Cyber Skyline Plus - Gym Instructor Guide

Module: Open Source Intelligence

Topic: Meta

Objective

Students will be able to use a metadata viewer to determine information about a photo that was taken.

Prompt

This challenge will give you experience with extracting metadata from an image file. You are given an image with contains metadata and you will need to use a metadata viewer to help answer the questions.

Questions & Answers

  1. When was the image created? (Round to the nearest minute) Answer: 2015/05/15 02:14
  2. What is the image size in pixels? (ex: 800x600) Answer: 1024x768
  3. What is the make of the camera that took the picture? Answer: apple
  4. What is the model of the camera that took the picture? Answer: iphone 5
  5. What is the exposure time for the picture? (ex: 1/200) Answer: 1/640
  6. Where was the picture taken? Please use only positive numbers with 4 decimal places. (ex: 45.4000N, 75.6667W) Possible answers: ● 39.8750N 20.0100E ● 39.8750N, 20.0100E ● 39 deg 52' 30.00" N, 20 deg 0' 36.00" E ● 39 deg 52' 30.00" N 20 deg 0' 36.00" E ● 39.8750 20.0100 ● N 39° 52' 30'' E 20° 0' 36'’ ● Latitude 39:52:30 Longitude 20:0:36 ● 39; 52;30 20;0; 36 ● 39º 52' 30.00" N, 20º 0' 36.00" E Incorrect answers: ● 39.8750 -20.0100 ● -39.8750 -20.0100 ● -39.8750N, 20.0

Extension Activities

Grade level
Extension Activity
Objective
Activity Steps
6-8
News Verification Lab
Distinguish between real and fake news using OSINT techniques.
Give students headlines or short articles. Ask them to: Reverse image search pictures Check sources Cross-reference news stories
9-12
OSINT Tools Treasure Hunt
Explore safe, open-source tools.
Tools: WHOIS lookup, Google Earth, The Wayback Machine, Social Search Engines (e.g., Social Searcher, IntelX) Activity: Create a challenge where students have to: Find who owns a domain Look at archived versions of a website (use wayback machine) Track public social posts for patterns

Topic: Lookup

Objective

Students will be able to find and use a specification document to answer questions about DNS.

Prompt

Answer these questions about DNS. Make sure you enter the record type and not the description of the record type.

Questions & Answers

  1. What type of DNS record hold the DNSSEC public signing key?

    2. Answer: DNSKEY

    image
  1. What type of DNS record is used to map hostnames to IPv6 addresses?

    2. Answer: AAAA

    image
  1. What type of DNS record is used to delegate a DNS zone?

    2. Answer: NS or Name Server

    image

Extension Activities

6-8
Username Investigation Game
Understand how usernames can reveal a digital trail.
Give a fictional username (e.g., “AlexGamer47”) and have students: Search for it on YouTube, Twitter (using screenshots), or game forums. Record patterns of use: hobbies, interests, locations. Discussion Prompt: Why do people reuse usernames? What can others learn from that?
9-12
Social Media Pattern Analysis
Understand how public posts create patterns.
Using a fictional account (set up by the teacher), have students: Map post times and locations Identify potential routines Connect hashtags to interests or communities

Topic: Threat Intel

Objectives

Students will be able to use search tools to answer questions about security topics.

Prompt

Answer the following questions about security issues.

Questions & Answers

  1. What is the CVE of the original POODLE attack?

    2. How to solve: The answer to this question can be found on Wikipedia.

    Answer: CVE-2014-3566

  2. What version of VSFTPD contained the smiley face backdoor?

    3. How to solve: The answer to this question can be found on Wikipedia.

    Answer: 2.3.4

  3. What was the first 1.0.1 version of OpenSSL that was NOT vulnerable to heartbleed?

    4. How to solve: The answer to this question can be found on Wikipedia.

    Answer: 1.0.1g

  4. What was the original RFC number that described Telnet?

    5. How to solve: The answer to this question can be found on Wikipedia. You will have to search another linked Wikipedia page for more information related to when Telnet was first developed.

    Answer: 15

  5. How large (in bytes) was the SQL Slammer worm?

    6. How to solve: The answer to this question can be found on Wikipedia.

    Answer: 376

  6. Samy is my…

    7. How to solve: The answer to this question can be found on Wikipedia.

    Answer: hero

Extension Activities

6-8
Build-A-Hacker Workshop (Fictional Personas)
Understand how threat actors gather info.
Given a scenario (e.g., a hacker wants to target a school), students: Use fictional student or staff profiles. Identify what information is publicly available (e.g., school calendar, staff names).Outcome: Students write a short paragraph predicting how the hacker might use the info and how to defend against it. Have students share their writings.
9-12
Fake Job Post Scam Breakdown
Understand how cybercriminals target individuals.
Students analyze fake job posts or emails (pre-curated).Use OSINT to check company legitimacy (e.g., WHOIS, company site vs fake URL).Discussion Prompt: How do threat actors use platforms like LinkedIn to customize attacks?

Topic: HTTP Headers

Objectives

Students will be able to find resources to understand different types of HTTP request headers.

Prompt

Solve these questions about HTTP headers.

Questions & Answers

  1. What HTTP request header is used to denote what URI linked to the resource being requested?

    2. Answer: referer *Note that the official specification for this header has “referrer” spelled incorrectly as “referer”

  2. What HTTP request header is used to identify the client software that made the HTTP request?

    3. Answer: user-agent

  3. What HTTP request header is used to identify the acceptable content types that can be returned?

    4. Answer: accept

Extension Activities

6-8
"What’s in a Web Request?" – Header Basics Lab
Introduce basic HTTP headers using simplified, printed mockups.
Present a mock HTTP GET request with headers like User-Agent, Host, and Referer. Ask students to decode what device/browser was used, what website was accessed, and where the request came from. Discussion Prompt: How could this data help someone track you online?
9-12
OSINT Header Case Study
Analyze how HTTP headers were used in a real-world investigation.
Setup: Use a public case (e.g., website misconfiguration or tech stack leakage). Activity: Provide captured headers from the case. Ask students to infer: Server type, Technologies in use, Possible vulnerabilities. Ethics Discussion: When is it okay to analyze headers? What should be off-limits?

Topic: WHOIS

Objective

Students will be able to conduct a WHOIS query to learn publicly available information about a domain name.

Prompt

Conduct open source intelligence data collection about cityinthe.cloud. Answer the following questions as they relate to the cityinthe.cloud domain.

Questions & Answers

  1. Who is the registrar of this domain?

    2. Answer: Dynadot

  2. On what day was this domain first registered?

    3. Answer: 2016-02-16

  3. What is this domain's registry domain ID?

    4. Answer: D15CD1AC4DEB54207A5048A69B9FC0558-ARI

  4. What is the Top-Level Domain (TLD) of this domain?

    5. Answer: cloud

  5. What organization manages the TLD used by cityinthe.cloud?

    6. Answer: Aruba

Extension Activities

6-8
WHOIS Mystery Matching Game
Connect WHOIS records to fictional organizations.
Setup: Create 3–4 mock WHOIS records and 3–4 fictional website profiles. Activity: Students analyze clues like registrar location, organization name, or domain age. Match each WHOIS record to the correct fake website. Use cards or slides for a collaborative classroom game.
9-12
WHOIS in the Real World: Threat Intelligence Report
Apply WHOIS to a broader investigation.
Assign a simulated incident (e.g., spam email, fake site).Students gather WHOIS data, infer attacker profile traits (e.g., fast-registered domains, offshore registrars).Produce a 1-page “Threat Intel Summary.”

Topic: PGP Lookup

Objectives

Students will query a public key database to identify the types of information stored there.

Prompt

Individuals use PGP to securely encrypt their emails, can you find out more about the following PGP keys?

Questions & Answers

  1. What is the key fingerprint for security@cpanel.net?

    2. Answer: B6709B4CC6F42077F69841919521BEDCABD94DDF

  2. What email address is associated with the key fingerprint 7A39A56B73D1E097D57435CFCDE2DE1DCB2077F2?

    3. Answer: hx@liber8tion.cityinthe.cloud

  3. On what date does the above key expire (in UTC)?

    4. Answer: 2050-12-26

Extension Activities

6-8
Understanding Digital Signatures
Introduce students to the concept of digital signatures and their role in verifying the authenticity of digital communications.
Discuss the basics of encryption and how digital signatures work. Use a simple analogy (like sealing a letter in an envelope) to explain how PGP ensures message integrity. Provide examples of how digital signatures are used in everyday life (e.g., software downloads, secure emails).
9-12
Analyzing PGP Key Metadata
Teach students how to extract and analyze metadata from PGP keys to gather OSINT.
Provide students with sample PGP public keys (ensure these are fictional or anonymized).Guide students through the process of examining key details such as creation date, associated email addresses, and key fingerprints. Discuss how this information can be used in digital investigations and the importance of ethical considerations.

Topic: SSL

Objectives

Students will use a browser in order to analyze a SSL certificate chain.

Prompt

Solve the following questions about the Cyber Skyline SSL certificate.

Note: If you see references to "BitDefender" in the process of solving this challenge, that means your BitDefender software is intercepting your SSL/TLS connection and will produce incorrect results.

Questions & Answers

  1. Who is the issuer for Cyber Skyline's SSL certificate?

    2. Possible Answers: sectigo, comodo

  2. How many bits long is the SSL key?

    3. Answer: 2048

  3. How many certificates are in the certificate chain?

    4. Answer: 3

Extension Activities

6-8
“What's in a URL?” Sorting Game
Learn to distinguish between HTTP and HTTPS.
Provide a stack of fake or real URLs.Students sort into “Secure” (HTTPS) and “Not Secure” (HTTP).Discuss what might happen if you send personal data over an insecure connection.
9-12
Expired or Misissued Certificate Challenge
Understand how SSL certificate issues may indicate threats.
Provide samples of expired, self-signed, or misconfigured certificates (can be screenshots or from certificate transparency logs).Students determine what’s wrong and how that might signal phishing, misconfiguration, or a suspicious site.

Topic: Barcode

Objective

Students will be able to use a barcode reader to identify hidden information.

Prompt

We intercepted a barcode we think might be hiding a flag. See if you can find it.

