ctf_writeups - This repository contains detailed Capture The Flag

项目说明

!Total Writeups
!Endpoint Forensics
!Network Forensics
!Mobile Forensics
!IDS/IPS
!SIEM
!CTI
!Email Analysis
!Malware Analysis
!Reverse Engineering
!Pentesting

CTF Writeups

Welcome to my CTF Writeups repository! Here, I document the solutions and methodologies used to sol Capture The Flag (CTF) challenges. This repository is intended to serve as a learning resource for others interested in cybersecurity and CTF competitions.
Capture The Flag (CTF) competitions are a popular way to practice and impro skills. These competitions present challenges that require problem-solving, creativity, and technical knowledge.

Writeups

The writeups in this repository (located in the "writeups" folder) are categorised based on the nature of the challenge. Each writeup provides step-by-step solutions, along with explanations of the tools and techniques used. The difficulty rating associated with each challenge matches the difficulty rating given by the platform hosting the challenge/lab/ctf, therefore, take it with a grain of salt as some challenges rated as hard are actually easy, etc. The rating is out of 5, where 5 stars means the challenge is enjoyable and 1 being not enjoyable. Whilst this will of course ha bias, my rating is not on the basis of whether I enjoyed it, it's more on the quality and realism of the challenge.

Disclaimer! In all honesty, some of these writeups are written poorly, mainly because I complete them to learn practical skills, not to practice reporting. When it comes to well written writeups, I recommend reading my most recent ones.

Where to Start

I recommend starting with the easy or medium rated challenges, there is honestly little difference between the two ratings for the most part. You can find challenges associated with each difficulty rating by clicking CTRL + F and pasting one of the following tags:

🟢 Easy

🟡 Medium

🔴 Hard

When it comes to what platform to use, that depends on your interests and skill level. For DFIR (digital forensics and incident response) and CTI (cyber threat intelligence) based challenges I highly recommend CyberDefenders, as it provides the most realistic challenges and often requires the use of VMs or a home lab. If you are a beginner, TryHackMe is a great place to start, as it often provides a VM or you can always use the AttackBox which comes preinstalled with a bunch of tools. Lastly, if you are intersted in becoming a blue teamer (stricly SOC operations), I recommend checking out blue team labs online (BTLO).

Table of Contents

Endpoint Forensics

Network Forensics

Mobile Forensics

IDS/IPS

SIEM (ELK, Splunk, etc.)

Cyber Threat Intelligence (CTI)

