GISVULN / CTF ARENA
Standalone website-based CTF

Run the test. Get the flag. Submit the flag.

Each challenge opens its own local CTF test page. Perform the specified test, receive the flag only after passing, then paste that flag back into this board to record your points. This arena is separate from the existing vulnerability labs.

91Challenges
0Points
0Solved
guestHandle

Challenge board

91 of 91 challenges · All
AllWebCryptoNetworkingForensicsReverse EngineeringOSINTExploitationMiscellaneousCase Studies
Web · Easy · 50 pts

Catalog Search

Test the local catalog-search simulator. Find the harmless boolean probe that makes the result count change.
Launch test
Web · Easy · 50 pts

Markup Reflection

Test the local feedback preview. Submit a harmless HTML marker to demonstrate why output encoding matters.
Launch test
Web · Easy · 50 pts

Record Switch

The local record viewer starts on your record. Test the second fixture identifier without enumerating beyond the supplied value.
Launch test
Web · Easy · 75 pts

Role Header

The local request inspector accepts one header line. Identify the dangerous trust boundary by submitting the client-controlled role header.
Launch test
Web · Easy · 75 pts

Fixture Path

Test the local file-preview simulator with the supplied traversal-shaped fixture path.
Launch test
Web · Easy · 75 pts

Token Algorithm

Choose the insecure token algorithm exposed by the local decoder test.
Launch test
Web · Medium · 100 pts

Cookie Role

The local session simulator accepts a decoded role field. Test the privileged value and explain why the server must sign and validate state.
Launch test
Web · Medium · 100 pts

URL Fetcher

Use the local URL-fetch simulator to test the private-address boundary. No network request is made.
Launch test
Web · Medium · 100 pts

Return URL

Test the local post-login redirect validator with an off-site destination.
Launch test
Web · Medium · 100 pts

Origin Echo

Test the local CORS policy simulator with an untrusted origin.
Launch test
Web · Medium · 125 pts

Upload Extension

Test the local upload validator with an active script extension. Submit only the extension, not a file.
Launch test
Web · Medium · 125 pts

Login Throttle

The local login simulator records a small attempt count. Find the first count at which throttling should activate.
Launch test
Business logic · Medium · 125 pts

Cart Total

Test the local checkout calculator by submitting a client-side total lower than the server catalog total.
Launch test
Forensics · Medium · 125 pts

Log Filter

Filter the local request log for the unusual tool user-agent.
Launch test
Recon · Medium · 125 pts

Robots Clue

Enter the disallowed training path shown by the local robots.txt simulator.
Launch test
Network · Hard · 150 pts

TXT Metadata

Query the local DNS-record simulator for the TXT record name used by the training zone.
Launch test
Web · Hard · 150 pts

Cache Key

Test the local cache-key simulator with the header that can influence host selection.
Launch test
API · Hard · 175 pts

Property Allowlist

Test the local JSON response inspector. Submit the sensitive property that should not be returned by a public profile endpoint.
Launch test
Web · Hard · 175 pts

State Change

Test the local profile-update simulator. Identify the missing request control required for a cookie-authenticated state change.
Launch test
API · Hard · 200 pts

Webhook Replay

Test the local webhook receiver with the supplied synthetic event ID. The simulator reveals the replay-protection finding when the same event is recognized twice.
Launch test
Web reconnaissance · Medium · 150 pts

Northstar Catalog

Search the catalog page for an implementation note left in an HTML comment.
Launch test
Web reconnaissance · Medium · 150 pts

Northstar Status

Find the deployment flag in the page metadata, not the visible status cards.
Launch test
Web reconnaissance · Medium · 150 pts

Northstar Profile

Review the profile card and its DOM attributes for an accidentally exposed training marker.
Launch test
Web reconnaissance · Medium · 150 pts

Northstar Dashboard

The dashboard loads a small configuration object for the chart. Find the training flag in the JavaScript.
Launch test
Web reconnaissance · Medium · 150 pts

Northstar Help Center

A hidden help article was left in the document. Find the flag without attempting any login.
Launch test
Web reconnaissance · Medium · 150 pts

Northstar Asset Library

One stylesheet class contains a review marker that should not have shipped.
Launch test
Web reconnaissance · Medium · 150 pts

Northstar Export Preview

The export preview contains a synthetic log in a preformatted block. Find the flag among the lines.
Launch test
Web reconnaissance · Medium · 150 pts