Questions & Answers

  1. What format does the barcode use?

    2. Possible Answers: code 39, code39, Code_39, USD-3, Code 3 of 9, Code 3/9, Alpha 39

  2. What is the flag hidden in the barcode?

    3. Answer: SKY-UZLU-5635

Extension Activities

6-8
Decode the Hidden Message (QR Detective)
Learn what QR codes are and how they encode information.
Students scan teacher-provided QR codes using school devices .Each QR code reveals a clue, message, or safe web link (e.g., a NASA fact, a riddle).Students work in teams to piece together a message or win a classroom scavenger hunt. Discussion: Why do we use QR codes? What kind of information can they hide?
9-12
Reverse Lookup of QR/Barcode Data
Investigate a product or web page linked via barcode or QR.
Scan or decode a real or simulated code. Conduct OSINT to find out: Who owns the domain or product? Where the item was manufactured or registered?Is the website or organization legitimate? Use WHOIS, Wayback Machine, and barcode prefix databases for investigation.

Module: Cryptography

Topic: Number Bases

Objectives

Students will use tools to recognize and convert various number bases.

Prompt

Our analysts have obtained password dumps storing hacker passwords. After obtaining a few plaintext passwords, it appears that they are all encoded using different number bases.

Questions & Answers

User
Cipher Text
Answer
Nan
0x73636f7270696f6e
Answer: scorpion
Elliot
c2NyaWJibGU=
Answer: scribble
Steve
01110011 01100101 01100011 01110101 01110010 01100101 01101100 01111001
Answer: securely
Daniel
01100010 01000111 00111001 01110011 01100010 01000111 01101100 01110111 01100010 00110011 01000001 00111101
Answer: lollipop

Extension Activities

6-8
Color Code Encryption (Hex and RGB)
Use hexadecimal to encode color values and relate them to cryptographic codes.
Teach students how hex values map to RGB (e.g., #FF0000 = red).Create a color-coded message where each letter maps to a hex color.Students decode messages using hex charts.
9-12
Cryptographic Base Challenge
Understand base conversions and their role in encoding systems like Base64 and hexadecimal hashes.
Provide students with encrypted-looking strings (e.g., hex-encoded, binary). Challenge them to decode messages by identifying and converting base formats. Include layers (binary → decimal → ASCII → message).

Topic: Shift

Objectives

Students will decode a Ceasar shift cipher.

Prompt

Our analysts have obtained password dumps storing hacker passwords. It seems to be using a pretty simple encryption scheme, see if you can crack them.

Questions & Answers

User
Password Ciphertext
Answer
Solution
Chris
iveghny ynxr
virtual lake
CyberChef.

Extension Activities

6-8
Code Wheel Construction & Cipher Fun
Learn letter shifting using a Caesar cipher wheel.
Students build a Caesar cipher wheel from a printable template (inner and outer alphabet circles).Encode a message by rotating the wheel to a shift value (e.g., shift of 3).Partner up: one student encodes, the other decodes.
9-12
Caesar Cipher + Frequency Analysis
Understand and exploit the vulnerabilities of shift ciphers.
Provide a Caesar-encrypted message without a known key. Students: Try all 25 possible shifts (“brute-force” method).Perform frequency analysis (e.g., looking for common letters like E or T).Discuss how frequency analysis led to the downfall of simple substitution ciphers.

Topic: @bash

Objective

Students will decode an atbash shift cipher.

Prompt

Our analysts have obtained password dumps storing hacker passwords. See if you can crack them.

Questions & Answers

User
Password Ciphertext
Answer
Solution
Christian
hzuvob lyerlfh xzev
safely obvious cave
CyberChef

Extension Activities

6-8
Binary to Text Bash Simulation
Explore how computers use binary to represent letters.
Give students ASCII codes in binary. Simulate Bash decoding using a chart or worksheet. Discuss how computers turn data into readable info via shell tools.
9-12
Build a Bash Password Vault
Use Bash to securely store and retrieve hashed passwords.
Script idea: Accept a username and password. Hash the password. Store it in a file. Later, compare a login attempt to the stored hash.

Topic: Beep

Objective

Students will recognize and decode morse code.

Prompt

Our analysts have intercepted an encoded message. See if you can decode it.

Questions & Answers

User
Password Ciphertext
Answer
Solution
Helen
- .... . / ... . -.-. .-. . - / --- ..-. / --. . - - .. -. --. / .- .... . .- -.. / .. ... / --. . - - .. -. --. / ... - .- .-. - . -.. / ... -.- -.-- / -.. -.- ...- -... / ----. ---.. .---- -.…
THESECRETOFGETTINGAHEADISGETTINGSTARTEDSKYDKVB9816
CyberChef

Extension Activities

6-8
Beep Morse Code Challenge
Encode and decode messages using sound.
Teach students basic Morse code (e.g., A = .-).Use a simple tone generator app, physical buzzer, or your own voice (short/long beeps).In teams, students send coded beeps across the classroom; others decode the message.
9-12
Sonic Modem & Tones
Learn how modems used sound for data transfer.
Play samples of old dial-up modem sounds. Discuss how tones carried data across phone lines. Try encoding binary into a sequence of tones using tools like Audacity. Optional: build a tone-to-binary decoder in Python or spreadsheet format.

Topic: Fencing

Objective

Students will recognize and decode a rail fence cipher.

Prompt

Our analysts have obtained encrypted messages. We saw hand-written notes that indicated the keys as being "3" and "5". See if you can crack them.

Questions & Answers

User
Password Ciphertext
Answer
Solution
Eve
Cair eruSA-0org sgaeudrpesr K-II98ue cn seYQ3
Courage is grace under pressure SKY-AIQI-9380
CyberChef
Nan
F daS-eefn n KZ3eheadty.YI8lta oiwy-Q0 r aI2
Feel the fear and do it anyway. SKY-IQIZ-3802.
CyberChef

Topic: French

Objective

Students will decrypt a Vigenère cipher.

Prompt

Our analysts have obtained an encrypted message. We know that the key, qizkwcgqbs was used. See if you can crack them.

Questions & Answers

User
Password Ciphertext
Answer
Solution
Matt
Y ln xkv lubj swlzqvkht, A vmzb pjk bbua we ddgs ILQ-GQYU-8026
I do not fear computers, I fear the lack of them SKY-QIZK-8026
CyberChef

Extension Activities

6-8
Vigenère Cipher Challenge
Encrypt/decrypt using a repeating keyword
Using a Vigenère square, students pick a keyword and encode a message so each letter shifts differently. They compare it to Caesar and discuss why a repeating key resists simple frequency analysis — a first taste of "polyalphabetic" thinking.
9-12
RSA in Real Life (Digital Certificates Demo)
Understand how RSA protects secure websites.
Use a browser to explore HTTPS certificates (lock icon → certificate).Identify the public key and certificate authority. Students answer questions: Who signed it? What does the public key do?

Topic: RSA

Objective

Use an understanding of key encryption to break a weak implementation of RSA.

Prompt

Our analysts have obtained several artifacts from a message that was encrypted with RSA. We need you to decrypt the message and figure out what the hackers are up to.

n = 1079
e = 43
c = 996 894 379 631 894 82 379 852 631 677 677 194 893

Questions & Answers

  1. What is the value of p (the smaller prime)?

    2. Answer: 13

  2. What is the value of q (the larger prime)

    3. Answer: 83

  3. What is the plaintext of the encrypted message?

    4. Answer: SKY-KRYG-5530

Extension Activities

6-8
RSA Role Play Game: Lock & Key Simulation
Understand public and private key mechanics.
Give each student a "public key" (a lock) and keep their "private key" (the key) hidden. Classmates can write secret messages and "lock" them (put in an envelope marked with your public key).Only the student with the matching private key can open the envelope and read it. Discussion: How does this simulate online encryption?
9-12
RSA in Real Life (Digital Certificates Demo)
Understand how RSA protects secure websites.
Use a browser to explore HTTPS certificates (lock icon → certificate).Identify the public key and certificate authority. Students answer questions: Who signed it? What does the public key do?

Topic: Stego 1

Objective

Students will use steganographic analysis tools to uncover a hidden message.

Prompt

The hackers have hidden a message in this image. Find out what it is.

Questions & Answers

  1. What is the hidden flag in the image?

    2. Answer: SKY-TVJI-2063

Topic: Stego 2

Objective

Students will use steganographic analysis tools to uncover a hidden message.

Prompt

The hackers have hidden a message in this image. Find out what it is.

Questions & Answers

  1. What is the hidden flag?

    2. How to solve: Use the Digital Invisible Ink Toolkit to obtain the hidden image using the “BlindHide” mode.

    Answer: SKY-ERNT-4183

Topic: Stego 3

Objective

Students will use steganographic analysis tools to uncover a hidden message.

Prompt

The hackers have hidden a message in this image. Find out what it is.

Questions & Answers

  1. What is the md5 sum of the hidden file?

    2. How to solve: The MD5 sum can be found by running the Linux md5sum program (ex: md5sum file.out) on the output file from the Digital Invisible Ink Toolkit.

    Answer: B2BDE37FEEDE452DB6CA45D1618785CA

  2. What is the hidden message?

    3. How to solve: Use the Digital Invisible Ink Toolkit to obtain the hidden image using the “BattleSteg” mode and then use the online hieroglyph translator to obtain the hidden message.

    Note: e and i are replaceable in this alphabet, so you may need to tweak your message to create something that is sound in English.

    Possible Answers: hidden messages, hedden messages

Topic: Stego 4

Objective

Students will use steganographic analysis tools to uncover a hidden message.

Prompt

The hackers have hidden a message in this image. Find out what it is.

Questions & Answers

  1. What is the md5 sum of the hidden file?

    2. How to solve: The MD5 sum can be found by running the Linux md5sum program (ex: md5sum file.out) on the output file from the Digital Invisible Ink Toolkit.

    Answer: 77864C67BC0D74B0A05E6FEC2C24125B

  2. What is the hidden message?

    3. Use the Digital Invisible Ink Toolkit to obtain the hidden image using the “HideSeek ” mode and then use the Futurama Alphabet converter to obtain the hidden message.

    Answer: there is no spoon

Module: Linux

Topic: DIR

Objective

Students will use commands via the Linux Command Line (CLI) to analyze files and directories.

Prompt

One of our analysts had their laptop damaged. However, we were able to recover and mount the hard drive. Access the terminal and recover various flags from the disk.

