portfolio/write_ups
indexed 361
platforms 8
last_sync 2026-07-23
Write-Ups Collection
CTF challenges & cybersecurity lab solutions — documented, reproducible, verifiable on source
Total write-ups
361entries
CyberDefenders
81
LetsDefend
75
Centri · Blue Team Labs Online
72
Platforms
8
CyberDefenders
CyberDefenders → CyberDefenders - CyberRange
CYBERDEFENDERS · 81
▾
CyberDefenders
CyberDefenders → CyberDefenders - CyberRange
Threat Intel
Trace the 3CX supply chain compromise using VirusTotal to identify malicious DLLs, evasion TTPs, malware family, and the responsible APT group
Mobile Forensics
Examine an Android image to confirm APT35 spyware disguised as a VPN, recovering its C2 domain, SMS-stealing functions, and permissions
Network Forensics
Analyze a VoIP honeypot pcap and log to uncover SIP scanning tools, dialed numbers, credentials, and RTP codec details
Windows DFIR
Examine a suspect's Windows disk image to recover browser searches, FTP servers, deleted files, Tor usage, and cracked login passwords
Mobile Forensics
Analyze an Android dump to trace a malicious APK download, decompile it, and recover exfiltration channels, encryption keys, and leaked credentials
Memory Forensics
Investigate a memory image to trace USB-borne Andromeda bot propagation, dropped payloads, C2 infrastructure, and the reactivating APT group
Memory Forensics
Analyze a memory image of a banking-malware infection to trace a malicious PDF exploit, embedded JavaScript, shellcode, and C2 connections
Memory Forensics
Analyze a memory dump infected with BlackEnergy v2 to identify the suspicious process, code injection, and the injected DLL's base address
Network Forensics
Correlate pcap and event logs to reconstruct a BlueSky ransomware attack from SQL brute force through privilege escalation, persistence, and credential dumping
Memory Forensics
Analyze a Windows memory image to enumerate browser processes, network connections, executable hashes, and PowerShell parent activity
Threat Hunting
Hunt across SIEM logs to trace a phishing-driven intrusion through execution, defense evasion, lateral movement, credential dumping, and persistence
Windows DFIR
Examine a Windows disk image to recover system build, users, file metadata, recycle bin contents, and installed browsers
Memory Forensics
Analyze a memory image to uncover a hidden unlinked process, its injected PEs, pool tags, and full path using Volatility and volshell
Memory Forensics
Analyze a memory dump of a Meterpreter infection to extract the infected PID, attacker IP, VBS script, hashes, and VAD protections
Endpoint Forensics
Analyze Chromebook and Google Takeout artifacts to reconstruct downloads, browser activity, and user location history
Malware Analysis
Dissect a malicious RTF exploiting CVE-2017-11882 to extract its obfuscated shellcode, payload URL, and download-and-execute functions
Network Forensics
Trace an SSH brute-force intrusion through PCAP and Linux logs to recover credentials and reconstruct malware installation and persistence
Malware Analysis
Reverse a malicious fake ChatGPT browser extension to expose its keylogging, cookie theft, encryption, and C2 exfiltration behavior
Windows DFIR
Investigate a Fog Ransomware infection from a phishing RAR through PowerShell execution, BYOVD privilege escalation, persistence, and encryption impact
Malware Analysis
Dissect a malicious PDF captured in PCAP to extract obfuscated JS object streams, shellcode, and CVE exploits that drop executables
Malware Analysis
Analyze a malicious LNK dropper that launches mshta-driven HTA/JS payloads, decrypt its stages, and attribute the campaign to an APT group
Threat Hunting
Hunt a password-spray-to-domain-compromise attack in Splunk, tracing RDP lateral movement, credential dumping, and Kerberos ticket abuse
Threat Intel
Analyze a MetaMask phishing kit to recover stolen seed phrases and pivot through its Telegram bot to unmask the phishing actor
Linux DFIR
Examine a compromised Linux web server disk image to determine SSH brute-force access, crack credentials, and identify attacker-created accounts
Log Analysis
Correlate honeypot auth, kernel, and Apache logs to profile SSH brute-force attackers, firewall changes, and dropped scanning tools
Network Forensics
Profile capture endpoints, DNS queries, and hosts in a PCAP to trace malware delivered via a malicious invoice email and its exfiltration
Windows DFIR
Analyze a Windows disk image via registry hives and browser artifacts to answer OS, user, and case-related questions about the suspect
Network Forensics
Analyze honeypot PCAP traffic to identify an SMB buffer-overflow exploit, decode its shellcode, and track downloaded malware
Windows DFIR
Examine a suspect Windows forensic image to confirm illegal port-scanning activity, identifying the scanner tool, timing, and open ports
Cloud Security
Investigate an AWS SSRF-to-IMDS attack via PCAP and CloudTrail logs to trace IAM credential theft, S3 exfiltration, and bucket deletion
Threat Intel
Pivot from an IcedID sample hash through VirusTotal and OSINT to map dropped payloads, hosting domains, and the responsible threat actor
Memory Forensics
Analyze a memory image of an IcedID-compromised endpoint to trace ISO delivery, malicious execution, persistence, and the payload DLL
Windows DFIR
Mount a breached web server's disk and memory image to trace SQL injection and LFI exploitation of DVWA and the attacker's rogue user creation
Linux DFIR
Examine a Kali Linux disk image to trace an insider's credential-dumping downloads, bash history, and hidden files proving lateral attacks
Mobile Forensics
Parse an iPad iOS filesystem with iLEAPP and SQLite to recover device details, browsing history, jailbreak app, and installed applications
AD / Kerberos
Hunt domain controller logs in Splunk to detect RC4 Kerberoasting, identify the compromised service account, RDP logins, and WMI persistence
OSINT
Use OSINT, GitHub leaks, and image geolocation to unmask an insider attacker's identity, leaked credentials, and physical whereabouts
Threat Intel
Pivot on a malicious MSIX installer hash in VirusTotal to profile the batloader family, dropped executables, C2 domains, and threat actor
Malware Analysis
Statically analyze a macro-laden malicious Office document with oledump and olevba to extract the base64 PowerShell dropper and its IOCs
Windows DFIR
Investigate KAPE-collected Windows artifacts to trace a malicious PyPi package install, Defender disabling, C2 traffic, and persistence
Windows DFIR
Analyze KAPE triage artifacts to reconstruct a GPO-delivered wiper attack, its staging, Defender exclusions, and boot manager destruction
Incident Response
Trace an APT29-style .rdp spear-phishing campaign through SIEM logs, covering initial access, DLL beacon, persistence, and privilege escalation
Linux DFIR
Explore a Linux gamer's disk image using bash history and SQLite artifacts to uncover Log4j exploit attempts and user activity anomalies
Memory Forensics
Analyze memory dumps with Volatility to identify a phishing-delivered RAT, its process injection, persistence, and stolen credential hashes
Memory Forensics
Use Volatility to spot a masquerading svchost process injected under explorer, extract its hidden hash, and recover alternate data stream artifacts
Network Forensics
Dissect a drive-by exploit-kit PCAP, deobfuscating malicious JavaScript to identify served CVEs, executables, and geo-targeted redirects
Malware Analysis
Deobfuscate a malicious document's macros and dropped JavaScript backdoor using oledump and olevba to reveal its decryption key and staging logic
Threat Intel
Analyze a malicious PPT dropper to identify the Stealc family, its C2 server, RC4 key, and credential-theft behavior via VirusTotal and Any.Run