Northstar Link Hub

One link contains a fragment used by the training router. Follow the in-scope link and inspect its URL fragment.
Launch test
Web reconnaissance · Medium · 150 pts

Northstar Map

The map page includes an inline SVG legend with a title intended for screen readers.
Launch test
Web reconnaissance · Medium · 150 pts

Northstar Robots

The site’s robots-style policy includes a training note in a comment.
Launch test
Application security · Hard · 175 pts

API Method

Inspect the synthetic API method note and identify the verb that should require authorization.
Launch test
Application security · Hard · 175 pts

GraphQL Field

The local schema simulator exposes a sensitive field. Submit the field name that should be restricted.
Launch test
Application security · Hard · 175 pts

CSP Nonce

The local browser-policy simulator receives a nonce from the client. Submit the policy directive that must be enforced server-side.
Launch test
Application security · Hard · 175 pts

Sitemap Exposure

The local sitemap contains an administrative training route. Submit the route path.
Launch test
Application security · Hard · 175 pts

ETag Privacy

The local cache simulator uses a user-specific ETag. Submit the missing cache directive for private responses.
Launch test
Application security · Hard · 175 pts

OAuth Redirect

The local OAuth simulator accepts a redirect URI. Submit the control that must be exact-match validated.
Launch test
Application security · Hard · 175 pts

Secret Rotation

The local deployment-note simulator shows a leaked test key. Submit the first response step.
Launch test
Application security · Hard · 175 pts

MIME Sniffing

The local download simulator serves user content. Submit the header that prevents MIME sniffing.
Launch test
Application security · Hard · 175 pts

Audit Trail

The local admin action simulator lacks an audit property. Submit the property needed to attribute the action.
Launch test
Application security · Hard · 175 pts

Session Fixation

The local login simulator keeps the pre-login session identifier. Submit the correct defensive action.
Launch test
Networking · Hard · 200 pts

Port Inventory

Scan the fixed allowlisted ports 21, 80, and 443 on gisvuln.xo.je.
Launch test
Networking · Hard · 200 pts

DNS Resolution

Resolve gisvuln.xo.je from the server and record the returned address list.
Launch test
Networking · Hard · 200 pts

HTTP Reachability

Request the public HTTP service on the owned host and inspect the status line.
Launch test
Networking · Hard · 200 pts

HTTPS Reachability

Request the public HTTPS service on the owned host with a short timeout.
Launch test
Networking · Hard · 200 pts

FTP Banner

Connect once to the supplied FTP service on port 21 and record whether a banner is returned.
Launch test
Networking · Hard · 200 pts

Common Database Ports

Check only 3306 and 5432 on the owned host and record their reachability.
Launch test
Networking · Hard · 200 pts

Header Snapshot

Fetch one HTTP header snapshot for the owned homepage and review server metadata.
Launch test
Networking · Hard · 200 pts

Robots Retrieval

Fetch only /robots.txt from the owned host and record the response status.
Launch test
Networking · Hard · 200 pts

Favicon Check

Request only /favicon.svg and inspect its content type.
Launch test
Networking · Hard · 200 pts

Low-Rate Service Check

Run the complete bounded check: DNS plus ports 21, 80, and 443, with one connection per port.
Launch test
Crypto · Hard · 225 pts

Julius Caesar — rotating substitutions

A rotating substitution cipher changes its key every 32 characters. The supplied artifact contains the changing-key notes and ciphertext. Recover the training flag without contacting an external service.
Launch test
Crypto · Hard · 225 pts

Collision — digest evidence

A digest challenge asks you to reason about two inputs that produce the same short training digest. The page gives the complete bounded fixture.
Launch test
Forensics · Hard · 225 pts

Short Routes — routing capture

Inspect the supplied routing-authentication evidence and identify the training key represented in the capture summary.
Launch test
Forensics · Hard · 225 pts

Pass It On — credential evidence

Review the synthetic Windows credential-evidence summary and identify the lesson demonstrated by pass-the-hash risk.
Launch test
Networking · Hard · 225 pts

Echo Request — protocol payload

Analyze the supplied ICMP request transcript and identify the exact payload marker expected by the echo responder.
Launch test
Networking · Hard · 225 pts