Questions & Answers

  1. What are the contents of flag1.txt, found in root's home directory?

    2. How to solve: Run cat flag1.txt from root’s home directory

    Answer: SKY-FNKC-3207

  2. What are the contents of flag2.txt, found in the root directory?

    3. How to solve: Use cd / to navigate to the root directory and then run cat flag2.txt.

    Answer: SKY-NPEJ-2501

  3. What are the contents of flag3.txt, found in an archive in /var/log?

    4. How to solve: Navigate to /var/log and then run tar -zxvf flag.tar.gz to extract the files from the archive.

    Answer: SKY-FVHR-3562

  4. What are the contents of flag4.txt, found in the flag user's home directory?

    5. How to solve: Navigate to the /home/flag directory and then run cat flag4.txt.

    Answer: SKY-SXIJ-6142

  5. What flag is printed when you run the flag5 program?

    6. How to solve: Run the flag5 program with the command flag5

    Answer: SKY-UDSV-9689

  6. What is the full path to the flag5 program?

    7. How to solve: Run which flag5

    Answers:

    • /usr/bin/flag5
    • /usr/bin/

    Incorrect: ./usr/bin/flag5

Extension Activities

6-8
Linux Adventure Story
Use commands like dir to progress through a narrative.
Students role-play as secret agents or explorers.Each directory contains parts of a story.Students unlock new parts by listing contents (dir) and making choices (cd cave, cd castle).
9-12
Linux Forensics Mini-Challenge
Find files based on clues using dir, ls, find, and grep.
Create a mystery scenario (e.g., “Find who deleted the secret file”).Students navigate directories, list contents (dir), and read logs (cat logfile.txt).Combine clues to solve the case.

Topic: File Edit

Objective

Students will use nano and Vim via the command line to create and edit files.

Prompt

Learn how to use command line file editors.

NOTE: The terminal session is logged. Please do not perform any denial of service attacks on the Linux server provided, malicious attempts to attack the Cyber Skyline platform will result in disqualification.

Questions & Answers

  1. What key should you press in addition to the CTRL key to trigger the combination to exit nano?

    2. Answer: x

  2. What vim mode allows you to write new characters in the file?

    3. How to solve: Search online for “vim mode to write new characters”.

    Answer: insert

  3. What keyboard combination will save and quit the file with vim?

      4. How to solve: Search online for “how to save and quit with vim” and read the descriptions for the different keyboard combinations.

      Answers:

    1. :wq
    2. wq
  4. What keyboard combination will delete an entire line in vim?

    5. How to solve: Search online for “vim delete line” and then read the descriptions for possible keyboard combinations. See the Trove for more detailed guidance.

    Answer: dd

  5. What command would you use to rename a file?

    6. How to solve: Search online for “linux how to rename a file” and read about the most common commands. See the Trove for more detailed guidance.

    Answer: mv

Extension Activities

6-8
Echo & Redirect Challenge
Use echo to write text to a file.
Run commands like echo "I love coding!" > myfile.txt.Append text using echo "And Linux!" >> myfile.txt.Display contents with cat myfile.txt.Discussion: What’s the difference between > and >>?
9-12
File Permissions and Editing
Explore how permissions affect file editing.
Create files with different permission settings (chmod).Try to edit them and observe what happens.Discuss why permissions are important for security.

Topic: Basic Commands

Objective

Use open source tools and Linux command line knowledge to string Linux commands together.

Prompt

Learn the common basic commands used on the Linux command line.

NOTE: The terminal session is logged. Please do not perform any denial of service attacks on the Linux server provided, malicious attempts to attack the Cyber Skyline platform will result in disqualification.

Questions & Answers

  1. What character can you use to redirect the output of one program as the input to another program?

    2. How to solve: Search online for this question as-is. Make sure to find an answer that is specific to redirecting from output from one program to another program (and not to a file). See the Trove for additional guidance.

    Answer: |

  2. What character can you use the redirect the output of a program to a file?

    3. How to solve: Search online for this question as-is. Make sure to find an answer that is specific to redirecting from output from one program to a file (and not to another program). See the Trove for additional guidance.

    Answer: >

  3. How many people have a first name of Jordan in names.csv?

    4. How to solve: Use cut to grab only the column of first names, then use grep to search for “Jordan” and then use wc -l to get a line count.

    cut -d "," -f 1 < names.csv | grep Jordan | wc -l

    Answer: 2

Extension Activities

6-8
Linux Command Bingo
Familiarize with common Linux commands.
Create Bingo cards with commands like ls, pwd, cd, mkdir, rm.Call out definitions or tasks (“Show me files in the folder”), students mark corresponding commands.First to bingo explains one command in detail.
9-12
Linux Trivia & Command Line Quiz
Reinforce command knowledge.
Prepare a quiz with multiple choice and practical terminal commands.Use interactive platforms or classroom polling.Include “Identify the command” from output examples.

Topic: Strings

Objective

Use the strings command to find hidden information in a file.

Prompt

The hackers have hidden a message in this image. Find out what it is.

Questions & Answers

  1. What is the hidden flag in the image?

    2. How to solve: Run the strings command on the image and search for text that contains “SKY”.

    strings STEG1.jpg | grep SKY

    Answer: SKY-RCLO-4839

Extension Activities

6-8
Guess the File Type
Use strings output to guess the type of file.
Give several files without extensions. Students use strings to extract text clues. Guess file types based on the strings (e.g., image metadata, code snippets, document text).
9-12
Build Your Own Binary File
Create a file with hidden text and practice extraction.
Use a hex editor or programming language (e.g., Python) to embed text inside a binary file. Use strings to extract it. Reflect on how data can be hidden and recovered.

Module: Log Analysis

Topic: SSH

Objective

Students will analyze the contents of an SSH log to identify adversarial behavior.

Prompt

Analyze this SSH log file to answer the following questions.

Questions & Answers

  1. What is the hostname of the ssh server that was compromised?

    2. Answer: myraptor

    Oct 11 10:12:00 myraptor sshd[29459]: Server listening on 0.0.0.0	port 22.
  2. What was the first IP address to attack the server?

    3. Answer: 169.139.243.218

    Oct 11 10:12:25 myraptor sshd[29465]: Failed password for harvey from 169.139.243.218 port 57273	ssh2
  3. What was the second IP address to attack the server?

    4. Answer: 56.13.188.38

  4. What was the third IP address to attack the server?

    5. Answer: 30.167.206.91

  5. Which user was targeted in the attack?

    6. Answer: harvey

    Oct 11 10:12:25 myraptor sshd[29465]: Failed password for harvey from 169.139.243.218 port 57273	ssh
  6. From which IP address was the attacker able to successfully log in?

    7. Answer: 30.167.206.91

    Oct 11 10:36:59 myraptor sshd[30003]: Accepted password for harvey from 30.167.206.91 port 55326	ssh2

Extension Activities

6-8
Log Line Match Game
Learn SSH terminology and log meanings.
Match terms like Accepted password, Failed password, port, user, IP to their meanings. Color code log lines by type (green for success, red for failed attempts).
9-12
Create Your Own SSH Log Puzzle
Design and share SSH log puzzles with classmates.
Students write their own fake SSH logs with a narrative: attack, success, mistake, etc. Swap puzzles and analyze each other’s scenarios.

Topic: Login

Objective

Students will use command line tools to analyze a custom application log format.

Prompt

Analyze a custom application login event log to help us understand user behavior.

Questions & Answers

  1. How many total login attempts were made in this log?

    2. How to solve: Get the line count of the log. (Reminder: at the end of the command, that is a lower case ‘L’ not a number 1)

    cat login.log | wc -l

    Answer: 6063

  2. How many unique usernames appear in this log?

    3. How to solve: Extract the third field (with the usernames) of the log, sort the usernames, get the unique usernames, and then get a line count of the number of unique usernames.

    cat login.log | cut -f 3 | sort | uniq | wc -l

    Answer: 1879

  3. What is the username with the most login attempts?

    4. How to solve: Extract the third field (with the usernames) of the log, sort the usernames, get a frequency count of each unique username, and then sort the unique usernames by frequency.

    cat login.log | cut -f 3 | sort | uniq -c |sort -n

    Answer: ntory

  4. How many attempts were made for the username with the most login attempts?

    5. cat login.log | cut -f 3 | sort | uniq -c |sort -n

    Answer: 124

  5. What is the date with the most login attempts?

    6. How to solve: Extract the first field (with the date+time) of the log, extract just the date, sort the dates, get a frequency count of each unique date, and then sort the unique dates by frequency.

    cat login.log | cut -f 1 | cut -d " " -f 1 | sort | uniq -c | sort -n

    Answer: 2011-03-23

  6. What is the username that had logins from the most unique IP addresses?

    7. How to solve: Extract the second field (with the IP address) and third field (with the username) of the log, sort the IP/username pairs, get the unique IP/username pairs, then extract just the usernames from each pair, sort the usernames, get a frequency count of how many unique pairs each username has, and then sort by frequency.

    cat login.log | cut -f 2,3 | sort | uniq | cut -f 2 | sort | uniq -c | sort -n

    Answer: wlfla0190

Extension Activities

6-8
Login Color Code
Visually interpret log entries.
Print or display several log lines.Students highlight: Green: Successful logins Red: Failed logins Blue: IP addresses Discuss: What can logs tell us about system usage?
9-12
User Behavior Profile
Analyze and profile user activity.
Provide anonymized logs for 2–3 users. Students summarize: Login times Access locations (IP)Behavior patterns Discuss: What’s normal vs suspicious?

Topic: VSFTPD

Objective

Students will analyze a VSFTPD log file.

Prompt

Analyze a VSFTPD log file that we obtained.