Email Analysis

Malware Analysis

Reverse Engineering

Pentesting

Tools Used

Personal Platform Profiles

<br>

Endpoint Forensics

These challenges mainly invol compromised endpoints, primarily Windows and Linux, using a of forensic tools.
| Challenge | Writeup | Challenge Link | Difficulty | Rating | Tags |
|-------------------------------|--------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|------------|----------|-----------------------------|
| KioskExpo7 Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | DB Browser for SQLite Registry Explorer MFTECmd Timeline Explorer PECmd Notepad++ R-Studio MFT Explorer |
| XMRig Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Built-in Linux Tools Photorec Linux Forensics |
| ConfluenceRCE Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | grep uniq cut Built-in Linux Tools Linux Forensics |
| Stealthy Ascent Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐ | Built-in Linux Tools Linux Forensics |
| RepoReaper Lab | PDF | CyberDefenders | 🔴 Hard | ⭐⭐⭐⭐⭐ | FTK Imager DB Browser for SQLite DCode Event Log Explorer MFTECmd Timeline Explorer Registry Explorer PECmd UAC Bypass Pri Escalation |
| Maranhao Lab| PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | FTK Imager E Timeline Explorer DB Browser for SQLite MFTECmd Infostealer |
| TheTruth Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Autopsy DB Browser for SQLite DCode JADX Mobile Forensics Android Forensics |
| Malicious PyPi Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Notepad++ Event Log Explorer E Timeline Explorer ProcMon Registry Explorer PECmd |
| Job Trap Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | FTK Imager DB Browser for SQLite DCode Olevba E Timeline Explorer Notepad++ |
| Andromeda Bot Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | MemProcFS E Timeline Explorer Memory Forensics |
| T1598.002 Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | oledump Google Admin Toolbox Messageheader |
| Re APT Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | DB Browser for SQLite Event Log Explorer Timeline Explorer E dnSpy CyberChef |
| BankingTroubles Lab | PDF | CyberDefenders | 🔴 Hard | ⭐⭐⭐⭐⭐ | 2 Strings Foremost peepdf pdf-parser jsunpack Memory Forensics |
| MrRobot Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | 2 Outlook Forensics Wizard R-Studio Strings Notepad++ Process Injection Process Hollowing Memory Forensics |
| Chollima Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐ | MemProcFS CyberChef Strings Memory Forensics |
| Chollima Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | FTK Imager Event Log Explorer Timeline Explorer MFTECmd Notepad++ Registry Explorer Python Analysis |
| PwnedDC Lab | PDF | CyberDefenders | 🔴 Hard | ⭐⭐⭐⭐⭐ | Event Log Explorer Arsenal Image Mounter Outlook Forensics Wizard olevba scdbg 2 ClamScan HxD Resource Hacker Strings Python yara |
| DetectLog4j Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Arsenal Image Mounter Registry Explorer Event Log Explorer CyberChef FakeNet Ja dnSpy C |
| Szechuan Sauce Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | 3 Arsenal Image Mounter Registry Explorer E Timeline Explorer Wireshark NetworkMiner DS Internals PowerShell framework Crack Station Event Log Explorer FTK Imager Credential Dumping |
| Zerologon Lab | PDF | CyberDefenders | 🔴 Hard | ⭐⭐⭐⭐⭐ | MFTECmd Timeline Explorer LECmd E CyberChef Notepad++ Event Log Explorer Windows Forensics |
| Phishy Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | FTK Imager Autopsy Registry Explorer WhatsApp CyberChef Olevba oledump.py BrowsingHistoryView PasswordFox Windows Forensics Macro analysis |
| Hammered Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Linux Command Line Tools Linux Forensics |
| SpottedInTheWild Lab | PDF | CyberDefenders | 🔴 Hard | ⭐⭐⭐⭐⭐ | Arsenal Image Mounter PECmd MFTECmd E Timeline Explorer Strings CyberChef AnyRun C bitsadmin Windows Forensics |
| Akira Lab | PDF | CyberDefedners | 🟡 Medium | ⭐⭐⭐⭐⭐ | 3 MemProcFS E Timline Explorer Strings Text Editor Windows Forensics PsExec |
| IcedID 2 Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐ | 3 MemProcFS Text Editor Windows Forensics |
| MinerHunt Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | E Timeline Explorer Windows Forensics Microsoft SQL Server IFEO WMI |
| LummaStealer Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | E Timeline Explorer DB Browser for SQLite Windows Forensics |
| Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | DB Browser for SQLite E Timeline Explorer MFTECmd Windows Forensics WMI Scheduled Tasks |
| IronShade | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐ | Bash Linux Forensics |