Network Forensics
Investigate an insider's PCAP to recover FTP creds, DNS lookups, TLS session keys, and image EXIF metadata using Wireshark and NetworkMiner
Email / Phishing
Investigate a phishing email and its malicious URL distributing BitRAT, AsyncRAT, and CoinMiner using threat intel tools to extract IOCs
Windows DFIR
Examine a disk image to trace a fake-giveaway phishing compromise through WhatsApp artifacts, a macro-laden doc, and dropped malware
Malware Analysis
Reverse engineer the Phobos ransomware to uncover its hashing, encryption logic, C2 protocol, and process-termination and persistence functions
Network Forensics
Trace an LLMNR/NBT-NS poisoning attack in a PCAP to identify the rogue machine, compromised account, and SMB host accessed
Malware Analysis
Analyze a Kimsuky APT malicious PDF to trace embedded JavaScript, memory-permission APIs, and a multi-stage PE32 payload downloaded from C2
Network Forensics
Analyze PCAP traffic to reconstruct PsExec lateral movement, identifying the pivot hosts, auth account, service executable, and network shares used
Memory Forensics
Analyze a memory dump with Volatility 3 to identify the QBot-infected Excel process, extract the malware, and uncover its C2 communications
Malware Analysis
Dissect a weaponized WinRAR ZIP exploiting CVE-2023-38831 to decrypt multi-stage payloads, identify injected shellcode, and its download C2
Reverse Engineering
Work through binary analysis exercises extracting flags from ELF files, obfuscated JavaScript, Brainfuck, and a corrupted encrypted ZIP
Memory Forensics
Analyze a memory dump with Volatility to trace the Ramnit malware process, its executable path, C2 IP, and compilation timestamp
Threat Intel
Investigate a RedLine Stealer sample by hash using VirusTotal and ThreatFox to map its MITRE techniques, C2 IPs, YARA rule, and DLLs
Memory Forensics
Analyze a memory dump with Volatility and Redline to identify the oneetx.exe process, its injection, VPN connection, and malware family
Memory Forensics
Analyze a Windows memory dump with Volatility 3 to trace a PowerShell-launched stealer, its second-stage payload, remote share, and family
Memory Forensics
Investigate a Linux CentOS memory dump with Volatility to uncover a reverse shell, persistence backdoor, and the attacker's rootkit and key
Windows DFIR
Hunt an Active Directory intrusion in Splunk, tracing reverse-shell initial access, run-key persistence, AS-REP roasting, rogue DC creation, and data staging
Mobile Forensics
Examine a macOS Catalina disk image with mac_apt to recover Safari bookmarks, Notes, iMessage permissions, quarantine records, and steganographic secrets
Windows DFIR
Investigate a compromised bank workstation to trace a WinRAR CVE-2023-38831 exploit, second-stage payload, event-log tampering, persistence, and data staging
Windows DFIR
Analyze a disk image of a fake SysInternals download using AmCache and registry artifacts to identify the malware, its C2 domain, dropped payload, and service
Incident Response
Correlate disk images, memory dumps, and a pcap to reconstruct an RDP-borne intrusion, identify the malicious process migration, C2 IPs, and attack toolkit
Threat Hunting
Hunt BITS-job persistence in Splunk using Security and Defender logs to identify the backdoor framework, scheduled task, LOLBAS, and attacker IP
Memory Forensics
Analyze memory dumps with Volatility to uncover a TeamViewer-abusing RAT delivered via a malicious Office document, tracing C2, remote-access ID, and phishing
Mobile Forensics
Parse an Android image with ALEAPP to reconstruct a murder victim's trading app, debts, SMS, location history, and Discord meeting arrangements
Network Forensics
Analyze a pcap to trace a Tomcat compromise from port scanning and Gobuster enumeration through admin-panel brute force, reverse-shell upload, and persistence
Incident Response
Investigate a Trigona ransomware attack across file server and IT machine to trace RDP initial access, enumeration, exfiltration, lateral movement, and encryption
Linux DFIR
Investigate a compromised Linux server with Volatility and disk analysis to trace SSH brute force, an exploited service, downloaded files, and data exfiltration
Reverse Engineering
Reverse the packed ShadowSteal stealer in IDA and Ghidra to recover its mutex string, RC4 key, version, screenshot routine, and self-delete command
Network Forensics
Analyze web-server traffic to trace a SQL injection attack, identify the vulnerable script, dumped databases, discovered directory, credentials, and uploaded shell
Network Forensics
Examine a pcap to trace a PHP web-shell upload, identify the attacker's origin and user agent, the upload directory, shell port, and exfiltrated file
Network Forensics
Dissect multiple packet captures to analyze DHCP, DNS, SMB, and reverse-shell traffic, extracting flags, transaction IDs, file paths, and netcat details
Malware Analysis
Analyze two Excel 4.0 macro documents on REMnux to crack encryption, reveal hidden sheets, decode anti-analysis checks, and extract payload URLs and families
Threat Intel
Pivot a malware hash through VirusTotal to identify the Yellow Cockatoo RAT family, its dropped files, compile timestamp, and C2 server
Network Forensics
Correlate PCAP and IDS alerts with NetworkMiner and Wireshark to map a Zeus bot infection, its C2 server, and WordPress compromise
Centri · Blue Team Labs Online
Security Blue Team → Blue Team Labs Online → BTLO - Investigations
BTLO · 72
▾
Centri · Blue Team Labs Online
Security Blue Team → Blue Team Labs Online → BTLO - Investigations
Malware Analysis
Analyze two OneNote malware samples with OneNoteAnalyzer and CyberChef to extract embedded HTA scripts and download URLs for an IOC report
Windows DFIR
Mount a VHDX and build a timeline with MFTECmd and Registry Explorer to reconstruct a break-in involving anti-forensic tooling and data theft
Windows DFIR
Parse BITS jobs with BitsParser to uncover attacker persistence and file downloads such as winPEAS on a compromised Windows host
Memory Forensics
Run a Volatility 2 investigation on a Cridex-infected memory dump to find the malicious process, C2 connection, and targeted banking domains
Reverse Engineering
Perform static PE analysis of the Basilisk malware with CFFExplorer, PEiD, and BinText to enumerate imports, entry point, packing, and build time
Malware Analysis
Analyze a malicious Excel document to extract VBA-macro shellcode and parse the embedded Cobalt Strike beacon configuration and IOCs
Malware Analysis
Investigate a phishing email and its dropped keylogger malware, tracing mutex, persistence locations, and C2 communication
Security Operations
Explore Sysmon 14 FileBlockExecutable events to identify blocked malware downloads and craft configs to prevent executable drops
Network Forensics
Analyze packet captures to detect exploitation of Openfire CVE-2023-32315, tracking admin account creation, plugin upload, and reverse shell
Incident Response
Investigate web server logs and a MySQL database to trace brute-force compromise, defacement, backdoor creation, and SQL data theft
Windows DFIR
Examine a seized laptop with Autopsy and Signal decryption to determine whether a bomb threat is real, recovering encrypted messenger data
Reverse Engineering
Reverse three .NET malware samples with dnSpy and CyberChef to extract C2 addresses and identify the covenant framework behind them
Network Forensics
Analyze a PCAP to uncover DNS exfiltration and encrypted covert HTTP C2, decrypting attacker commands and identifying the C2 framework
Incident Response