Questions & Answers

  1. What IP address did "ftpuser" first log in from?

    2. How to solve: Search for any entries that include “ftpuser”. One of these lines should include an IP address. cat vsftpd.log | grep ftpuser

    Answer: 10.0.0.123

  2. What is the first directory that ftpuser created?

    3. cat vsftpd.log | grep ftpuser | grep -i mkdir | head -n 1

    Answer: TreeSizeFree

  3. What is the last directory that ftpuser created?

    4. cat vsftpd.log | grep ftpuser | grep -i mkdir | tail -n 1

    Answer: 110D300S

  4. What file extension was the most used by ftpuser?

    5. How to solve: Search for successful file upload entries from ftpuser, extract the file extension for those uploads, and then get the frequency count for each unique file extension

    cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD' | awk -F ',' '{print $2 }' | awk -F "." '{print $2}' | sort | uniq -c | sort

    Possible Answers: jpeg, jpg, Joint Photographic Experts Group

  5. What is the username of the other user in this log?

    6. cat vsftpd.log | awk '{print $8}' | sort | uniq

    Answer: jimmy

  6. What IP address did this other user log in from?

    7. cat vsftpd.log | grep jimmy

    Answer: 10.0.0.214

  7. How many total bytes did this other user upload?

    8. How to solve: Search for successful file upload entries from jimmy, extract the number of bytes transferred, then sum the bytes cat vsftpd.log | grep jimmy | grep 'OK UPLOAD' | awk -F ',' '{print $3 }' | awk '{s+=$1} END {print s}’

    Answer: 105750628 bytes

  8. How many total bytes did ftpuser upload?

    9. cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD' | awk -F ',' '{print $3 }' | awk '{s+=$1} END {print s}’

    Answer: 13980839165 bytes

  9. How many total bytes did ftpuser download?

    10. cat vsftpd.log | grep ftpuser | grep 'OK DOWNLOAD' | awk -F ',' '{print $3 }' | awk '{s+=$1} END {print s}’

    Answer: 6008032 bytes

  10. Identify the IP address of the suspicious login (the login with no subsequent activity).

    11. How to solve: Search for all of the successful login attempts, extract the IP address used to log in, then sort and unique the IP addresses to identify IP addresses for manual inspection

    cat vsftpd.log | grep 'OK LOGIN' | awk -F '"' '{print $2 }' | sort | uniq

    Answer: 10.3.0.6

Extension Activities

6-8
FTP Role-Play Activity
Act out FTP log scenarios and decode them.
Assign roles (Client, Server, Logger).Simulate login attempts and file transfers.Logger writes log entries, others guess what actions they represent.
9-12
Create Your Own FTP Log Puzzle
Design a VSFTPD log mystery for peers.
Students generate fictitious VSFTPD logs with:Students generate fictitious VSFTPD logs with:One suspicious loginOne normal userA fake attack attemptPeers analyze the log and identify the risky event.

Topic: Nginx

Objective

Students will analyze an nginx access log.

Prompt

Analyze an nginx access log and answer questions about what happened.

Questions & Answers

  1. How many different IP addresses reached the server?

    2. Answer: 47

  2. How many requests yielded a 200 code?

    3. How to solve: Extract the third field after double quotes as the delimiter (which includes the HTTP codes), sort the codes, get the unique values with a count of the occurrences of each. Optional: sort in descending numeric order.

    cat access.log | cut -d '"' -f3 | cut -d ' ' -f2 | sort | uniq -c | sort -rn

    Answer: 19

  3. How many requests yielded a 400 code?

    4. cat access.log | cut -d '"' -f3 | cut -d ' ' -f2 | sort | uniq -c | sort -rn

    Answer: 38

  4. What IP address rang at the doorbell?

    5. cat access.log | grep "bell"

    Answer: 186.64.69.141

  5. What version of the Googlebot visited the website?

    6. cat access.log | grep "Googlebot"

    Answer: 2.1

  6. Which IP address attempted to exploit the shellshock vulnerability?

    7. How to solve: Search online for details about the Shellshock vulnerability. You should be able to find that the presence of this sequence of characters () { :; }; is an indication of an attempted exploitation of this vulnerability. With this knowledge, search the log for any lines with that sequence of characters.

    cat access.log | grep '() { :; };'

    Answer: 61.161.130.241

  7. What was the most popular version of Firefox used for browsing the website?

    8. How to solve: Search the log for all lines that contain “Firefox” and the following characters which make up the version number, sort those values, and then get a unique count.

    cat access.log | grep -o "Firefox/.*" | sort | uniq -c

    Answer: Firefox/31.0

  8. What is the most common HTTP method used?

    9. How to solve: Extract the 6th field (with the HTTP method), sort, get the unique values with a count of the occurrences of each value, and then sort in descending numeric order.

    cat access.log | awk -F " " '{print $6}' | sort | uniq -c | sort -rn

    Answer: GET

    Incorrect: POST, PUT, HEAD, DELETE, CONNECT

  9. What is the second most common HTTP method used?

    10. cat access.log | awk -F " " '{print $6}' | sort | uniq -c | sort -rn

    Answer: CONNECT

    Incorrect: GET, POST, PUT, HEAD, DELETE

  10. How many requests were for \x04\x01\x00P\xC6\xCE\x0Eu0\x00?

    11. Note that that command requires two backslashes for each original backslash to perform a proper escape sequence for the backslash.

    cat access.log | grep '\\x04\\x01\\x00P\\xC6\\xCE\\x0Eu0\\x00' | wc -l

    Answer: 6

Extension Activities

6-8
Website Detective
Match access log lines to website actions.
Give students fictional scenarios (e.g., visiting a page, clicking a link).Match them to the correct NGINX access log line. Match errors to mis-clicks (e.g., 404 for broken links).
9-12
Traffic Pattern Analysis
Analyze a set of access logs for usage trends.
Provide a few dozen real or simulated NGINX access log lines. Have students: Count total visits Identify top-requested URLs Chart visit frequency over time Use spreadsheets or visual tools for analysis.

Topic: History

Objective

Students will use SQL commands to analyze a SQlite database.

Prompt

Analyze a Firefox SQlite history database and answer questions about what happened. It you are not familiar with SQL you may want to learn more about SQL here: https://www.tutorialrepublic.com/sql-tutorial/

Questions & Answers

  1. What did the user search for on craigslist?

    2. Answer: bitcoin

  2. What was the current price (USD) of bitcoin when the user was browsing?

    3. Answer: $239.50

  3. What Bitcoin exchange did the user log in to?

    4. Answer: Coinbase

  4. What is the email that was used to log into the exchange?

    5. Answer: b1gbird@gmail.com

  5. What was the ID of the Bitcoin transaction that the user looked at?

    6. Answer: 5274cfba585a4b5681527a37f95c76340428916bb7480cef6c545f0a28dcd2d7 blockchain.info

  6. What was the total BTC value of all the inputs of the Bitcoin transaction?

    7. Answer: 0.22616302

  7. Which Bitcoin address received the majority of the Bitcoin in the transaction?

    8. Answer: 18z6bTFjxkXCmhfp8YBetR2wgmoVjXGJZz

Extension Activities

6-8
Log Story Sequencing Game
Reconstruct a digital activity timeline.
Provide: Cut-out log line cards with mixed-up order. User logs in at 8:00User opens a document. User edits document. User deletes a file User logs out Activity: Students rearrange the cards into the correct order. They write a one-paragraph summary of what happened based on the log.
9-12
Command Frequency Analysis
Determine behavior based on command frequency.
Provide a long history list with command repetition. Students: Tally top 5 used commands. Infer the user’s job (developer, admin, attacker?). Discuss what's "normal" vs "abnormal" usage.

Topic: Squid

Objective

Students will analyze a Squid proxy log.

Prompt

Analyze this Squid proxy log to answer the following questions.

Questions & Answers

  1. In what year was this log saved?

    2. How to solve: Take any of the Epoch timestamps and convert them into a human-readable date. An online tool, such as Epoch Converter, can be used to do this.

    Answer: 2010

  2. How many milliseconds did the fastest request take?

    3. How to solve: Extract the second field (the response time) and then sort the results numerically

    cat squid_access.log | awk '{print $2}' | sort -n

    Answer: 5

  3. How many milliseconds did the longest request take?

    4. How to solve: Same as the question above.

    cat squid_access.log | awk '{print $2}' | sort -n

    Answer: 41762

  4. How many different IP addresses did the proxy service in this log?

    5. How to solve: Extract the third field (the IP address of the proxy client), sort, get the unique values, and then get the line count.

    cat squid_access.log | awk '{print $3}' | sort | uniq | wc -l

    Answer: 4

  5. How many GET requests were made?

    6. How to solve: Extract the 6th field (the HTTP Request type), sort, and then get the unique values with a count of their occurrences. cat squid_access.log | awk '{print $6}' | sort | uniq –c

    Answer: 35

  6. How many POST requests were made?

    7. Answer: 78

  7. What company created the antivirus used on the host at 192.168.0.224?

    8. How to solve: The name of the company is found within the URLs of the requests made 192.168.0.224 . cat squid_access.log | grep "192.168.0.224"

    Answer: Symantec

  8. What URL is used to download an antivirus update?

    9. How to solve: Use the command from the question above and then find the URL that includes “virus” and “definitions”

    Answer: http://liveupdate.symantecliveupdate.com/streaming/norton$202009$20streaming$20virus$20definitions_1.0_symalllanguages_livetri.zip

Extension Activities

6-8
URL Scavenger Hunt
Explore responsible internet use.
Provide fake Squid logs with safe and unsafe URLs .Students highlight URLs that are: Educational Entertainment Suspicious or inappropriate Discussion: Why might schools block certain content?
9-12
Attack Simulation: Malicious Site Detection
Detect unsafe browsing behavior.
Some logs include suspicious URLs (e.g., phishing sites).Students must: Identify risky URLs Explain why they are suspicious Suggest how the network should respond (block? notify? educate?)

Topic: Log Payments

Objective

Students will analyze a SOAP log using the command line and a spreadsheet editor.

Prompt

A payment transaction log was compromised in a data breach. Help us determine what information was stolen.

Questions & Answers

  1. How many transactions are contained in the log?

    2. How to solve: Count the number of lines that start with PPAPIService: Request:

    Answer: 192

  2. What is the transaction ID of the largest purchase made in the log?

    3. Answer: 3a4da8c8-6934-4655-9ec5-335ab4540a2b

  3. Which state made the greatest number of purchases?

    4. Answer: massachusetts Incorrect: maryland

Extension Activities

6-8
Budget Match
Practice real-world math and budgeting.
Each student is given a budget (e.g., $20/week).They "shop" using log entries from a store list.Keep track of their spending and create their own log lines.
9-12
Policy Designer
Understand how rules protect users and systems.
After analyzing fictional logs, students propose:Spending limitsDaily caps on categories (e.g., junk food)Rules to prevent refunds/gift card abusePresent their “fraud prevention policy” to the class

Topic: Custom File Format

Objective

Students will parse a custom log format to extract meaningful information.

Prompt

We need to analyze a custom log format that we use to monitor data transfers on a secure network. Unfortunately, the parser was not committed to our code repository, but we do have a copy of the file format spec. See if you can use it and help us answer questions about the log file. Provide all date/timestamps as UTC.

Questions & Answers

  1. What is the hostname of the server?

    2. How to Solve: Calculate the length of the hostname, which is represented as a 4-byte integer at offset 13. Use this cyberchef recipe to calculate the length of the hostname, which is 14.