| Hunter Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | FTK Imager Registry Explorer DCode E Timeline Explorer PECmd Sublime DB Browser for SQLite SysTools Outlook PST ShellBags Explorer JumpListExplorer Windows Forensics |
| CrownJewel1 | PDF | HackTheBox | 🟢 Easy | ⭐⭐⭐⭐⭐ | Hayabusa Timeline Explorer E MFTECmd Event ntds.dit Shadow Copies |
| Lockbit Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | E Timeline Explorer Notepad ++ |
| DarkCrystal Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Timeline Explorer E |
| QBot Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Malicious Excel Document |
| ELPACO-team Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | E Timeline Explorer MFTECmd |
| Retracted | PDF | TryHackMe | 🟢 Easy | ⭐⭐ | Event |
| Unattended | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐ | Registry Explorer Autopsy |
| Disgruntled | PDF | TryHackMe | 🟢 Easy | ⭐ | cat |
| Secret Recipe | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐ | Registry Explorer |
| Critical | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐⭐ | strings |
| Tempest | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐⭐ | Timeline Explorer WireShark Brim CyberChef |
| Boogeyman 2 | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐⭐ | text editor Olevba |
| Ramnit | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐ | |
| Reveal | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐ | Timeline Explorer |
| FakeGPT | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | ExtAnalysis CyberChef |
| Brave | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐ | HxD |
| Redline | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐ | Timeline Explorer |
| Memory Analysis | PDF | LetsDefend | 🟡 Medium | ⭐⭐⭐⭐⭐ | Crackstation |
| Lockbit | PDF | LetsDefend | 🟢 Easy | ⭐⭐⭐⭐ | |
| WinRar 0-Day | PDF | LetsDefend | 🟡 Medium | ⭐⭐⭐ | CyberChef |
| BlackEnergy Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐ | Timeline Explorer |
| Memory Analysis - Ransomware | PDF | BTLO | 🟡 Medium | ⭐⭐⭐⭐ | |
| Tardigrade | PDF | TryHackMe | 🟡 Medium | ⭐ | Linux command-line |
| Sysinternals | PDF | CyberDefenders | 🟡 Medium | ⭐⭐ | Autopsy AppCompatParser AmCacheParser |
| REvil Corp | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐ | Redline |
| Forensics | PDF | TryHackMe | 🔴 Hard | ⭐⭐⭐⭐⭐ | strings |
| Dead End? | PDF | TryHackMe | 🔴 Hard | ⭐⭐⭐ | FTK Imager |
| Insider Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐ | FTK Imager |
| Seized Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐ | strings |
| Browser Forensics - Cryptominer | PDF | BTLO | 🟢 Easy | ⭐⭐⭐ | FTK Imager |
| Kraken Keylogger Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐ | DB Browser for SQLite LECmd text editor |
| HireMe Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐ | FTK Imager Registry Explorer LECmd RegRipper OST |
| DumpMe Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | |
| AfricanFalls Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐ | FTK Imager rifiuti2 Browsing History View PECmd ShellBags Explorer |
| Injector Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | FTK Imager Registry Explorer cut |
| NintendoHunt Lab | PDF | CyberDefenders | 🔴 Hard | ⭐⭐ | Strings |
| DeepDive Lab | PDF | CyberDefenders | 🔴 Hard | ⭐⭐ | |
| CorporateSecrets Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | FTK Imager MFTECmd Timeline Explorer RegRipper PECmd |
| Bruteforce | PDF | BTLO | 🟡 Medium | ⭐⭐⭐⭐⭐ | Timeline Explorer cat |
| Silent Breach | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | FTK Imager Browsing History View DB Browser for SQLite Strings Grep |
| Amadey Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐ | |
| DiskFiltration | PDF | TryHackMe | 🔴 Hard | ⭐⭐⭐⭐ | Autopsy Timeline Explorer MFTECmd Exiftool HxD |
| Traces Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | 3 Defense E |
| MeteorHit Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Registry Explorer Timeline Explorer E MFTECmd NTFS Forensics Sysmon Defense E |
| Fog Ransomware Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | DB Browser for SQLite MFTECmd Timeline Explorer E
| NetX-Support Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | DB Browser for SQLite FTK Imager MFTECmd E PECmd CyberChef Registry Explorer LECmd |
| Beta Gamer Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | DB Browser for SQLite FTK Imager MFTECmd E |
| Trigona Ransomware Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | E Timeline Explorer Registry Explorer MFTECmd PECmd AmcacheParser |
| Deep Blue | PDF | BTLO | 🟢 Easy | ⭐⭐⭐ | deepbluecli Event |
| Brutus | PDF | HackTheBox | 🟢 Easy | ⭐⭐⭐⭐⭐ | grep awk sed sort uniq last grep auth.log wtmp |
| Crownjewel-2 | PDF | HackTheBox | 🟢 Easy | ⭐⭐⭐⭐⭐ | E Timeline Explorer |
| Operationa Blackout 2025: Phantom Check | PDF | HackTheBox | 🟢 Easy | ⭐⭐ | E Timeline Explorer |