Digging — DNS TXT evidence

Inspect the DNS worksheet and recover the message stored in the TXT record.
Launch test
Web · Hard · 225 pts

Misspelling — client-side route

Inspect the supplied button page and determine why the click handler does not call the function that exists.
Launch test
Web · Hard · 225 pts

Fishy Export — path handling

Review the safe fixture showing how an export route can expose implementation details when path handling is weak.
Launch test
Misc · Hard · 225 pts

Secret Key — timing lesson

Study the timing transcript and identify why character-by-character comparisons can disclose secret prefixes.
Launch test
Reversing · Hard · 225 pts

Eventually a Flag — algorithmic delay

Inspect the small program summary and identify the algorithmic mistake that causes the flag generation to take impractically long.
Launch test
Misc · Hard · 225 pts

Buggigt — input validation

A bounded fixture demonstrates how inconsistent validation can produce two different interpretations of the same input.
Launch test
Misc · Hard · 225 pts

The Hen and the Egg — ordering

Read the supplied dependency note and identify which operation must happen first to avoid the circular assumption.
Launch test
Misc · Hard · 225 pts

The Safe — code review

Review the small safe-control fixture and identify the missing authorization check.
Launch test
OSINT · Hard · 225 pts

Find It — public clue chain

Follow the supplied public-information clue chain without leaving the provided pages.
Launch test
OSINT · Hard · 225 pts

Intern — metadata trail

Inspect the supplied document metadata and recover the training identifier.
Launch test
Reverse · Hard · 225 pts

Warm-up — branch logic

Trace the small branch table and determine which input reaches the success path.
Launch test
Reverse · Hard · 225 pts

Packman — state machine

Analyze the supplied state transitions and identify the sequence that reaches the flag state.
Launch test
Web · Hard · 225 pts

Robot Filter — crawler policy

Inspect the local robots policy and identify the path that should not be treated as a security boundary.
Launch test
Web · Hard · 225 pts

XML Control — parser boundary

Review the safe XML fixture and identify the parser control that prevents external entity resolution.
Launch test
Web · Hard · 225 pts

Search — query handling

Inspect the search-result fixture and identify the output-encoding boundary.
Launch test
Case Studies · Practical · 300 pts

Phishing email and image OSINT

Evidence1.eml and secret.png
Launch test
Case Studies · Practical · 160 pts

Authentication log triage

auth.log and users.csv
Launch test
Case Studies · Practical · 160 pts

Browser history investigation

history.csv and download-note.txt
Launch test
Case Studies · Practical · 160 pts

DNS record case

zone.txt and resolver.log
Launch test
Case Studies · Practical · 160 pts

Cloud audit trail

cloud-audit.json and iam.txt
Launch test
Case Studies · Practical · 160 pts

Web server log trail

access.log and routes.txt
Launch test
Case Studies · Practical · 160 pts

Chat export timeline

chat.json and timeline.csv
Launch test
Case Studies · Practical · 160 pts

Mobile backup review

backup.json and notes.txt
Launch test
Case Studies · Practical · 160 pts

Git history review

git-diff.txt and config.env.example
Launch test
Case Studies · Practical · 160 pts

Firewall event analysis

firewall.csv and service-map.txt
Launch test
Case Studies · Practical · 160 pts

Image metadata review

photo.png and exif.txt
Launch test
Case Studies · Practical · 160 pts

USB artifact review

usb-history.txt and file-list.csv
Launch test
Case Studies · Practical · 160 pts

Phishing landing page

landing.html and mail.txt
Launch test
Case Studies · Practical · 160 pts

Ransom-note triage

ransom-note.txt and process-list.txt
Launch test
Case Studies · Practical · 160 pts

API token incident

api.log and token-record.json
Launch test
Case Studies · Practical · 160 pts

Email header trace

trace.eml and header-notes.txt
Launch test
Case Studies · Practical · 160 pts

SOC alert correlation

alerts.json and correlation.txt
Launch test
Case Studies · Practical · 160 pts

Document metadata case

document.txt and revisions.csv
Launch test
Case Studies · Practical · 160 pts

Proxy log investigation

proxy.log and allowlist.txt
Launch test
Case Studies · Practical · 160 pts

Timeline reconstruction

timeline.csv and notes.txt
Launch test
Case Studies · Practical · 160 pts

Secure configuration review

config.yaml and review.txt
Launch test