    Extract the hostname, which is an ASCII string of length 14 at offset 17. Use this cyberchef recipe to extract the hostname.

    Answer: sky-server-711

  2. What is the plaintext flag in the log file?

    3. How to Solve: Calculate the length of the flag, which is represented as a 4-byte integer at offset 31. Use this cyberchef recipe to calculate the length of the flag, which is 20.

    Extract the flag, which is an ASCII string of length 20 at offset 35. Then, perform a base64 decode. Use this cyberchef recipe to extract the flag.

    Answer: SKY-PARS-7325

  3. On what date was the file created (in UTC)?

    4. How to Solve: The date is a 4-byte timestamp at offset 9. Use this cyberchef recipe to extract the timestamp.

    Answer: 2018-03-03

  4. How many entries are in the log file?

    5. How to Solve: The number of entries is a 4-byte integer at offset 55. Use this cyberchef recipe to extract the number of entries.

    Answer: 161 or 162

  5. How many total transferred bytes were recorded in the log?

    6. How to Solve: The entries are each 16-bytes long starting at offset 59. The number of bytes transferred for each entry is a 4-byte integer that is at offset 12 from the start of each entry. You can use this cyberchef recipe to calculate the total transferred bytes. This recipe extracts the bytes for the entries, splits the data into 16-byte lines (one line per entry), extracts just the number of bytes transferred as an integer value, and then sums the total amounts.

    Answer: 811167

  6. How many unique IP addresses (both senders and receivers) are recorded?

    7. How to Solve: The entries are each 16-bytes long starting at offset 59. The source and destination IP addresses are each a 4-byte integers at are at offsets 0 and 4 from the start of each entry. You can use this cyberchef recipe to calculate the number of unique IP addresses. This recipe extracts the bytes for the entries, splits the data into 16-byte lines (one line per entry), extracts the source + destination IP addresses, splits those into 4-byte lines (one line per IP address), converts each line into a human-readable IP addresses, and then gets a count of the number of unique IP addresses.

    Answer: 13

  7. Which IP address sent the most amount of data?

    8. How to Solve: Use awk to parse the human-readable log.

    awk '{sums[$1]+=$4} END {for (ip in sums) print sums[ip], ip}' merged.log  | sort -n

    Create a hashtable where the keys are the source IP addresses (column 1), sum the number of bytes transferred (column 4) for each source IP address, print the result, and then sort by the most bytes transferred.

    Answer: 229.212.21.212

  8. How many total bytes were sent by the above IP address that sent the most amount of data?

    9. Answer: 145048

  9. What was the busiest day (day with the most bytes transferred)?

    10. How to Solve:

    awk '{sums[$3]+=$4} END {for (date in sums) print sums[date], date}' merged.log  | sort -n

    Answer: 2018-03-23

Module: Network Traffic Analysis

Topic: DNS

Objectives

Students will analyze a network packet capture to communicate an understanding of DNS.

Prompt

DNS is what enables us to access much of the internet without remembering IP addresses, analyze the network packet capture to understand more about DNS.

You can read this guide to learn more about computer networking.

Questions & Answers

  1. What is the type of the DNS query requested?

    2. Answer: AXFR

  2. What domain was requested?

    3. Answer: etas.com

  3. How many items were in the response?

    4. Answer: 4

  4. What is the TTL for all of the DNS records?

    5. Answer: 3600

  5. What is the IP address for the "welcome" subdomain?

    6. Answer: 1.1.1.1

Extension Activities

6-8
Guess That Domain!
Identify which domain names are real vs. suspicious.
Show 10 domains (e.g., netflix.com vs. netf1ix-login.xyz).Students vote whether it's safe or suspicious. Discuss how DNS could be used in phishing. Extension: Create their own fake (but safe!) domains and test each other.
9-12
Model a DNS Spoofing Attack
Understand how DNS can be exploited.
Students map out: How the spoofing occurs What the attacker gains How it can be prevented (e.g., DNSSEC, user awareness)Output: Students can write or present their scenario.

Topic: FTP Traffic

Objective

Students will analyze a network packet capture to communicate an understanding of FTP traffic.

Prompt

We found some interesting FTP traffic, analyze the network packet capture to identify what was transferred.

You can read this guide to learn more about computer networking.

Questions & Answers

  1. What was the first username:password combination attempt made to log in to the server? ex. 'user:password'

    2. Possible answers: user1/cyberskyline, user1:cyberskyline

  2. What software is the FTP server running? (Name and version)?

    3. Answer: FileZillaServer0.9.53

  3. What is the first username:password combination that allows for successful authentication?

    4. Possible answers: user1/metropolis, user1:metropolis

  4. What is the first command the user executes on the ftp server?

    5. Answer: dir, list

  5. What file is deleted from the ftp server?

    6. Answer: bank.cap

  6. What file is uploaded to the ftp server?

    7. Answer: compcodes.zip

  7. What is the filesize (in bytes) of the uploaded file?

      8. Possible Answer:

    1. 3303628E25D43BE4E11CC8878C5C5878
    2. 28183
    3. 28183 bytes
  8. What file does the anonymous user download?

    9. Answer: compcodes.zip

Extension Activities

6-8
"Guess the Protocol" Sorting Game
Compare how FTP works with other network services.
Provide printed “network traffic cards” with clues (e.g., "transfers files", "sends web pages", "sends email").Students sort them into categories (FTP, HTTP, SMTP, etc.). Highlight that FTP sends data in plain text, unlike HTTPS.
9-12
FTP vs. SFTP Comparison Lab
Understand the difference between FTP and SFTP.
Show examples (screenshots or logs) of FTP and SFTP sessions. Students identify: What data is visible in FTP (e.g., usernames, files)What’s encrypted in SFTP Extension: Propose a school policy recommendation: should your school block unsecured FTP?

Topic: HTTP

Objective

Students will analyze a network packet capture to communicate an understanding of HTTP.

Prompt

HTTP is how we're sending you this message, analyze the provided capture to answer the following questions about a HTTP download.

You can read this guide to learn more about computer networking.

Questions & Answers

  1. What Linux tool was used to execute a file download?

    2. How to solve: Apply thehttp.request filter and looking at the HTTP dissection. The “User-Agent” field in the HTTP portion of the packet is used to identify the software making the HTTP request.

    Answer: wget

  2. What is the name of the web server software that handled the request?

    3. How to solve: Apply the http.response filter and looking at the HTTP packet dissection. The “Server” field in the HTTP portion of the packet is used to identify the software responding to the HTTP request.

    Answer: nginx

  3. What IP address initiated request?

    4. How to solve: Apply the http.response filter and looking at the HTTP packet dissection. The Destination is the IP address that initiated the request.

    Answer: 192.168.1.140

  4. What is the IP address of the server?

    5. How to solve: Apply the http.response filter and looking at the HTTP packet dissection. The Source is the IP address of the server.

    Answer: 174.143.213.184

  5. What is the MD5 sum of the file downloaded?

    6. How to solve: Copy data into Cyberchef and add the following operations to the Recipe: Ensure data is in Hex, Determine file type, Calculate MD5 sum.

    Answer: 966007c476e0c200fba8b28b250a6379

Extension Activities

6-8
"HTTP vs. HTTPS: Spot the Difference" Scavenger Hunt
Understand the difference between HTTP and HTTPS.
Have students visit a list of sample websites (teacher-approved) and record:Which ones use HTTP Which ones use HTTPS (look for padlock in the URL bar) Create a chart or tally board. Discussion: Ask: What does the padlock mean? Why is HTTPS better for logging into websites?
9-12
HTTP vs. HTTPS Debate
Analyze the pros and cons of different web protocols.
Students research and prepare arguments for a debate:Should all websites be required to use HTTPS?Is HTTP ever acceptable?Roles: Debate teams + moderator + audience voters.

Topic: Telnet

Objective

Students will analyze a network packet capture to communicate an understanding of Telnet.

Prompt

Telnet is an older protocol that allowed an interactive text-oriented communication with remote systems, use the provided capture to answer the following questions about telnet.

Questions & Answers

  1. What is the username that was used to log in?

    2. Answer: test

  2. What is the password that was used to log in?

    3. Answer: capture

  3. What command was executed once the user was authenticated?

    4. Answer: uname

  4. In what year was this capture created?

    5. Answer: 2011

  5. What is the hostname of the machine that was logged in to?

    6. Answer: cm4116

  6. What CPU architecture does the remote machine use?

    7. Answer: armv4tl

Extension Activities

6-8
Telnet Time Capsule
Understand Telnet as part of Internet history.
Students research and create a short presentation or timeline: When and why Telnet was invented Why it’s not used much anymore What replaced it Extension: Build a “then vs. now” chart comparing Telnet and SSH.
9-12
Telnet Intercept Role-Play
Simulate a man-in-the-middle attack.
One student sends credentials via “Telnet” (on paper).Another student intercepts and reads it.Contrast with a scenario where the message is encrypted (SSH version: pass sealed envelopes).Discuss how attackers capture credentials using packet sniffers.

Topic: Packet Dissection

Objectives

Students will analyze a portion of a packet to identify how IP packet headers are structured.

Prompt

Dissect an IP packet header to understand how the protocol works.

You can read this guide to learn more about computer networking.

Data

Offsets
0
1
2
3
0
01000101
00000000
00000000
00111100
4
10101001
10011010
01000000
00000000
8
01000000
00000110
01001111
10010011
12
11000000
10101000
10000000
10000000
16
10011111
11001011
01100000
10011010
image

Questions & Answers

  1. What is the header checksum in hexadecimal representation?

    2. Answer: 4F93

  2. What is the TTL of the packet?

    3. Answer: 64

  3. What is the source IP address?

    4. Answer: 192.168.128.128

  4. What is the destination IP address?

    5. Answer: 159.203.96.154

Extension Activities

6-8
“What’s in a Packet?” Envelope Simulation
Understand that data sent over the internet is broken into packets.
Give students envelopes labeled as "packets. "Inside, place mock data: sender address, receiver address, content (e.g., “Hello World”), packet number. Students “send” the envelopes across the classroom. Others act as routers, forwarding based on destination. Some envelopes are “intercepted” by the “network analyst” who reads them aloud (to simulate unencrypted traffic).
9-12
Dissect a Protocol Worksheet
Identify how different protocols appear in packet structure.
Provide a simplified table with different protocol packets (e.g., DNS, HTTP, FTP).Students match: Protocol Typical ports Data shown in payload Risk level (e.g., “clear text,” “encrypted”) Rank the protocols by security

Topic: Decrypt

Objective

Students will decrypt a packet capture with an SSL key log file to analyze encrypted HTTPS traffic.