<br>

Network Forensics

This category focuses on packet analysis through PCAP files and zeek logs. Tools like Wireshark, Zeek, and Brim are frequently used.
| Challenge | Writeup | Challenge Link | Difficulty | Rating | Tags |
|-------------------------------|--------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|------------|----------|-----------------------------|
| XXE Infiltration Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | Wireshark Zui |
| JetBrains Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | Wireshark Zui C |
| Openfire Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | Wireshark Zui CyberChef C |
| Trident Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Wireshark Zui NetworkMiner IDA Pro scdbg C shellcode analysis |
| NukeTheBrowser Lab | PDF | CyberDefenders | 🔴 Hard | ⭐⭐⭐⭐⭐ | Wireshark Zui scdbg C shellcode analysis |
| HoneyBOT Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Wireshark Zui NetworkMiner scdbg C shellcode analysis |
| Malware Traffic Analysis 5 Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐ | Wireshark Zui Oledump Thunderbird |
| Malware Traffic Analysis 4 Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Wireshark Zui NetworkMiner |
| Malware Traffic Analysis 3 Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Wireshark Zui NetworkMiner GHex pesec Python |
| Malware Traffic Analysis 2 Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Wireshark Zui NetworkMiner |
| Malware Traffic Analysis 1 Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Wireshark Zui NetworkMiner |
| WireDive Lab | PDF | CyberDefenders | 🟡 Medium | ⭐ | Wireshark |
| Acoustic Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐ | Wireshark Zui VoIP Command line |
| RetailBreach Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | Wireshark Zui CyberChef |
| RCEMiner Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Wireshark |
| BlueSky Ransomware Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Wireshark Zui Event Log Explorer CyberChef |
| HawkEye Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Wireshark Zui NetworkMiner |
| PacketMaze Lab | PDF | CyberDefenders | 🟡 Medium | ⭐ | Wireshark NetworkMiner |
| Boogeyman 1 | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐ | Thunderbird lnkparse cat Wireshark |
| PacketDetective | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐ | Wireshark |
| DanaBot | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐ | Wireshark Network Miner |
| Web In | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | Wireshark MaxMind GeoIP database |
| WebStrike | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐ | Wireshark |
| PoisonedCredentials | PDF | CyberDefenders | 🟢 Easy | ⭐⭐ | Wireshark |
| TomCat Takeover | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | Wireshark |
| PsExec Hunt | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐ | Wireshark |
| Shellshock Attack | PDF | LetsDefend | 🟢 Easy | ⭐ | Wireshark |
| HTTP Basic Auth | PDF | LetsDefend | 🟢 Easy | ⭐⭐ | Wireshark |
| Brute Force Attack | PDF | LetsDefend | 🟡 Medium | ⭐⭐⭐⭐ | Wireshark cat grep |
| OpenWire Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐ | Wireshark |
| Network Analysis - Web Shell | PDF | BTLO | 🟢 Easy | ⭐⭐⭐⭐ | Wireshark |
| XMLRat Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | Wireshark CyberChef |
| Network Analysis - Ransomware | PDF| BTLO | 🟡 Medium | ⭐⭐ | Wireshark |
| l337 S4uc3 Lab | PDF| CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Wireshark Network Miner Brim 2 |
| Piggy | PDF | BTLO | 🟢 Easy | ⭐⭐⭐ | Wireshark |
| Shiba Insider | PDF | BTLO | 🟢 Easy | ⭐⭐ | Wireshark exiftool |
| Tshark Challenge II: Directory | PDF| TryHackMe | 🟢 Easy | ⭐⭐⭐⭐⭐ | Tshark |
| TShark Challenge 1: Teamwork | PDF| TryHackMe | 🟢 Easy | ⭐⭐ | Tshark |
| TShark | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐ | Tshark |
| Carnage | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐⭐ | Wireshark |
| Warzone 2 | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐⭐ | Brim Network Miner Wireshark CyberChef |
| Warzone 1 | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐⭐ | Brim Network Miner Wireshark |
| Masterminds | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐⭐ | Brim |
| Zeek Exercises | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐⭐ | zeek CyberChef |