Correlate a PowerShell script, PCAP, and memory dump to trace an XMRig cryptominer infection, its persistence, and cryptomining IOCs
Cloud Security
Query AWS CloudTrail and S3 access logs to reconstruct an insider's over-permissive policy abuse and bucket data retrieval
Windows DFIR
Use the dissect framework on a disk image to trace confidential data theft, USB exfiltration, and a reverse shell persistence chain
AD / Kerberos
Trace an attacker from DVWA web compromise through AD lateral movement using Splunk and PCAP, uncovering credential dumping and pass-the-ticket
Reverse Engineering
Perform static disassembly of a malicious PE in Ghidra to map entry point, imports, anti-debug checks, mutex, and the decoded payload URL
Network Forensics
Analyze network traffic to trace a webshell reverse shell and generate a JA3 fingerprint of the malware's C2 communication
Malware Analysis
Research and analyze an Oski stealer sample with PEstudio and IDA to identify its C2, downloaded files, string cipher, and exfil config
Malware Analysis
Crack a builder archive and reverse a .NET ransomware sample, mapping its encryption, persistence, YARA detection, and leak-site IOCs
Network Forensics
Identify a spoofed PDF image, extract defanged URL IOCs, and hunt HTTP beacons in access logs to map compromised network hosts
Network Forensics
Analyze a pcap to trace an sqlmap SQL injection, credential theft, SSH privilege escalation, and encoded data exfiltration
Malware Analysis
Perform dynamic analysis of a UPX-packed Discord token stealer to recover its PowerShell dropper, webhook URL, and exfil IOCs
Log Analysis
Parse IIS web logs from the command line to isolate a malicious IP, geolocate it, and quantify its scanning and access activity
Threat Intel
Correlate breach reports, adversary profiles, and malicious document IOCs to attribute a defacement and server attack to APT groups
Malware Analysis
Analyze an RTF dropper and its .NET payload heaven.exe to recover the download URL, PE metadata, and C2 IP address
Malware Analysis
Unpack and disassemble a UPX-packed sample to uncover its anti-analysis checks, dropped payload, persistence keys, and YARA hits
Incident Response
Trace ProcMon events to enumerate the commands malware used to disable Defender, clear audit policies, and wipe logs
Malware Analysis
Extract IOCs from an ELF sample using exiftool, Zone.Identifier, and hash lookups to trace its download source and botnet family
Incident Response
Review a rogue contractor's nmap and Metasploit artifacts to reconstruct scanning, exploitation, and blackmail payload delivery
Windows DFIR
Combine a memory image, security logs, and registry hive to prove an insider accessed, compressed, and exfiltrated sensitive files
Memory Forensics
Analyze a memory dump to trace a malicious package download, masqueraded executable, stolen credentials, and data exfiltration
Malware Analysis
Deobfuscate two malicious JavaScript droppers to reveal the Microsoft components, download URLs, and payloads they fetch
Windows DFIR
Timeline Windows event and Sysmon logs to reconstruct a DLL-hijack reverse shell, process injection, UAC bypass, and persistence
Memory Forensics
Analyze a memory dump to find a vulnerable KeePass version and its CVE, then recover the malicious trigger that stole credentials
Memory Forensics
Extract the viruskiller executable from a memory dump and analyze it to recover C2, hashes, PE details and registry persistence IoCs
Memory Forensics
Recover a forum password from a RAM dump, download the insider's tool, decode obfuscated PowerShell shellcode and emulate it to find the C2 IP
Windows DFIR
Trace a DLL injection into notepad.exe with Process Explorer and decode a base64 PowerShell reverse shell to identify the attacker's server IP
Windows DFIR
Hunt timestomping anti-forensics in MFT output to expose masqueraded files, post-exploitation tooling and LSASS-dumping utilities on David's imaged machine
Windows DFIR
Reconstruct a USB-borne ransomware breach using registry, shellbags and MFT artifacts to trace the disguised file, download URL and CVE exploited
Web Exploitation
Analyze Splunk SIEM logs to trace a Next.js middleware auth bypass, uploaded reverse shell and SSH lateral movement across the network
Malware Analysis
Detonate a PE32 sample under Sysmon and build detection logic by tracing its C2 domain, scheduled task, dropped bat file and persistence path
Malware Analysis
Sift a large ProcMon capture to reconstruct a ransomware incident covering fileless PowerShell, service impact, Defender tampering and encryption
Network Forensics
Investigate RITA reports and Zeek logs to expose Nano's beaconing C2, cloud infrastructure and DNS TXT tunneling used to evade detection
Malware Analysis
Analyze an LNK dropper and cracked-software binary to uncover the certutil download, sandbox-evasion imports, user-agent and C2 endpoint
Memory Forensics
Reverse-engineer BlackEnergy 2 from a memory image using malfind and ssdt to find injected code, hooked SSDT functions and the malicious rootkit driver
Malware Analysis
Dissect a malicious OneNote attachment hiding an RTLO-disguised HTA to recover the embedded payload and files it downloads to disk
Incident Response
Trace a Kimsuky-style intrusion across DC and workstation artifacts covering Sliver C2, LSASS dumping, process injection and DC lateral movement
Mobile Forensics
Unpack a malicious macOS .pkg to expose its curl download, credential and PEM-file theft, exfiltration URL and installer persistence mechanism
Malware Analysis
Carve hidden streams from two JPEG samples with jpegdump to identify an embedded c99 PHP webshell and a malware payload's C2 endpoint
Cloud Security
Investigate an AWS and AD breach by dumping leaked git keys and pivoting through Splunk to trace ASREPRoast, obfuscated commands and lateral movement
Web Exploitation
Trace a WordPress defacement through access and MySQL logs, tracking WPScan enumeration, sqlmap injection, and a malicious plugin web shell
Windows DFIR
Analyze Sysmon events and a pcap to reconstruct a PrintNightmare exploit that transfers a malicious DLL over SMB and spawns a reverse shell
Windows DFIR
Examine process-tree snapshots to spot masquerading and anomalously located system processes using Windows process genealogy
Malware Analysis
Deobfuscate a VBScript dropper to reveal its WebClient staging call, C2 URL, and PowerShell download-and-execute payload path
Cloud Security
Query CloudTrail and Azure logs in Splunk to trace a threat actor pivoting across a hybrid AWS/Azure environment to exfiltrate and deface data
Malware Analysis
Automate sample triage with the LiSa sandbox to profile an ELF binary's C2 and analyze a PCAP revealing scans and a 2021 exploit attempt
Incident Response
Use Splunk over Sysmon logs to follow a phishing-borne compromise from a malicious document through persistence to AD credential dumping
Email / Phishing
Triage a phishing email in Thunderbird and CyberChef to extract sender, attachment, embedded URL, and MITRE phishing sub-techniques
AD / Kerberos
Carve an AD snapshot from a disk image with FTK Imager and AD Explorer to enumerate OUs, user attributes, GPO policies, and LAPS settings
Network Forensics
Reconstruct an attacker's chain in Arkime as they SQL-inject a surveillance console and pull a CCTV clip from S3 via a presigned URL
Windows DFIR
Recover deleted concept-art evidence from thumbcache and iconcache databases to prove leaked plans once resided on the suspect's laptop
Network Forensics
Analyze a PCAP in Wireshark to trace router firmware exploitation, identifying the CVE, injected parameter, and reverse-shell commands
Memory Forensics
Perform Linux memory analysis with Volatility 3 to recover the victim's bash history, payloads, and SCP transfers from the attack