Prompt

The 'S' in HTTPS stands for secure and it uses the TLS/SSL protocol to achieve its security. Let's decrypt this traffic to find the hidden flag.

Questions & Answers

  1. What Cipher Suite was chosen by the secure socket server?

    2. Answer: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

  2. What is the domain covered by the SSL key?

    3. Answer: tomsvacations.com

  3. What is the flag transferred over HTTPS?

    4. Answer: SKY-LADN-1435

Topic: Pandora

Objective

Students will analyze a packet capture to reverse-engineer a custom network protocol and extract data.

Prompt

The hackers have created their own custom protocol for private communication. Luckily, our analysts have managed to obtain the documentation describing the protocol. Use the provided capture to answer the following questions about a custom protocol hackers have created.

Questions & Answers

1. What is the IP address of the server?

Answer: 10.1.0.20

2. What is the IP address of the client?

Answer: 10.1.0.217

3. What port is the server listening on?

Answer: 60123

4. What is the magic 2-byte ID in decimal representation?

Answer: 1047

5. How many encrypt requests were made by the client?

Answer: 5

6. What is the length of the first encrypt request?

Answer: 88

7. What is the length of the second encrypt request?

Answer: 72

8. How large is an individual encrypt hash in bytes?

Answer: 32

9. What was the encrypt response in hexadecimal form (e.g. FFFF) for the first request?

Answer: b8c97b08e198fa9ff79a3a9c1f0109b18687b7a1a3ff1772c29b4dc86753d711

10. What was the encrypt response in hexadecimal form (e.g. FFFF) for the second request?

Answer: 8817153ae81d94b5d6c745e63d1df31d5d02bd3b030b820c3c038654fdca619c

11. What is the hidden flag being sent over the protocol?

Answer: NCL-FJCG-1632

Topic: CAN Bus

Objective

Students will audit a CAN Bus packet capture to analyze vehicle network traffic and extract speed data.

Prompt

Ohm Motors has requested assistance with conducting a security audit on their CAN Bus protocol. They have provided a small code snippet. Use this to help you complete this report.

Questions & Answers

  1. How many unique CAN Bus IDs are present in this capture?

    2. How to Solve: Export the CAN bus IDs and data as a CSV file, then use a spreadsheet editor to calculate the number of unique CAN bus ID values.

    Answer: 36

  2. How many speed update messages are present in this capture?

    3. How to Solve: Use a spreadsheet editor to count the number of times calculate the number of lines that contain 589 in the ID column.

    Answer: 352

  3. What is the maximum speed, in mph, that this vehicle reached in the capture?

    4. How to Solve: Filter the data to only include lines that contain 589 in the ID column, then write a script that will ingest the data column of the CSV and perform the same calculations the code snippet to calculate the maximum speed.

    Possible Answers: 20.13, or 19.88, or 19.89 (differences due to rounding throughout vs at the end)

Topic: WiFi PCAP 1

Objective

Crack a WEP-encrypted wireless network by analyzing captured initialization vectors.

Prompt

We have created a packet capture from our test lab to see if you can handle the challenges of wireless password cracking.

Questions & Answers

  1. How many IVs are in the packet capture?

    2. Answer: 14337

  2. What is the key size of the wireless network data encryption method in bits?

    3. Answer: 64

  3. What is the IV for the first packet in the capture in hexadecimal representation?

    4. Answer: 003a33

  4. What is the WEP key?

    5. Answer: A4:81:53:B4:C

  5. What is the TCP checksum, in hexadecimal representation, of the first packet in the capture?

    6. Answer: 897b

Topic: WiFi PCAP 2

Objective

Crack a WEP-encrypted wireless capture to recover the network key and packet data.

Prompt

We have created a packet capture from our test lab to see if you can handle the challenges of wireless password cracking.

Questions & Answers

  1. How many IVs are in the packet capture?

    2. Answer: 24592

  2. What is the key size of the wireless network data encryption method in bits?

    3. Possible Answers: 128, or 104

  3. What is the IV for the first packet in the capture in hexadecimal representation?

    4. Answer: 0994ff

  4. What is the WEP key?

    5. Answer: DE:AD:10:CC:D1:5E:A5:EC:DC:C2:D6:7A:CA

  5. What is the TCP checksum, in hexadecimal representation, of the first packet in the capture?

    6. Answer: 08f0

Topic: WiFi PCAP 3

Objective

Crack a WPA wireless capture and investigate router configurations and network activity.

Prompt

We have created a packet capture on a temporary wireless network that a couple of hackers have set up. Break into their network and see what you can learn.

Questions & Answers

  1. What is the MAC address of the router?

    2. Answer: C0:4A:00:80:76:E4

  2. What is the ESSID of the wifi network?

    3. Answer: TP-LINK_8076E4

  3. What is the password for the wireless network?

    4. Answer: blueberrymuffin

  4. What is the IP address of the router?

    5. Answer: 192.168.0.254

  5. What company manufactured the router?

    6. Answer: tp link

  6. What is the model of the router?

    7. Answer: WR702N

  7. What firmware version is installed on the router?

    8. Answer: 4.19.1

  8. What release number is the router using?

    9. Answer: 52704n

  9. What is the IP address of the user who logged into the router admin panel?

    10. Answer: 192.168.0.101

  10. What is the MAC address of the first victim of the deauth attack?

    11. Answer: B8:E8:56:47:44:38

  11. What is the MAC address of the second victim of the deauth attack?

    12. Answer: 80:E6:50:0B:26:BA

Module: Password Cracking

Topic: Rockyou

Objective

Identify hash types in order to crack hashes using a common wordlist.

Prompt

Our analysts have obtained password dumps storing hacker passwords. After obtaining a few plaintext passwords, it appears that they overlap with the passwords from the Rockyou breach.

Questions & Answers

  1. 68a96446a5afb4ab69a2d15091771e39

    2. Answer: emilybffl

  2. ec5f0b1826389df8622133014e88afde

    3. Answer: ryjd1982

  3. 32e5f63b189b78dccf0b97ac41f0d228

    4. Answer: joybird1

  4. 2233287f476ba63323e60addca1f6b64

    5. Answer: kirkles

  5. 2233287f476ba63323e60addca1f6b64

    6. Answer: ddmack

Topic: Mask

Objective

Use a mask attack to recover the plaintext of a password.

Prompt

Our analysts have obtained password dumps storing hacker passwords. After obtaining a few plaintext passwords, it appears that they are all in the format: "SKY-HQNT-" followed by 4 digits. Can you crack them?

Questions & Answers

  1. 71b816fe0b7b763d889ecc227eab400a

    2. Answer: SKY-HQNT-8765

  2. 674291170dffcf620bda2a604a6820ea

    3. Answer: SKY-HQNT-7659

  3. 06f03267f31077d2c4b5c728472070ae

    4. Answer: SKY-HQNT-6598

  4. d866f4b3b34b598375149fb7661113ab

    5. Answer: SKY-HQNT-5981

  5. d9053951a8d1c15254b46ec9fc974a6b

    6. Answer: SKY-HQNT-9816

Topic: Pokemon

Objective

Create a wordlist to crack password candidates.

Prompt

Our analysts have obtained password dumps storing hacker passwords. After obtaining a few plaintext passwords, it appears that they are based on Pokémon.

Questions & Answers

  1. a532443f3e04a9e00295a8cd2a75e080

    2. Answer:  golduck

  2. 54c10b9736b70e75c6e505f340b6e2f1

    3. Answer: basculin

  3. b8a24794813a47521b4be55747e0665a

    4. Answer:  rotom

  4. 83b020b0a7b3c353e1c11b1647b53cda

    5. Answer: celebi

  5. 999cae1e22fe69d89d6f56e3050f18cb

    6. Answer: goldeen

Topic: Windows

Objective

Use ophcrack to crack Windows NTLM passwords.

Prompt

Our analysts have obtained Windows password dumps storing hacker passwords. Can you crack them?

Questions & Answers

  1. 21259DD63B980471AAD3B435B51404EE:1E43E37B818AB5EDB066EB58CCDC1823

    2. Answer:  starf0x

  2. 11CB3F697332AE4C4A3B108F3FA6CB6D:13B29964CC2480B4EF454C59562E675C

    3. Answer: P@ssword

  3. 65711C079DC4CD3CC2265B23734E0DAC:47F747C5190DC0F0B921AA4A07F06285

    4. Answer:  footba11

  4. FBBDA33FC12E83FB0C240E84A183686E:DDE9DC6E34E2E6E11EF9E51C6B27ED96

    5. Answer: 1trustno1

  5. 21C4E7C2EFE8E8D1C00B70065ED76AA7:A7A0F9AFD4A78F531A1CF4C42E531BBF

    6. Answer:  ectoplasm32

  6. E85B4B634711A266AAD3B435B51404EE:FD134459FE4D3A6DB4034C4E52403F16

    7. Answer: "=Cxu&L

  7. BA756FB317B622DBAAD3B435B51404EE:C8405270B10B13AE8A24612BB853567A

    8. Answer:  yhM^GK7

  8. 199C926FA387EAB7AAD3B435B51404EE:F196F77BF8BB15781BA8364C649C5FD4

    9. Answer: 58?-<C6

  9. FE4AACAAAD7D986AAAD3B435B51404EE:3928E16F614E2316CA51C336FA5B3011

    10. Answer:  $xEn@=y

  10. 3613F7EC15407F56AAD3B435B51404EE:C82E164316183AA3AF3EA6BAA642A237

    11. Answer: ^B7e3D;

Topic: PDF Cracking

Objective

Recover a password from a PDF file in order to open the file.

Prompt

We have captured an encrypted pdf from a hacker's FTP server. Decrypt it and find out what you can.

Questions & Answers

  1. What is the password used to encrypt the pdf?

    2. Answer: keanureeves2008

  2. What is the flag in the PDF?

    3. Answer: SKY-KANU-5902

Topic: Law & Order

Objective

Create a wordlist of episode names and use a mask attack to crack passwords.

Prompt

Our analysts have obtained password dumps storing hacker passwords. It appears that they are based off of Law and Order: SVU episodes and end in 2 digits.

