DFIR-LABS - DFIR LABS - A compilation of challenges that aims

项目说明

!DFIR LABS

About

DFIR LABS is a compilation of challenges that aims to provide practice in simple to ad concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.

This is aimed at Professionals, Security Researchers, Students, CTF Players as well as DFIR & Malware Analysis Enthusiasts in the field of Cyber Security who want to practice or have an interest in the aforementioned topics.

Though the final goal of the challenges is CTF-styled flags, most of the challenges are in the traditional and effecti method of answering an incident response scenario.

The first release of DFIR LABS is focused primarily on Windows-based challenges. Future and upcoming editions will broaden the scope to include Linux, MacOS, and Android, offering a comprehensi of DFIR challenges across diverse platforms.

Our is to create a comprehensi that grows with the community, incorporating modern threats and techniques, and fostering collaboration across diverse cybersecurity domains. Whether you're a beginner or an expert, DFIR LABS offers a unique opportunity to sharpen your skills and stay ahead in this e field.

Important Notice

Indi are strongly advised against executing any executables or binaries provided in the challenge files, as they may contain potentially malicious software. Authors of DFIR LABS holds no responsibility for any consequences resulting from the use of these files, including but not limited to system compromise, data loss, or operational disruptions. To mitigate risks, all acti should be conducted within a secure, isolated en such as a machine or sandboxed setup. Ensure your testing infrastructure is robust and appropriately configured to handle potential threats.

> Warning <br>
> The challenges in DFIR LABS are designed to simulate real-world scenarios and may contain potentially harmful softwares like ransomware, trojan, stealers, c2, etc., Always exercise caution and use a secure, isolated en when working with these challenges.

Challenges

| Chall-Name | Difficulty | Author(s) |
| --- | --- | --- |
| Gotham Hustle | Easy | Azr43lKn1ght |
| Trinity Of Secrets | Easy | rudraagh, kr4z31n, __ m1m1 __ |
| 2-layer security | Easy | bquanman |
| Winserpart | Easy | Azr43lKn1ght,jl_24, gh0stkn1ght, sp3p3x |
| Kn1ghtfl4r3 | Medium | kr4z31n, __ m1m1 __, rudraagh |
| | Medium | sp3p3x, jl_24, gh0stkn1ght, hrippi.x_ |
| Co Scenario | Medium | ws1004 |
| pf-ing | Medium | k.eii |
| The Malware Crusade | Medium | Azr43lKn1ght, sp3p3x, jl_24 , gh0stkn1ght, 5h4rrk |
| Compromised | Medium | Abdelrhman |
| DFIR 2025 Ⅰ - Lost In Router | Medium | Suyun|
| Shiunji-ouka | Medium | k.eii|
| Famous AMOS | Medium | warlocksmurf |
| The Saint Bat | Medium | Azr43lKn1ght |
| Stealth | Hard | bquanman |
| Interesting | Hard | k.eii |
| Thugs on a boat | Hard | bquanman |
| Batman In I | Hard | Azr43lKn1ght |
| Not My Mod Files Bestie | Hard | mooofinnn |
| Master of DFIR - Phishing | Hard | crazyman, F0rest, yuro |
| Master of DFIR - Coffee | Hard | crazyman, F0rest |
| ReAL File System | Hard | 5h4rrk |
| Hidden Gem Mixtape | Hard | bquanman |
| Kn1ghtF4LL | Hard | Azr43lKn1ght, sp3p3x, jl_24, gh0stkn1ght |
| Breadcrumbs | Insane | Abdelrhman |
| DFIR 2025 Ⅱ - fake news | Insane | crazyman, bquanman, F0rest, yuro |
| DFIR 2025 III - who is spyder | Insane | crazyman, F0rest |
| Batman In II | Insane | Azr43lKn1ght |
| Batman In III | Insane | Azr43lKn1ght |
| Kn1ghtw4r3 | Insane | Azr43lKn1ght, gh0stkn1ght, jl_24, sp3p3x, hrippi.x_ |
| S4nct1m0ny | Insane | gh0stkn1ght |
| Kn1ghtm4r3 | Insane | Azr43lKn1ght |
| Batman In IV | Insane | Azr43lKn1ght, jl_24, sp3p3x, gh0stkn1ght |
| Kage No Nazo | Insane | jl_24 |
| Batman In V | Insane | Azr43lKn1ght, Kr4z31n |
| Batman In VI | Insane | Azr43lKn1ght |
> Note <br>
> The difficulty level of each challenge is subjective and may vary based on indi experience and skill level.
> The challenges are designed to be completed in a specific order, with each challenge building upon the previous one. However, participants are free to attempt the challenges in any order they prefer.

En Setup

To ensure a secure and efficient analysis en, follow these steps:

Feedback/ Suggestions

Any and all feedbacks, suggestions or impro are welcome! We would appreciate any feedbacks from the community.

Send your feedback on X: Azr43lKn1ght

How to Contribute

If you are interested in contributing to DFIR LABS, please refer to the CONTRIBUTING.md file for more information.

Usage

DFIR Labs is absolutely free for anyone to use. If you wish/want to use DFIR Labs in your workshops, Sessions or anywhere else, Please always use the original links to the labs and also mention the author's name and the labs as well. For any other queries, please contact me via email or twitter/X : Azr43lKn1ght

Circle of Gratitude

We extend our deepest gratitude to e who has played a part in the success of DFIR LABS. This project thrives on the passion, expertise, and unwa dedication of our core contributors and supporters. A special acknowledgment goes to the incredible teams that ha and enriched this initiative:

We are profoundly grateful for the continued encouragement, insightful feedback, and inspiration from the global DFIR and cybersecurity community. Your support fuels the growth and e of DFIR LABS, and we are honored to have you alongside us on this journey!

Tools and Resources

Here are some of the most used open-source tools that will help you in solving the challenges:
#### Network Analysis

#### Memory Forensics

#### Disk, File System and Windows Forensics

#### Debugging and Reverse Engineering

Process Analysis

Binary and PE Analysis

Here are some of the most used resources that will help you in solving the challenges:

#### Blogs:

#### CTF Writeups

#### YouTube Channels

#### Guides and References

#### Books

Discord

Join our Discord server to connect with the DFIR community, share insights, and collaborate on cybersecurity challenges. The server is open to all cybersecurity enthusiasts, students, professionals, and researchers. We welcome diverse perspectives and encourage acti in discussions, workshops, and CTF events.

DFIR LABS Community Discord

Also join the Digital Forensics Discord server for more discussions and resources on DFIR topics.

Digital Forensics Discord

Chief Author and Maintainer

Azr43lKn1ght - Twitter | Linkedin | Github

项目信息

开发语言：Python

Star 数：600

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕DFIR LABS - A compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。