Malware Analysis
Dynamically analyze NG-IA.exe by emulating its C2 to extract dropped DLLs, LOLBAS execution, scheduled-task persistence, and registry keys
Windows DFIR
Investigate a disk image in Autopsy and PeStudio to trace a downloaded malicious file, its C2 protocol, persistence, and originating email
Network Forensics
Dissect a PCAP in Wireshark to collect IOCs from a trojan download, profiling the victim host and decoding stolen credentials exfiltrated over SMTP
Linux DFIR
Investigate a compromised Ubuntu corporate wiki using memory, disk, and pcap to trace a CVE exploit, webshell, and database exfiltration
Malware Analysis
Analyze malicious Excel XLM macros with oletools and LibreOffice to reveal obfuscated payload download URLs and rundll32 execution
Incident Response
Trace an ISO-delivered in-memory loader from execution artifacts through C2 beaconing, process injection, and Active Directory enumeration
Windows DFIR
Perform full triage-image DFIR to trace a drive-by PowerShell payload, shellcode C2 callback, and persistence executable
LetsDefend
LetsDefend → LetsDefend Challenge
LETSDEFEND · 71
▾
LetsDefend
LetsDefend → LetsDefend Challenge
AD / Kerberos
Parse DC and workstation Security logs and prefetch to trace an AS-REP roasting attack and the compromised account's subsequent activity
Reverse Engineering
Reverse engineer the .NET Agniane infostealer with ILSpy/dotPeek to recover its decoded hostname, anti-debug APIs, and Telegram exfil bot
Reverse Engineering
Reverse engineer the .NET AstasiaLoader that fetches a URL from a GitHub README to drop RedLine stealer and exfiltrate data to Telegram
Malware Analysis
Analyze a Windows batch script that uses bitsadmin LOLBIN to download, unzip, and execute Laplas Clipper malware from a C2 server
Network Forensics
Investigate a compromised web server by correlating pcap and auth logs to uncover HTTP, RDP, and SSH brute-force attacks and valid credentials
Network Forensics
Analyze a pcap of an Openfire chat server exploited via CVE-2023-32315 path traversal to trace admin creation and webshell plugin upload
Network Forensics
Investigate pcap and logs from a compromised water-treatment PLC to identify the exposed service, brute-force entry point, and attacker actions
Network Forensics
Trace an attacker's port scan and PJL abuse of an HP network printer in a pcap to determine exploited ports and stolen print jobs
Linux DFIR
Investigate a UAC triage image of a Confluence server exploited via CVE-2023-22527 SSTI, using access and Sysmon logs to reconstruct attacker commands
Malware Analysis
Decompile a .NET PE64 infostealer with dotPeek to uncover its anti-analysis VirusTotal checks, data-gathering commands, and Discord webhook C2
Network Forensics
Reconstruct SMTP email conversations from a pcap and extract an attachment with NetworkMiner to disclose a leaking agent's identity and meetup
Windows DFIR
Trace a malware entry point on a KAPE-acquired image by parsing Windows Live Mail and Discord cache to identify the attacker and first contact
Reverse Engineering
Reverse a Visual C++ downloader binary in IDA to recover the C2 IP, user-agent, downloaded payload, and WinHTTP request functions
Email / Phishing
Analyze a phishing email header and its EXE attachment with pestudio and VirusTotal to confirm a malicious Loki infostealer payload
Malware Analysis
Analyze a malicious Excel 4.0 XLM macro document that abuses Auto_Open and regsvr32 to fetch and execute a second-stage DLL payload
Malware Analysis
Dissect a Go-based Kuiper ransomware sample in Ghidra and IDA to recover its base64-encoded PowerShell process-killer and evasion techniques
AD / Kerberos
Trace a Golden Ticket attack against a Domain Controller by parsing Security.evtx with EvtxECmd to identify the compromised service account and lateral movement
Network Forensics
Examine a pcap to enumerate HTTP GET requests and recover the server software, OpenSSL version, and Basic Authentication credentials
Malware Analysis
Follow an IcedID infection chain from a macro-laden Word dropper through mshta and rundll32 to the installer DLL and its C2 host
Malware Analysis
Extract a PowerShell payload hidden in a PNG via Invoke-PSImage steganography, revealing embedded Mimikatz executables and their hashes
Network Forensics
Perform root-cause analysis on a Cobalt Strike infection pcap using Wireshark and NetworkMiner to trace DocuSign phishing delivery and C2 traffic
Log Analysis
Investigate web server logs to reconstruct a Nikto scan, login brute force, code injection via whoami, and attacker persistence
Reverse Engineering
Decompile a malicious Java archive with JD-GUI to analyze JNA-based shellcode injection targeting native Windows processes via kernel32
Linux DFIR
Investigate a UAC-collected Linux forensic image to identify a kernel privilege-escalation exploit run from /tmp and trace the attacker's process
Malware Analysis
Analyze a Kimsuky APT VBScript sample to map its WMI reconnaissance, antivirus enumeration, registry tampering, and C2 exfiltration functions
Linux DFIR
Examine a Linux disk image to identify a cracked-software ELF malware that uses strings and netcat to exfiltrate Chrome data to an attacker IP
Linux DFIR
Mount a Linux disk image and trace a disgruntled ex-employee's activity through bash_history, apt logs, auth.log and a hidden secret file
Memory Forensics
Examine a Linux memory dump with Volatility to recover the kernel version, a dropped PHP web shell, and the attacker's reverse-shell IP and port
Memory Forensics
Analyze a memory dump of a LockBit ransomware infection to pinpoint the malicious process, encryption extension, ransom note and registry persistence
Log Analysis
Investigate an endpoint breach through Sysmon logs in Splunk to reconstruct the reverse shell, fodhelper UAC bypass and dropped Mimikatz
Malware Analysis
Use Oletools oleobj on malicious Office documents to extract embedded C2 indicators and confirm exploitation of the CVE-2021-40444 MSHTML flaw
Malware Analysis
Analyze a packed AutoIt executable with Detect It Easy and AutoIt-Ripper to unpack the script and reveal its payload-download domain
Windows DFIR
Examine a Windows disk image to identify a malicious cookie-stuffing Chrome extension by its ID, name and attacker domain
Malware Analysis
Analyze a weaponized RTF document exploiting CVE-2017-11882 to identify the C2 server, downloaded payload and dropped aro.exe
Malware Analysis
Decode obfuscated VBA macro strings with CyberChef to reveal the payload download URL, HTTP method, user-agent and WMI persistence object
Network Forensics
Trace a web attack in a pcap through brute-force, an XXE source-code leak and LFI reading /etc/passwd to reconstruct the intrusion chain
Network Forensics
Analyze pcap traffic of a WordPress compromise to track wpscan enumeration, credential brute-forcing and RCE via a vulnerable plugin
Memory Forensics
Use Volatility 3 on a Windows memory dump to spot a masquerading lsass, identify winPEAS and crack the compromised user's NT hash with John
Windows DFIR
Parse a jump server's $MFT with MFTECmd and MFTExplorer to recover a downloaded file, its source URL via Zone Identifier and creation timestamps
Malware Analysis
Deobfuscate a comment-bloated JavaScript dropper to reconstruct its real logic and expose the WScript network and WMI objects it abuses
Reverse Engineering
Decompile a .NET DarkCrystal RAT with dotPeek and ILSpy and script TripleDES decryption to recover its C2 server URL and port
Network Forensics
Filters a pcapng capture in Wireshark to trace an HTTP file upload between two hosts and recover an exfiltrated encryption script.