Questions & Answers

  1. 6475c851b56004eb96ab1404252c3a34

    2. Answer: hooked37

  2. abe6591e06aafc3cf1b0783b120f685e

    3. Answer: manhunt74

  3. 1e1612db8bdeebc7e8d56f8f30b39456

    4. Answer:  philadelphia53

  4. 3dd9dd0e352df4433aadf2273e269287

    5. Answer: resilience05

  5. 08038f679de74982bfb9bac43d46271a

    6. Answer:  unorthodox12

Topic: Kali Linux

Objective

Crack a yescrypt password hash included in Kali Linux.

Prompt

We have obtained /etc/shadow from a Kali Linux machine. Help us obtain the password, we think this might be a using a password from the Rockyou wordlist.

Questions & Answers

hollie:$y$j9T$/WzixhAsn8sdXhCquYzh01$KZlio78LilItobsx/17ecFf1e2SbsduhP1sZEWuHrL4:18934:0:99999:7:::

  1. What is the username of the only user account with a password?

    2. Answer: hollie

  2. On what date was the user's password last changed?

    3. Answer: 2021-11-03

  3. What is the salt used to secure the user's password?

    4. Answer: /WzixhAsn8sdXhCquYzh01

  4. What is the hash digest of the user's password?

    5. Answer: KZlio78LilItobsx/17ecFf1e2SbsduhP1sZEWuHrL4

  5. What is the plaintext password of the user's password?

    6. Answer: hollie03

Module: Forensics

Topic: Version Control

Objectives

Use Git to examine file system metadata and conduct artifact analysis.

Prompt

One of our employee's computers was compromised and we saw this backup file leave the network, but we couldn't find anything other than a simple README.md file in it. Help us found out what information the hackers got.

Questions & Answers

  1. What is the email address of the employee who was compromised?

    2. Answer: gpeterson@mpd.hacknet.cityinthe.cloud

  2. Each employee is assigned a flag. What is the flag that was compromised?

    3. Answer: SKY-LRHX-4910

  3. Greg thinks that he may have had additional account credentials that were compromised. What's the name of the service provider for that other compromised account?

    4. Answer: facebook

  4. What was the password on that compromised account?

    5. Answer: waffles85

Topic: PDF Examination

Objective

Use a PDF editor to examine file metadata and conduct artifact analysis.

Prompt

Our analysts managed to get hold of a document that we believe has a flag on it. Can you recover it?

Questions & Answers

  1. What is the name of the program that exported this PDF file?

    2. Answer: Photoshop

  2. What PDF version is this file?

    3. Answer: 1.7

  3. What software was used to redact the file and insert a watermark?

    4. Answer: pdftron

  4. What is the flag?

    5. Answer: SKY-PDRD-2390

Topic: File Carving

Objective

Use a hex editor or a forensics tool to perform file signature analysis and recover hidden files.

Prompt

The security team has found a rather strange file exiting the network, we're not sure if it's containing any sensitive information. Help us identify what's in it.

Questions & Answers

  1. This file initially looks like something green, what's the file format of this green file?

    2. Answer: PNG or portable network graphics

    Incorrect: JPG, JPEG, BMP, GIF

  2. How many files can be extracted from the binary blob?

    3. Answer: 6

  3. What is the hidden flag in the file?

    4. Answer: SKY-RWCI-4291

Topic: Magic Bytes

Objective

Use a hex editor or a forensics tool to perform a file signature analysis and repair the file.

Prompt

This file appears to be changed in some way. Can you recover the original?

(You can use either CyberChef or a tool of your choosing to complete this challenge)

Questions & Answers

  1. What is the original file type?

    2. Answer: PNG, png, or Portable Network Graphics

  2. What is the flag?

    3. Answer: SKY-DSFG-5792

Topic: Doctor

Objective

Use a hex editor or a forensics tool to perform file signature analysis and recover hidden files from a Microsoft Word Doc.

Prompt

We think this document is hiding something. Can you find what is hidden?

Questions & Answers

  1. What is the name of the hidden file containing the flag?

    2. Answers: image0.png, image0

  2. What is the flag?

    3. Answer: SKY-RATL-8439

Topic: The Book

Objective

Analyze and search through a live Windows memory dump to extract the SQL database from memory.

Prompt

We have obtained a live system memory dump from a hacker's computer before it fried itself. The hacker was looking at a suspicious document. Can you retrieve the lost information?

Questions & Answers

  1. What operating system was this dump taken from?

    2. Answer: Windows

  2. What is the name of the computer?

    3. Answer: DESKTOP-OT97GG3

  3. What is the name of the user that was logged in?

    4. Answer: liber8hacker

  4. What is the full filepath and file of the file in interest?

    5. Answer: Users\liber8hacker\Desktop\black_book.db

  5. What is the real name of "cloud"?

    6. Answer: Gloria Hampton

  6. What is the password of the currently logged in user?

    7. Answer: avatar2

Module: Scanning & Reconnaissance

Topic: Dig

Objective

Use DNS services to gain information about an organization's internet resources.

Prompt

You've been tasked to help the newly launched company, Fortaigan, audit its DNS records.

To complete the tasks, use the device with the resolver hostname in the provided terminal as the DNS resolver to query for fortaigan.net.

Questions & Answers

  1. What is the IPv4 address for fortaigan.net?

    2. Answer: 104.231.72.5

  2. How many mail servers does fortaigan.net have?

    3. Answer: 3

  3. What's the name of the mail server that takes the first priority?

    4. Answer: maila2.fortaigan.net

  4. What is the IPv4 address of the name server record for fortaigan.net?

    5. Answer: 104.231.73.10

  5. What's the full name of the responsible person at fortaigan.net?

    6. Answer: Leo Danza

  6. What is the text flag found in the DNS records?

    7. Answer: SKY-PZUV-5091

  7. What is the priority number given to the SIP service using the TCP protocol on fortaigan.net?

    8. Answer: 0

  8. What is the IPv4 address of the machine that's running the SIP service for fortaigan.net?

    9. Answer: 104.231.74.3

Topic: NMAP

Objective

Scan a target host using Nmap to identify open TCP and UDP ports.

Prompt

Test your understanding of port scanning by scanning the website and answering these questions.

Questions & Answers

  1. What is the lowest open port on the system?

    2. Answer: 7

  2. What is the second lowest open port on the system?

    3. Answer: 13

  3. What is the third lowest open port on the system?

    4. Answer: 37

  4. What is the lowest UDP port on the system?

    5. Answer: 7

  5. What software is being run on port 16080?

    6. Answer: nginx

Topic: Git

Objective

Investigate a Git repository's history to uncover hidden flags and metadata.

Prompt

Analyze a git project and find some hidden flags. You can try to clone the repository but that might not work for you. If not, you'll need to find a way around it.

Questions & Answers

  1. What is the display name of the author of this git project?

    2. Answer: Cyber Cyber

  2. What is the short commit hash (first 8 characters) of the initial commit?

    3. Answer: F9714EDD

  3. What is flag #1?

    4. Answer: SKY-HSNO-2303

  4. What is flag #2?

    5. Answer: SKY-OZNW-3730

  5. What is flag #3?

    6. Answer: SKY-CCXL-4067

  6. What is flag #4?

    7. Answer: SKY-IRRK-9672

  7. What is flag #5?

    8. Answer: SKY-DKIT-9801

Topic: Net Track

Objective

Communicate with a text-based service using netcat/telnet.

Prompt

Can you interact with the strange server and see what information you can extract?

Questions & Answers

  1. What is the name and version of the software?

    2. Answer: RadicalShell v9

  2. What is the flag?

    3. Answer: SKY-NCAT-3071

  3. What is the size of the largest file in bytes?

    4. Answer: 40 bytes

Topic: Metadata

Objectives

Scan an AWS EC2 Metadata Service to extract information about the instance.

Prompt

We have found what appears to be a server displaying metadata about a cloud service. Can you find out more information?

Questions & Answers

  1. What availability zone is this instance hosted in?

    2. Answer: us-west-2a

  2. What is the security credentials role named?

    3. Answer: liber8-role

  3. What is the instance type being used?

    4. Answer: c6g.16xlarge

  4. What is the operating system name and version number?

    5. Answer: Ubuntu 16.04

  5. What is the flag?

    6. Answer: SKY-AWSM-1570

Module: Enumeration & Exploitation

Topic: Bytes

Objective

Students will analyze a Python script to identify the value that will return ‘True’ from the program.

Prompt

Determine the secret password that will validate successfully against the verify function. We've been having trouble getting it to run, but we saw it running properly on a different system. The code seems to be a bit old, maybe you can find the right environment/configuration to get it to run.

Questions & Answers

  1. What language is this program written in?

    2. Answer: Python

  2. What is the password that will successfully pass the verify function?

    3. Answer: 534b592d484558482d35363830

Extension Activities

6-8
Byte Builder Game
Understand how bytes store data.
Students use cards or tiles to build bytes (e.g., 01101100) and match them to letters using an ASCII table. Extension: Convert a secret message from text to bytes and exchange with peers to decode.
9-12
Secure or Suspect? Byte Tampering Simulation
Understand how changing a few bytes can change software behavior.
Provide a small Python or C program with an embedded message or function. Task: Modify the byte pattern to alter behavior (harmless examples), then suggest protections like checksums or hashes. Extension: Discuss real-world tampering and software integrity checks.

Topic: Python 1

Objective

Students will analyze a Python script to calculate an input that will authenticate with the program.

Prompt

We have created a python script for you to break into as training. See if you can figure out a password that will authenticate with the program. Note: The password cannot contain special characters.

#!/usr/bin/python
import sys

def main():
if len(sys.argv) != 2:
print("Invalid args")
return
password = sys.argv[1]
builder = 0
for c in password:
builder += ord(c)
if builder == 1000 and len(password) == 10 and ord(password[1]) == 83:
print("correct")
else:
print("incorrect")

if **name** == "**main**":
main()

Questions & Answers

  1. What is a secret key that will pass validation?

    2. Possible Answer: mSeeeeeeee (multiple answers exist)

Extension Activities

6-8
Code Detectives: Spot the Unsafe Python
Understand what unsafe coding looks like—even without writing code.
Students receive simplified Python code snippets (e.g., saving a password in plain text, printing private data to screen).Task: Highlight “unsafe” lines and explain why they’re risky.Extension: Rewrite one unsafe line as a "safe" version (e.g., masking a password).
9-12
Secure or Suspect? Analyze Python Code for Risks
Practice identifying real-world security flaws.
Provide code samples involving:SQL injection vulnerabilitiesHardcoded credentialsLack of input validationTask: Students annotate and explain each flaw, then refactor code to improve security.