<br>

Mobile Forensics

This section focuses on in mobile devices.
| Challenge | Writeup | Challenge Link | Difficulty | Rating | Tags |
|-------------------------------|--------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|------------|----------|-----------------------------|
| AndroidBreach Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐ | ALEAPP jadx CyberChef Android Forensics |
| The Crime lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | ALEAPP |
| Eli Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐ | CLEAPP |

<br>

IDS/IPS

Writeups here explore intrusion detection and pre systems like Snort. These labs simulate network-based attacks and help develop skills in detecting and repsonding to suspicious traffic patterns and rule-based alerts.
| Challenge | Writeup | Challenge Link | Difficulty | Rating | Tags |
| ---------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |------------|----------|-----------------------------|
| Snort Challenge the Basics | PDF | TryHackMe | 🟡 Medium | ⭐⭐ | Snort |
| Snort Challenge li | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐ | Snort |

<br>

SIEM (ELK, Splunk, etc.)

These challenges invol SIEMs like Splunk, ELK, and Wazuh to identify threats.
| Challenge | Writeup | Challenge Link | Difficulty | Rating | Tags |
|-------------------------------|--------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|------------|----------|-----------------------------|
| T1110-003 Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐ | ELK password spraying RDP |
| REvil Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | ELK |
| HafinumAPT Lab | PDF | CyberDefenders | 🔴 Hard | ⭐⭐⭐⭐⭐ | ELK |
| GitTheGate Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐ | ELK C |
| Kerberoasted Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | ELK Kerberoasting |
| ElasticCase Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | ELK |
| Monday Monitor | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐ | Wazuh CyberChef |
| NerisBot Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐⭐⭐ | Splunk Zeek Suricata |
| Peak | PDF | BTLO | 🟡 Medium | ⭐⭐ | ELK |
| Defaced | PDF | BTLO | 🟢 Easy | ⭐⭐ | ELK |
| SOC Alpha 3 | PDF | BTLO | 🟡 Medium | ⭐⭐⭐⭐⭐ | ELK |
| SOC Alpha 2 | PDF | BTLO | 🟢 Easy | ⭐⭐⭐⭐⭐ | ELK |
| SOC Alpha 1 | PDF | BTLO | 🟢 Easy | ⭐⭐⭐ | ELK |
| Middle Mayhem | PDF | BTLO | 🟢 Easy | ⭐⭐⭐ | ELK |
| Boogeyman 3 | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐⭐ | ELK |
| New Hire Old Artifacts | PDF| TryHackMe | 🟡 Medium | ⭐⭐⭐⭐⭐ | ELK |
| PS Eclipse | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐⭐ | ELK |
| Conti | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐⭐ | ELK |
| SlingShot | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐ | ELK CyberChef |
| Benign | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐ | ELK |
| In with Splunk | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐⭐ | Splunk |
| ItsyBitsy | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐ | ELK |

<br>

Cyber Threat Intelligence (CTI)

These labs focus on cyber threat intelligence, you will learn how to use threat intelligence platforms like , Malpedia, MITRE ATT&CK, and much more. Most of these challenges invol malware campaigns, attributing malware to threat actors, etc.
| Challenge | Writeup | Challenge Link | Difficulty | Rating | Tags |
|-------------------------------|--------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|------------|----------|-----------------------------|
| Trooper | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐ | Open CTI |
| Yellow RAT | PDF | CyberDefenders | 🟢 Easy | ⭐⭐ | |
| GrabThePhiser | PDF | CyberDefenders | 🟢 Easy | ⭐⭐⭐ | Sublime |
| Red Stealer | PDF | CyberDefenders | 🟢 Easy | ⭐⭐ | MalwareBazaar |
| PhishStrike Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | Sublime URLhaus |
| Tusk Infostealer Lab | PDF | CyberDefenders | 🟢 Easy | ⭐ | Kaspersky Threat Intelligence Portal |
| Oski Lab | PDF | CyberDefenders | 🟢 Easy | ⭐⭐ | any.run |
| IcedID | PDF | CyberDefenders | 🟢 Easy | ⭐ | Tria.ge Malpedia |