Malware Analysis
Uses the Didier Stevens PDF suite and peepdf to unpack a malicious PDF's OpenAction, embedded JavaScript, and base64 PowerShell payload.
Windows DFIR
Images a compromised disk with FTK Imager and mines Edge browser databases and registry hives to trace a malicious PDF's PowerShell execution.
Web Exploitation
Reviews Apache configuration and access logs to confirm exploitation of the PHP-CGI argument injection RCE against a web server.
Email / Phishing
Parses a German PayPal-themed phishing email's headers and embedded links, confirming the malicious URL via VirusTotal.
Network Forensics
Applies Wireshark TCP flag filters and passive OS fingerprinting to identify a scanning host and the systems it discovered on the network.
Malware Analysis
Statically reverses a PowerShell keylogger's functions to map its Tor-based C2 channel, screenshot capture, and keystroke logging.
Malware Analysis
Decodes a base64-obfuscated PowerShell one-liner in CyberChef to expose its malicious download-and-execute behavior.
Malware Analysis
Leverages VirusTotal's behavior and relations tabs to profile a malicious PowerPoint file's dropped HTML file and mshta persistence chain.
Windows DFIR
Correlates Suricata alerts in Brim with a Redline memory dump to trace a PrintNightmare privilege-escalation exploit to the attacker's SMB share and DLL.
Email / Phishing
Dissects a phishing email's malicious OneNote attachment to trace its embedded HTA lure and registry-key creation used to deliver QakBot.
Memory Forensics
Mines a Redline memory dump for a sideloaded malicious DLL masquerading inside a Windows process to uncover a ransomware infection chain.
Windows DFIR
Parses SYSTEM, SAM, SOFTWARE, and SECURITY registry hives with RegRipper and Registry Explorer to reconstruct host and user configuration details.
Malware Analysis
Sandboxes a macro-laden Excel stager in VirusTotal and Triage to trace its dropped files and second-stage payload download URL.
Reverse Engineering
Decompiles a .NET Revenge RAT sample with dotPeek to extract its mutex, C2 configuration, host fingerprinting, and anti-sleep routines.
Reverse Engineering
Decompiles a .NET information stealer to map its VirusTotal-evasion checks, UAC bypass commands, and targeted wallet and file-extension lists.
Network Forensics
Analyze a pcap in Wireshark to trace a Shellshock exploit against an Apache/Ubuntu server and recover the attacker's command
Malware Analysis
Unpack and inspect a malicious Chrome CRX extension with ExtAnalysis and crxcavator to identify its metadata and scripts
Windows DFIR
Investigate a malicious PyPI-style package by parsing MFT, UsnJournal, and browser artifacts to trace credential exfiltration to a C2
Windows DFIR
Reconstruct an unauthorized TeamViewer remote session from connection logs to identify the intruder, session IDs, and durations
Malware Analysis
Reverse the .NET TinyTurla backdoor to map its RunShell, command polling, and MSBuild in-memory execution capabilities
Malware Analysis
Analyze the UPSTYLE Python backdoor exploiting CVE-2024-3400 to reveal its log-monitoring command execution and self-restoring persistence
Memory Forensics
Combine memory and disk forensics with Volatility, oledump, and Outlook OST analysis to trace a WannaCry infection back to a phishing email
Memory Forensics
Use Volatility 3 and CyberChef to analyze a WinRAR CVE-2023-38831 exploit in a memory dump and decode its PowerShell download chain
Memory Forensics
Use Volatility 3 and IDA to trace a fake crack tool that drops BlackCat ransomware and modifies registry keys in a memory image
Windows DFIR
Examine SAM, SOFTWARE, SYSTEM, and NTUSER registry hives in Registry Explorer to profile added users, OS build, network config, and executed files
Network Forensics
Investigate CVE-2024-21320 theme spoofing by analyzing SMB and NTLMSSP traffic to recover the attacker share and relayed NTLM hashes
Malware Analysis
Dissect a YARA rule detecting the GwisinLocker Linux ransomware using IDA disassembly and hunt matching samples on Hybrid Analysis
Reverse Engineering
Reverse engineer a Linux ELF cl0p ransomware sample in IDA to extract its encryption key, target directories, extension, and ransom note
Reverse Engineering
Reverse engineer a macOS infostealer in Ghidra and IDA to map its targeted browsers, crypto wallets, Telegram exfil channel and HTTP C2
HTB Sherlocks
HackTheBox → HTB Labs → HTB Sherlocks
HTB · SHERLOCK · 52
▾
HTB Sherlocks
HackTheBox → HTB Labs → HTB Sherlocks
Network Forensics
Reconstruct an APT intrusion from PCAP in Wireshark, tracing port scanning, DNS zone transfer, credential brute force, initial access, privesc, and persistence
Memory Forensics
Analyze a Linux memory dump with Volatility to uncover a hidden malicious kernel module masquerading as nfnetlink that hooks syscalls and hides processes
Windows DFIR
Parse the NTFS MFT with MFTECmd and Timeline Explorer to trace a downloaded ZIP, identify a resident invoice.bat stager, and recover its C2 IP and port
Memory Forensics
Analyze a memory image with Volatility to find a malicious startup process, then reverse the malware's mutex, anti-debug tricks, and DGA C2 domains
Linux DFIR
Investigate Unix auth.log and wtmp to trace an SSH brute-force, identify the compromised account, backdoor user, and privilege escalation
Log Analysis
Trace an insider contractor through phpBB SQLite tables and access.log to uncover a credential-stealing XSS post and stolen database backup
AD / Kerberos
Correlate DC security logs, PowerShell logs, and Prefetch to detect a kerberoasting attack executed via PowerView and Rubeus
AD / Kerberos
Examine domain controller security logs to detect an AS-REP roasting attack, identifying the targeted account, its SID, and the compromised asset
Network Forensics
Examine a pcap in Wireshark to trace a Pikabot infection, extract the PE payload, and analyze self-signed TLS certs and tunneling domains
OSINT
Extract timestamps from memory-recovered URLs with unfurl and use OSINT to expose an insider threat and the threat actor handler behind data exfiltration
Windows DFIR
Analyze a suspect's disk image to recover Zoom conferencing artifacts, DPAPI-protected credentials, and encrypted meeting data revealing a planned attack
AD / Kerberos
Analyze DC system and security logs to detect vssadmin abuse creating a volume shadow copy and dumping NTDS.dit with a registry hive
AD / Kerberos
