Misconfigured cloud services simulation: open S3-like storage, exposed metadata endpoints, overprivileged IAM policies, and SSRF to IMDS attacks.
Reverse Engineering - Basic
rev
medium
Crackme binaries, obfuscated scripts, and packed executables. Students must reverse engineer to find hidden flags using static/dynamic analysis.
OSINT - Open Source Intelligence
osint
easy
OSINT challenges with planted digital breadcrumbs: fake social profiles, metadata-rich images, DNS records, WHOIS data, and document metadata to trace.
Web Exploitation - Basic
web
easy
DVWA, WebGoat, and custom SQLi/XSS challenges. Includes Apache, PHP, MySQL stack with intentionally vulnerable web apps.
Binary Exploitation - Basic
pwn
medium
Buffer overflow, format string, and ROP chain challenges. Includes pre-compiled vulnerable binaries with various protections disabled.
Web Exploitation - Advanced
web
hard
Multi-stage web challenges: SSRF, SSTI, deserialization, JWT abuse, OAuth bypass. Node.js + Python Flask apps with chained vulnerabilities.