sonic Cipher
Pull a hidden message from the lowest bits of an audio file.
Digital Forensics & IR
Steganography Audio Analysis LSB
Challenge
Pixel Puzzler
Pull a hidden message out of the lowest bits of an image's pixels.
Digital Forensics & IR
Steganography Image Analysis LSB
Challenge
Quick win
PDF Trap
Dig through a PDF's metadata and hidden layers to find its secret.
Digital Forensics & IR
PDF Forensics File Analysis Metadata
Challenge
Quick win
Blockchain Secrets
Trace a Bitcoin transaction and decode the message stored inside it.
Digital Forensics & IR
Blockchain Analysis Bitcoin OP_RETURN
Challenge
Corporate Breach 2
Bend the file path past the filter and read what is blocked.
Web & API Security
Web Security PHP LFI
Challenge
Corporate Breach
Read a hidden file with LFI, crack the password, and log in.
Web & API Security
Web Security PHP LFI
Challenge
Quick win
DNS Exfil
Read the domain lookups in a capture and decode the stolen data.
Digital Forensics & IR
Network Analysis DNS Packet Analysis
Challenge
Crypto Cipher
Break the old-school code and read the hidden message.
Cryptography
Cryptanalysis Classical Crypto Pattern Recognition
Challenge
Session Switch
Tamper with your session and get the app to treat you as an admin.
Web & API Security
Web Security Session Management Authentication
Challenge
Snapchat Exposed
Find an open build server and make it run your commands for you.
Web & API Security
Jenkins CI/CD DevOps
Challenge
Red is Dead
Find an exposed Redis server and decode the data left inside.
Digital Forensics & IR
Network Reconnaissance Service Discovery Database Forensics
Challenge
Memory Forensics
Carve strings out of a memory dump and undo a ROT13 disguise.
Reverse Engineering & Binary Exploitation
Memory Forensics Binary Analysis Digital Forensics
Challenge
API Breaker
Decode your Base64 token, change your role, and call the API as admin.
Web & API Security
API Security Web Hacking Logic Flaws
Challenge
QR Code Quest
Decode QR codes hidden in images and pull out the secret data.
Digital Forensics & IR
QR Code Analysis Image Analysis Data Extraction
Challenge
Base64 Detective
Dig through the page source and decode the Base64 hiding in plain sight.
Web & API Security
Base64 Web Inspection Browser DevTools
Challenge
Quick win
Binary Secrets
Open the file in a hex editor and read what the bytes are hiding.
Reverse Engineering & Binary Exploitation
Binary Analysis Hex Editors Data Structures
Challenge
Get the Password
Find the hash in the page script and crack it back to a password.
Cryptography
JavaScript MD5 Rainbow Tables
Challenge
Quick win
Stego Hunt
Pull a hidden message out of an ordinary looking image file.
Digital Forensics & IR
Steganography Image Analysis Web
Challenge
Quick win
Hex Hunt
Spot the hex string in the page code and decode it into the flag.
Web & API Security
JavaScript Web Development Hexadecimal
No labs match these filters.
Clear filters
Show more