Trace ntdsutil.exe abuse through DC event logs to identify the dumped NTDS database path, enumerated privilege groups, and the malicious logon session
Windows DFIR
Analyze Edge history and MFT to trace a fake AI-tool malvertising install, uncovering the staging directory and recovering the malicious JS payload
Malware Analysis
Reverse a PowerShell-to-PE binary with pestudio and strings to recover the reversed-base64 script, network IOCs, and exfiltration password
Cloud Security
Correlate web access logs and AWS CloudTrail to trace an SSRF-driven metadata compromise, stolen IAM credentials, and database snapshot exfiltration
Windows DFIR
Triage a single MFT record with MFTECmd and MFTExplorer to identify a phished user's malicious HTA download, its ADS ZoneId, and file sizes
Windows DFIR
Parse the Windows Notifications database in DB Browser to reconstruct an insider's Slack chat revealing data leaked to a rival company for money
Incident Response
Analyze API Monitor apmx64 logs to track WSL2 activity, uncovering intercepted string functions, exfiltrated files, and lsassy credential theft
Network Forensics
Analyze a packet capture to trace how an attacker port-scanned, brute-forced FTP, and used port knocking to reach a critical Forela dev service
Network Forensics
Investigate a PCAP of DNS-tunneled C2 traffic, decoding queries to recover attacker commands and quantify stolen customer PII records
Malware Analysis
Reverse-engineer a Linux ransomware binary in Ghidra to recover the encryption key and decrypt Forela's ransomed UNIX server files
Windows DFIR
Analyze Windows event logs to track a user's malicious logon, firewall tampering, scheduled task, PowerShell activity, and log clearing
Network Forensics
Examine PCAP and logs to confirm a Bonitasoft auth-bypass RCE (CVE-2022-25237) via credential stuffing and SSH key persistence
Web Exploitation
Trace log evidence of a Next.js middleware bypass (CVE-2025-29927) chained with SSRF and Redis exploitation against BCI infrastructure
Windows DFIR
Reconstruct a data-extortion attack from Notepad++ artifacts to recover the attacker's exfil archive, crypto wallet, and contact details
Network Forensics
Hunt an LLMNR poisoning attack in a PCAP, identifying the rogue Responder host and stitching NTLM values to crack the victim's password
Cloud Security
Investigate AWS CloudTrail logs in Splunk to track compromised access keys, IAM privilege escalation, and S3 data encryption by a threat actor
Windows DFIR
Trace a malicious NuGet supply-chain package across PowerShell history, browser, and MFT artifacts to its Defender-disabling C2 payload
Cloud Security
Correlate Windows artifacts and AWS CloudTrail logs to track a rogue insider abusing Ammyy Admin and tampering with an S3 archive
Web Exploitation
Investigate pcap, auth.log, and bash history to trace an AI chatbot prompt-injection leading to credential leak and root privilege escalation
Reverse Engineering
Reverse a malicious NSIS/Electron Node.js keylogger, decoding XOR shellcode and V8 bytecode to recover its exfil channel and fake coupon
Incident Response
Correlate KAPE logs and a memory dump to track RDP access, Defender bypass, privilege escalation, and exploit use on a Windows 11 host
Incident Response
Follow prefetch and event-log evidence to trace BITS downloads, credential dumping, and database exfiltration during lateral movement
Windows DFIR
Audit an insider elf's workstation and eM Client emails to reconstruct threat-actor contact and locate Santa's exfiltrated secret file
Cloud Security
Audit AWS CloudTrail logs to confirm automated S3 bucket theft, identify malicious IPs, and pinpoint the leaked VPN file and compromised account
Memory Forensics
Analyze a memory dump with Volatility to trace an LNK/VBS infection chain, process injection, and procdump credential theft on a workstation
Network Forensics
Analyze a printer-server pcap in Wireshark to trace port scanning, PJL print jobs, and lateral movement to a critical SSH server
Windows DFIR
Investigate a KAPE triage of a compromised domain controller to trace CVE exploitation, a malicious service, and file-encrypting ransomware
Windows DFIR
Trace a phishing LNK that abuses LOLBins to stage C2, then reconstruct the attacker's VPN and RDP access from Windows artifacts
Windows DFIR
Reconstruct a fake-captcha ClickFix attack from RunMRU, PowerShell history, and network traffic to recover the downloaded stager and reverse shell
Linux DFIR
Examine CatScale Linux artifacts and bash history to trace a trojanized enum script that downloads a password-protected payload and sets cron persistence
AD / Kerberos
Correlate a network capture with logon audit logs to detect an NTLM relay attack from a rogue device authenticating as a stolen account
Memory Forensics
Analyze a memory dump and disk image to trace a malicious VSCode extension spawning a NjRAT reverse shell and modifying the registry for persistence
Memory Forensics
Analyze a memory dump with Volatility malfind and dumpfiles to identify a process-hollowing C2 implant and build the incident timeline
Network Forensics
Trace a pcap from a malicious VBS download through PowerShell and AutoHotkey staging to identify the delivered RAT and its C2
Windows DFIR
Investigate KAPE artifacts and Sysmon to trace a TeamViewer social-engineering intrusion deploying Merlin C2 and time-tampering PowerShell scripts
Windows DFIR
Parse prefetch and USN journal artifacts to count PsExec executions and identify the service binary, key file, and named pipe from lateral movement
Network Forensics
Analyze HTTP POST traffic to reconstruct a router web-admin brute force and command-injection CVE exploit leading to a reverse shell C2
Web Exploitation
Investigate CatScale logs from a WordPress server to trace a WPScan fingerprint, Ultimate Member CVE exploit, backdoor user, and web shell RCE
Windows DFIR
Examine Sysmon logs to identify an msiexec-delivered backdoored UltraVNC installer, its timestomping, dropped files, and C2 connections
Windows DFIR
Trace an insider's USB data theft from an FTK disk image using SYSTEM/SOFTWARE hives to recover device, timestamps, and copied files
TryHackMe
TryHackMe → THM Blue Teaming
TRYHACKME · 33
▾
TryHackMe
TryHackMe → THM Blue Teaming
Linux DFIR
Investigate an Ubuntu API server breach where command injection in an Nginx-served Python app led to SSH access and data exfiltration
Log Analysis
Hunt through Splunk process-execution (4688) logs to spot an imposter account, malicious scheduled tasks, and LOLBIN payload downloads
