pix3latedpic

What reference is recorded for the production deployment that changes the target site's live content?

What attestation reference belongs to the accepted release candidate?

What reference is held by the preview worker reached through template execution?

What object-version reference appears when the target preview uses the modified template?

What reference is recorded for the unauthorized addition to the target project's team?

You walk through a door using an identity you forged

The server fetches something internal on your behalf

You gave yourself access the system never intended to grant

A credential meant for someone else ends up in your hands

Something was left exposed that shouldn't be public

What is the flag from the secrets vault accessed by exploiting the fail-open authentication bypass?

What is the flag returned by the exfiltration callback endpoint of the backdoored supply chain package?

What is the flag extracted from the AI assistant's internal configuration through prompt injection?

What is the flag retrieved from the internal cloud metadata service accessed via Server-Side Request Forgery?

What is the flag received after verifying the admin credentials obtained through SQL injection and password hash cracking?

What is the flag obtained from the debug admin panel accessed through secrets leaked in the exposed git commit history?

If you’ve made it through the last door, it’s time to search for the treasure hidden within.

Broken authentication is an invitation to attackers to walk right in. You don’t need to break the front door, it’s already unlocked.

Feeling unwell? A doctor uses an injection. Some systems react similarly when prodded the right way.

User “daniel” seems innocent enough, but not everyone takes security seriously, and he’s no exception.

Look beyond what the app shows you to uncover the first flag.

Data is only as secure as its weakest link. Can you uncover information that shouldn't be accessible?

A system's curiosity can sometimes lead it to unexpected places. Can you make it fetch something valuable?

Certain reports are meant for specific eyes only. Can you access what's not meant for you?

Sometimes, what you send isn't what's saved. Can you manipulate the system to reveal what's hidden?

Some users have more privileges than others. Can you find something they shouldn't have left exposed?

What is the flag value found on the forest domain controller?

Provide the NTLM hash of the user account responsible for Kerberos authentication in the child domain.

What is the flag retrieved from dbserver.dbcenter.infosec.local?

What is the NTLM hash associated with the DBADMIN user?

Which user has the impersonation rights to the SQL Server Administrator account?