<br>

Email Analysis

This section dives into in emails, primarily phishing emails. You will learn how to extract headers, decode payloads, SPF/DKIM records, and asess malicious indicators in emails.
| Challenge | Writeup | Challenge Link | Difficulty | Rating | Tags |
|-------------------------------|--------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|------------|----------|-----------------------------|
| Greenholt Phish | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐⭐ | Thunderbird mxtoolbox |
| Snapped Phish-ing Line | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐ | text editor |
| Phishing Analysis | PDF | BTLO | 🟢 Easy | ⭐⭐⭐⭐⭐ | Sublime URL2PNG |
| Phishing Analysis 2 | PDF | BTLO | 🟢 Easy | ⭐⭐⭐⭐⭐ | Sublime CyberChef |
| Phishy v1 | PDF | BTLO | 🟡 Medium | ⭐⭐⭐ |

<br>

Malware Analysis

This section focuses on static and dynamic malware analysis. These writeups document the analysis of malicious PE files, scripts, macros, and more.
| Challenge | Writeup | Challenge Link | Difficulty | Rating | Tags |
|-------------------------------------------|-------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|------------|----------|-----------------------------|
| TeleStealer Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | DIE ProcMon Wireshark Python|
| AgentTesla Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | DIE AutoIT Extractor PE-sieve Process Explorer CFF Explorer dnSpy CyberChef ProcMon |
| MalaCrypt Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | PE Studio Floss Strings CyberChef ProcMon Cutter Capa |
| XWorm Lab | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | PE Studio DIE dnSpy ANY.RUN |
| MalBuster | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐ | pestudio detect it easy CTF Explorer capa floss |
| Mr. Phisher | PDF | TryHackMe | 🟢 Easy | ⭐ | LibreOffice Writer |
| Dunkle Materie | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐ | ProcDOT |
| Maldoc101 | PDF | CyberDefenders | 🟡 Medium | ⭐⭐⭐⭐⭐ | oledump olevba CyberChef |
| Downloader | PDF | LetsDefend | 🔴 Hard | ⭐⭐⭐⭐⭐| IDA Pro |
| Malicious Doc | PDF | LetsDefend | 🟢 Easy | ⭐ | |
| PowerShell Script | PDF | LetsDefend | 🟢 Easy | ⭐⭐| text editor |
| Suspicious USB Stick | PDF | BTLO | 🟡 Medium | ⭐ | text editor peepdf |
| Reverse Engineering - A Classic Injection | PDF | BTLO | 🟢 Easy | ⭐⭐⭐⭐⭐ | pestudio detect it easy IDA Pro Procmon CyberChef |
| PowerShell Analysis - Keylogger | PDF | BTLO | 🟢 Easy | ⭐⭐| text editor |
| Injection Series Part 3 | PDF | BTLO | 🟡 Medium | ⭐⭐⭐⭐⭐ | cutter IDA Pro CyberChef |
| Injection Series Part 4 | PDF | BTLO | 🟢 Easy | ⭐⭐⭐⭐⭐ | IDA Pro CyberChef |
| Reverse Engineering - Another Injection | PDF | BTLO | 🟢 Easy | ⭐⭐⭐⭐ | detect it easy strings IDA Pro CyberChef |
| Malware Analysis - Ransomware Script | PDF | BTLO | 🟢 Easy | ⭐⭐⭐ | text editor
| Nonyx | PDF | BTLO | 🟢 Easy | ⭐⭐⭐⭐ | 2 |
| Anakus | PDF | BTLO | 🟢 Easy | ⭐⭐⭐ | detect it easy sigcheck timeline explorer

<br>

Reverse Engineering

Challenges in this section invol program logic and unco hidden functionality from binaries. They often require IDA Pro, Ghidra, or Radare2.
| Challenge | Writeup | Challenge Link | Difficulty | Rating | Tags |
|---------------------|--------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|------------|----------|-----------------------------|
| Re ELF | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐ | radare2 strings |
| DLL Stealer | PDF | LetsDefend | 🟡 Medium | ⭐⭐⭐⭐⭐ | dotPeek |
| Beginner Crackme | PDF | Crackmes.one | 🟢 Easy | ⭐ | IDA Pro