Windows DFIR
Analyze three compromised servers using EvtxECmd and RDP logs to backtrack lateral movement and persistence from the Midnight Blizzard group
Network Forensics
Decrypt SMB3 traffic in a pcap using NT hashes recovered from an LSASS dump to prove which fired employees accessed private files
Incident Response
Assess a phishing compromise across email headers, endpoint execution, and network traffic to trace the Boogeyman actor's malicious attachment
Email / Phishing
Decode a base64 email attachment and analyze headers to assess a spear-phishing resume that compromised an HR specialist's workstation
Incident Response
Reconstruct a multi-stage ISO/HTA intrusion in Kibana and Sysmon logs, tracing DLL execution, persistence, and threat-actor activity
Network Forensics
Analyze a pcap in Wireshark to trace a malicious Word document download, C2 domains, and outbound connections from an infected workstation
Memory Forensics
Follow an artefact trail across a memory dump and disk image with Volatility and FTK Imager to uncover a netcat reverse shell
Linux DFIR
Review auth.log and bash history to trace a disgruntled IT employee's privileged commands, rogue user creation, and sudo changes
Windows DFIR
Use Autopsy to extract host details, user accounts, network config, and IP/MAC from an E01 disk image and its registry hives
Windows DFIR
Use Autopsy and registry artifacts to trace a terminated engineer's USB exfiltration, hotspot evasion, and accessed sensitive files
Disk Forensics
Repair a corrupted MBR boot signature, examine partitions, and carve deleted files to prove an insider stole quantum-crypto research
Linux DFIR
Examine a suspect's Linux workstation using wtmp, auth.log, and syslog to trace logins, USB insertion, and data exfiltration activity
Threat Hunting
Hunt through Elastic and Sysmon logs to trace a malicious ZIP attachment from download to data exfiltration on a finance workstation
Log Analysis
Query Splunk Windows event logs to detect a masqueraded backdoor user, registry changes, and remote WMI account creation
Linux DFIR
Perform a compromise assessment on a Linux honeypot to uncover a backdoor account, cron persistence, and hidden malicious processes
Network Forensics
Analyze HTTP connection logs in Kibana to trace bitsadmin LOLBin C2 activity and recover a malicious file from a filesharing site
Log Analysis
Analyze web server logs to reconstruct an attacker's toolchain, vulnerable endpoints, and stolen data from a breached juice shop
Memory Forensics
Use Volatility across multiple memory dumps to recover a password, console history, shutdown time, and a TrueCrypt passphrase
Threat Hunting
Sift Splunk Sysmon events to find NirSoft credential-viewer binaries and activity while endpoint security was disabled
Log Analysis
Investigate Splunk Sysmon logs to trace a base64 PowerShell dropper, Defender tampering, and scheduled-task persistence in a ransomware case
Email / Phishing
Investigate an .eml file's headers and client-side body to determine whether a ParrotPost login request is a credential-stealing phish
Email / Phishing
Use Thunderbird and CyberChef to dissect phishing email headers and bodies, extracting spoofed senders, origin IPs, and malicious URLs
Incident Response
Use Redline to analyze an infected host and identify the REvil ransomware binary, its download URL, hash, and files it encrypted
Windows DFIR
Investigate a live Windows host with Sysmon and Event Viewer to reconstruct a fake-antivirus ransomware execution and its aftermath
Windows DFIR
Examine registry hives with Registry Explorer and RegRipper to prove secret recipe files were copied onto a suspect's machine
Log Analysis
Investigate ModSecurity WAF logs in Kibana to build a timeline of scanning, brute-force, and data exfiltration against an e-commerce server
Email / Phishing
Analyze phishing emails and a recovered phishing kit to trace the adversary's redirect URLs, .zip archive, and threat intel
Linux DFIR
Hunt and remediate five backdoors on a compromised Linux server, uncovering malicious binaries and .bashrc persistence
Windows DFIR
Reconstruct a full intrusion from a malicious document through privilege escalation using Sysmon, event logs, and packet captures
Email / Phishing
Inspect a suspicious business email's headers, SPF/DMARC records, and originating IP to determine if it is a phishing attempt
Windows DFIR
Investigate insider activity on a live Windows system to identify searched, accessed, and exfiltrated files during an absence window
HTB Machines
HackTheBox → HTB Labs → HTB Machines → VulnLab
HTB · MACHINE · 16
▾
HTB Machines
HackTheBox → HTB Labs → HTB Machines → VulnLab
AD / Kerberos
Pull passwords from LDAP descriptions via null session, reset a hidden user, then use Backup Operators to dump NTDS and root the DC
AD / Kerberos
Abuse a guest account and SYSVOL logon script for a foothold, then chain WriteOwner and GPO abuse to root the domain controller
AD / Kerberos
Steal a hash with a guest-writable share, Kerberoast svc_mssql, forge a silver ticket for xp_cmdshell, then abuse SeImpersonate for SYSTEM
Web Exploitation
Exploit Grafana directory traversal (CVE-2021-43798) to steal and crack DB hashes, then abuse sudo docker exec privileged mode to reach root
Web Exploitation
Deploy a malicious LimeSurvey plugin for a Docker foothold, harvest an env-var password, and abuse a shared host directory with SUID bash to root the box
Windows Privesc
Phish a malicious macro ODT over SMTP for a shell, abuse developer webroot control for a webshell, then leverage SeImpersonatePrivilege to reach SYSTEM
Windows Privesc
Recover a Gitea PAT to deploy an ASPX webshell, decrypt mRemoteNG credentials for RDP, then exploit PDF24 Creator CVE-2023-49147 via oplock to reach SYSTEM
Web Exploitation
Abuse an unauthenticated JMX MBean server for a Tomcat foothold, loot a backup with SSH keys, then create an admin user via sudo to become root
Windows Privesc
Force NTLM auth with an ntlm_theft WAX file for SSH access, abuse a symlink upload for a webshell, then use FullPowers and SeImpersonate to reach SYSTEM
Web Exploitation
Abuse forgot-password to log in, poison access logs for LFI RCE, exploit trusted-host rlogin, then escape sudo nano to root the box
AD / Kerberos
Guess a weak trainee password, reset a Pre2K computer account, then abuse ADCS ESC1 to obtain the Administrator hash and take over the domain controller