Topic: Python 2

Objective

Students will analyze a compiled Python script to calculate an input that will authenticate with the program.

Prompt

We have created a python script for you to break into as training. See if you can figure out a password that will authenticate with the program.

Questions & Answers

  1. What is a secret key that will pass validation?

      2. Possible Answers:

    1. mysupersecretpassword
    2. m_s[persecreZpass]ord
    3. m_supersecretpassword

      4. Incorrect: M_supersecretpassword

Extension Activities

6-8
Cyber Hero Comic: “Fixing the Python Bug”
Introduce the concept of secure coding through storytelling.
Students create a short comic where a character finds a cybersecurity bug in a Python app and saves the day.Topics to Include: Weak passwords, missing updates, phishing via Python app.
9-12
Threat Modeling a Python App
Use critical thinking to anticipate attacks.
Students choose or are assigned a basic Python app (e.g., to-do list, chat system, calculator).Identify: Assets to protect (user data, access levels)Threats (malicious input, unauthorized access)Mitigations (authentication, logging, error handling)

Topic: Python 3

Objective

Students will analyze a Python script to calculate an input that will authenticate with the program.

Prompt

We have created a python script for you to break into as training. See if you can figure out a password that will authenticate with the program.

Questions & Answers

  1. What is an input to this program that will result in a correct validation?

      2. Possible Answers:

    1. N>>>>>>>>>>
    2. NOTC0FFEE

      3. Incorrect:

    3. NAAAAAAAANZ

Extension Activities

6-8
Safe Login Flowchart
Model secure authentication steps without needing to code.
Students draw a flowchart of a secure login system for a Python app. Include: Username/password check Two-factor authentication Password retry limits
9-12
Ethics in Software Security: Class Debate
Explore legal and ethical issues in Python development.
Debate Prompts: “Should ethical hackers be paid for finding bugs in open-source Python code?” “Is it ethical to reverse-engineer someone else’s Python software for research?” Task: Prepare arguments and consider ethical, technical, and business perspectives.

Topic: Timebomb

Objective

Students will decompile a .class file and extract its original source code to understand its logic.

Prompt

Reverse engineer a program to find out when it activates.

Questions & Answers

  1. What programming language is the program written in?

    2. Answer: java Incorrect: JavaScript

  2. What exit code does the program exit with when it is not time?

    3. Answer: 10

  3. What time (in UTC) does the software go "Boom"?

    4. Answer: 2022-07-17 13:13 (also accepted: 2022-07-17 13:12) Incorrect: 2022/07/17 09:12

Topic: Not Affine

Objective

Students will perform code analysis on C source code to reverse a series of bitwise operations.

Prompt

Math is often tricky and hard, which is why we make computers do math for us. That being said, it's important to know how to solve the math when the bidding is essential.

Questions & Answers

  1. What are the dimensions of the transform_matrix variable?

    2. Answer: 3x3

  2. What is the integer value stored at transform_matrix[0][1]?

    3. Answer: 3

  3. What is the header file that provides functions like isdigit and isalpha?

    4. Answer: ctype.h

  4. What is the hex value assigned to the letter_r_xor_key variable?

    5. Answer: 1A

  5. A matrix change is applied to the letters at indices 0 to 2. What are these three letters in the target_string?

    6. Answer: EOC

  6. What is the input that correctly works for this code?

    7. Answer: SKY-MMTR-4555

Topic: Binary 1

Objective

Use a disassembler (like ghidra) to exploit a compiled binary.

Prompt

We need to break into a program that the hackers have created. You will need to provide the identifier, 7074, as the only argument to the program.

Questions & Answers

  1. What is the flag hidden in the program?

    2. Answer: NCL-EZOF-4024

Topic: Binary 2

Objective

Students will use a debugger to exploit a compiled binary.

Prompt

We need to break into a program that the hackers have created. You will need to provide the identifier, 4930, as the only argument to the program.

Questions & Answers

  1. What is the flag hidden in the program?

    2. Answer: NCL-FYOF-0044

Module: Web Application Exploitation

Topic: egov

Objective

Students will utilize web cookies to check the permission level of the user.

Prompt

Conduct a security audit on the egov login panel.

Note: This challenge is limited to HTTPS in scope, please do not attack any other ports on this server.

Questions & Answers

  1. What is the flag obtained from logging in?

    2. Answer: ⚠️ The flag is randomly generated so the correct flag for you will be different.

Extension Activities

6-8
What Is eGov? Digital Government Scavenger Hunt
Discover how governments provide digital services.
Provide students with a list of real eGov services to explore (e.g., paying taxes online, renewing licenses, voter registration).For each service, they identify:What information is collected?What kind of data is most sensitive?Discuss: What happens if that data is stolen?
9-12
Threat Modeling: Secure the eGov Portal
Think like a security architect.
Provide a sample eGov system diagram (e.g., for tax filing or online voting).Students identify:Assets (personal data, government records)Threats (SQL injection, data leaks, phishing)Protections (HTTPS, code validation, firewalls)Create a “threat model chart.”

Topic: Never Winter Bank

Objective

Analyze Java script code on a website to find an exploit to utilize.

Prompt

You have been hired to run a pentest on this bank's old out of date system. Can you find the vulnerability in the code and drain this user's account?

Questions & Answers

  1. What is the path of the leaked file?

    2. Answer: /dev/rel.js

  2. What is the flag?

    3. Answer: ⚠️ The flag is randomized, follow the guide to capture the flag

Extension Activities

6-8
Password Protection Relay
Understand how secure passwords protect financial systems.
Teams create a strong password using rules (e.g., 12+ characters, mix of symbols, no common words).Relay Game: Each team passes a “password baton” and explains: Why their password is strong What could make it better Extension: Add a quick "Phishing Alert" round where students respond to fake email examples.
9-12
Digital Heist Simulation: Red Team vs. Blue Team
xperience ethical hacking vs. defense thinking.
Divide students into: Red Team: Identifies ways to exploit insecure software in the bank Blue Team: Proposes countermeasures (patches, protocols, training)Scenario: The bank has just updated its app—what could go wrong? Follow-up: Reflect on real-life cybersecurity careers (penetration tester, software security analyst).

Topic: Cloud Marketing

Objectives

Students will use knowledge of penetration testing principles to identify a directory traversal vulnerability.

Prompt

A hot new firm just opened up to help organizations with digital marketing, but it seems like they need some help with security. Identify the security vulnerability and demonstrate to the firm that their web server is not securely configured by proving that you can extract the contents of /etc/flag from their web server.

Note: Your scope is limited to HTTPS & you may not use automated bruteforce tools for this challenge.

Questions & Answers

  1. How many people are listed on their firm's team page?

    2. Answer: 7

  2. What path does the firm not want search engines to index?

    3. Answer: /wp-admin

  3. What is the value of the flag?

    4. Answer: ⚠️ The flag is randomized, follow the guide to capture the flag

  4. What is the common name of the vulnerability used to retrieve the flag?

    5. Accepted Answers: Directory traversal, path traversal, or folder traversal

Topic: Metro Lottery

Objective

Analyze Javascript on a webpage in order to exploit trusted client input.

Prompt

Players of the Metropolis online lottery are able to get a win percentage of more than 80% resulting in more people winning than should be statistically possible. Conduct a security audit to determine the cause.

Note: This challenge is limited to HTTPS in scope, please do not attack any other ports on this server and do not brute force attack this web server.

Questions & Answers

  1. What is the flag obtained after winning the lottery?

    2. Answer: ⚠️ The flag is randomly generated so the correct flag for you will be different.

Extension Activities

6-8
Tamper Alert Game
Learn what tampering means in digital systems.
Create a card game or worksheet where some “lottery entries” are altered.Students identify which entries are valid and which might be fraud.Discuss: Why would someone cheat? How can software detect that?
9-12
Lottery Fraud Case Study
Analyze real-world lottery frauds to identify software flaws.
Example: The 2017 Iowa Hot Lotto insider fraud (Eddie Tipton case).Students research:What system was hacked?How was random number generation compromised?What could have prevented it?Deliverables: Slide presentation or short paper with solutions.

Topic: Todo

Objectives

Use knowledge of penetration testing and JavaScript cookies in order to expose a cross-site scripting vulnerability.

Prompt

We've uncovered a todo list made by the nefarious Liber8tion group. There seems to be a flag hidden in the admin user's cookies. The admin user periodically checks the todo list to make sure employees are actively working, can you extract the flag from them? Note: Your scope is limited to HTTPS & you may not use automated brute-force tools for this challenge.

Questions & Answers

  1. What is the name of the vulnerability used to get the flag?

    2. Answer: Cross site scripting, XSS

  2. What is the flag found in the admin user's cookies?

    3. Answer: SKY-XSSV-8390

  3. What is the User Agent of the account the flag was extracted from?

    4. Answer: Liber8-XSS-Bot

Topic: Leek

Objectives

Students will use penetration testing knowledge to identify and exploit a type confusion vulnerability.

Prompt

Our favorite grocery store allegedly has a vulnerability, can you replicate it?

Questions & Answers

  1. What is the flag?

    2. Answer: ⚠️The flag is randomly generated so the correct flag for you will be different.

Topic: Metro Clinic

Objective

Craft SQL statements in order to exploit a vulnerability in an organization’s database.

Prompt

Conduct a security audit on the city's medical directory system.

Note: This challenge is limited to HTTPS in scope, please do not attack any other ports on this server and do not brute force attack this web server.

Questions & Answers

  1. What is the name of the only Orthopedist?

    2. Answer: Tracy Gill

  2. What is Katie Cain’s profession?

    3. Answer: Neurologist

  3. How many medical professionals can be found in this registry?

    4. Answer: 11

  4. What is the name of the person who has a password of "greyblob"?

    5. Answer: Kim Jenkins

  5. What is Mike Torres' password?

    6. Answer: SKY-VJDT-4472

Extension Activities

6-8
Build a Secure Login System (Unplugged Coding)
Model basic authentication logic.
Use flowcharts to plan how the clinic software should check usernames and passwords. Add "Too many failed attempts? Lock account!" logic. Materials: Paper, pens, optional online flowchart tools like Lucidchart or Draw.io.
9-12
Code Investigation: Find the Flaw
Identify security weaknesses in sample code.
Students are given pseudocode or beginner Python code for a login system at Metro Clinic Task: Identify at least three security flaws (e.g., storing plain text passwords, lack of input validation).Suggest how to fix each issue.