AD / Kerberos
Crack an MS Access DB for domain creds, abuse Pre2K GenericWrite for RDP, then exploit ZeroLogon and DCSync to dump all hashes and root the DC
AD / Kerberos
Spray for accounts pending password change, chain GenericAll and ReadGMSAPassword via BloodHound, then abuse ADCS ESC4 to impersonate Administrator
Linux Privesc
Abuse an NFS export to impersonate a user, crack a PostgreSQL hash from psql history, then hijack a root backup cron with SUID bash to root the box
AD / Kerberos
Spray to enter Lansweeper, capture scan creds with an SSH honeypot, abuse GenericAll for a foothold, then deploy or decrypt Lansweeper creds to reach SYSTEM
Windows Privesc
Break out of a passwordless RDP kiosk via a second Edge instance, unmask a Remote Desktop Plus admin password, then bypass UAC to root the box
HackSmarter.org
HackSmarter.org
HACKSMARTER · 12
▾
HackSmarter.org
HackSmarter.org
AD / Kerberos
Chain a Jenkins foothold and sudo binary abuse on Ubuntu into Kerberos keytab theft and ADCS ESC1 to seize Domain Admin
AD / Kerberos
Chain Kerberoasting, shadow credential attacks, and ADCS ESC1 across service accounts to escalate a standard user to Domain Admin
Linux DFIR
Leak credentials over SNMP then chain cronjob replacement, Unix socket hijacking, and SUID PATH hijacking to reach root on a Linux server
AD / Kerberos
Crack leaked MD5 hashes then chain password spraying, Kerberoasting, NTLM theft, and SeBackupPrivilege to compromise the AD domain
AD / Kerberos
Abuse a description-field password and ForceChangePassword, then leverage the BadSuccessor dMSA attack to reach Enterprise Admin on Server 2025
AD / Kerberos
Pivot from an RDP jump box through RBCD, DPAPI secrets, and Backup Operators to a DCSync that fully compromises the domain
AD / Kerberos
Exploit Jinja2 SSTI on a Linux web server, reuse keys and cracked hashes to pivot across Windows hosts, and abuse GPO to own the domain
AD / Kerberos
Steal a hash via NTLM theft, abuse GenericAll, then pivot with ligolo-ng into MSSQL and SeImpersonate to reach SYSTEM
AD / Kerberos
Run a Sliver C2 stager past Defender, loot Edge and autologon credentials, then tunnel to a MySQL server to exfiltrate the flag
AD / Kerberos
Enumerate usernames from a website, AS-REP roast, crack a Cisco router config, then abuse GPO Creator Owners to compromise the domain
Linux DFIR
Abuse Oracle CREATE ANY DIRECTORY via CloudBeaver to read an SSH key, then replace a root-run script to fully compromise the Linux server
AD / Kerberos
Crack a share document password, spray it, then chain shadow credentials and ADCS ESC1 to escalate to Domain Admin
Unlisted Labs
Unlisted Labs
UNLISTED · 11
▾
Unlisted Labs
Unlisted Labs
Digital Forensics
Solve ten CTF challenges across forensics, crypto, reversing, stego, and OSINT using strings, ROT decoding, and packet analysis
Network Forensics
Work through blue-team CTF challenges spanning packet analysis, DNS tunneling, auditd, Suricata IDS, and Windows event logs
Incident Response
Recap the Cyber Range Thailand 2024 final round experience without a technical write-up of the challenges
Memory Forensics
Recover an encrypted flag image from a Windows memory dump by extracting the AES key and IV from a PowerShell script and env vars
Malware Analysis
Recover a Windows Defender quarantined malware with dexray to extract the base64-encoded flag from its PowerShell payload
Incident Response
Work through incident-response and reverse-engineering challenges chaining web recon, hashes, and a password-protected evidence file
Log Analysis
Trace an attacker through Windows Security event logs via process-creation 4688 events, rundll32 payloads, and AES-decrypted clues
Windows DFIR
Investigate malicious PDFs, stealers and ransomware using exiftool metadata, VirusTotal behavior, and email analysis
Network Forensics
Analyze PCAPs to recover LSB-hidden flags, brute FTP logins, and decrypt C2 traffic alongside mobile forensics tasks
Reverse Engineering
Reverse ELF binaries in Ghidra to brute-force seeds and generate flags, plus crypto and programming challenge solutions
Reverse Engineering
Solve mixed crypto, forensics, web and OSINT challenges including Vigenere, low-exponent RSA cube root, and EXIF GPS extraction
Unlisted Labs
Unlisted Labs → MemLabs
UNLISTED · 6
▾
Unlisted Labs
Unlisted Labs → MemLabs
Memory Forensics
Recover important files from a crashed Windows memory dump using Volatility to locate and dump a WinRAR archive across three flags
Memory Forensics
Dig through a Windows memory dump with Volatility to recover env vars, browser history, and a KeePass database for three flags
Memory Forensics
Recover a secret encrypted by a malicious script from a memory dump, brute-forcing the XOR key to rebuild the split flag
Memory Forensics
Recover a deleted flag-bearing text file from a Windows memory dump by scanning files and parsing the MFT with Volatility
Memory Forensics
Hunt multi-stage flags in a Windows memory dump by tracing Notepad and WinRAR processes, IE history, and a password-protected archive
Memory Forensics
Reconstruct a split flag from a memory dump by recovering a RAR password from console history and environment variables
LetsDefend
LetsDefend → LetsDefend Alert
LETSDEFEND · 4
▾
LetsDefend
LetsDefend → LetsDefend Alert
Incident Response
Investigate a SOC alert for ProxyNotShell (CVE-2022-41082) exploitation attempts against an Exchange server via malicious autodiscover URLs in IIS logs
Email / Phishing
Analyze a quishing email by decoding its QR code to confirm a Microsoft-login phishing site and scope endpoint exposure
Email / Phishing
Triage a deceptive phishing email delivering AsyncRAT, confirming delivery, execution via explorer.exe, and C2 communication on the endpoint
Malware Analysis
Analyze an allowed Invoice.exe flagged as Maze ransomware, mapping its behavior and hunting endpoint C2 callbacks
Unlisted Labs
Unlisted Labs → Level Effect Cyber Defense CTF
UNLISTED · 3
▾
Unlisted Labs
Unlisted Labs → Level Effect Cyber Defense CTF
Threat Intel
Answer threat-intel challenges identifying CVEs, FSB malware lineage, and APT groups like Volt Typhoon from TTPs
Email / Phishing
Work email-security challenges parsing disguised eml headers, tracing sender IPs, and decoding quoted-printable evasion
Log Analysis
Identify Windows Security event IDs and spot suspicious logon activity in an evtx log to recover the flag
⌕
no write-ups matched your query ·