<br>

Pentesting

This section contains writeups focused on penetration testing. Challenges are typically boot2root which invol, enumeration, analysis and exploitation, pri escalation, and more. Great for building foundation penetration testing skills and learning common attacks.
| Challenge | Writeup | Challenge Link | Difficulty | Rating | Tags |
| ---------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |------------|----------|-----------------------------|
| Basic | PDF | HackThisSite | 🟡 Medium | ⭐⭐⭐ | burp suite |
| Sil | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐ | Nmap GoBuster ssh pri escalation |
| Dav | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐ | Nmap GoBuster hydra pri escalation |
| Wgel CTF | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐ | Nmap dirb ssh pri escalation |
| Lookup | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐ | Nmap hydra searchsploit metasploit pri escalation |
| Toolsrus | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐ | Nmap dirbuster hydra nikto metasploit msfvenom |
| Raven 1 | PDF | | 🟡 Medium | ⭐⭐⭐⭐⭐ | arp-scan Nmap GoBuster wpscan nikto hydra ssh mysql |
| Pickle Rick | PDF | | 🟢 Easy | ⭐⭐⭐⭐⭐ | Nmap GoBuster nikto pri escalation |
| Mr Robot | PDF | | 🟡 Medium | ⭐⭐⭐⭐ | arp-scan Nmap GoBuster nikto wpscan hydra hashcat pri escalation |
| Photographer | PDF | | 🟡 Medium | ⭐⭐⭐⭐⭐ | arp-scan Nmap GoBuster nikto enum4linux SMB burp suite |
| Lazy Admin | PDF | | 🟡 Medium | ⭐⭐⭐⭐⭐ | Nmap GoBuster hash-identifier searchsploit pri escalation |
| IDE | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐⭐ | Nmap FTP searchsploit ssh pri escalation |
| Easy peasy | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐⭐ | Nmap GoBuster hash-identifier CyberChef steghide ssh pri escalation |
| Colddbox | PDF | | 🟢 Easy | ⭐⭐⭐⭐⭐ | Nmap GoBuster wpscan hydra pri escalation |
| Colddbox THM | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐⭐ | Nmap GoBuster wpscan hydra pri escalation |
| Bounty Hacker | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐ | Nmap FTP hydra pri escalation |
| Blogger1 | PDF | | 🟢 Easy | ⭐⭐⭐⭐⭐ | arp-scan Nmap GoBuster wpscan pri escalation |
| Basic Pentesting | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐ | Nmap GoBuster enum4linux SMB hydra john pri escalation |
| Anonymous | PDF | TryHackMe | 🟡 Medium | ⭐⭐⭐⭐ | Nmap enum4linux SMB FTP pri escalation |
| Agent Sudo | PDF | TryHackMe | 🟢 Easy | ⭐⭐⭐⭐ | Nmap curl hydra FTP binwalk steghide ssh pri escalation |

<br>

Tools Used

Some of the tools used in these writeups include (not limited to):

| Category | Tool Name | Link |
| ----------------------------------------- | ------------------- | ------------------------------------------------------------------------------------------- |
| Network Scanning & Enumeration | Nmap | |
| | GoBuster | |
| | WPScan | |
| | enum4linux | |
| Scanning and Exploitation| Burp Suite | |
| | Metasploit | |
| | Nikto | |
| | Hydra | |
| | John the Ripper | |
| Packet Analysis and Network Monitoring | Wireshark | |
| | TShark | |
| | Snort | |
| | Zeek | |
| | Zui/Brim | |
| | NetworkMiner | |
| Binary Analysis | Binwalk | |
| Log Analysis and SIEM | ELK | |
| | Splunk | |
| | Wazuh | |
| | Event | |
| | Sysmon-View | |
| Cyber Threat Intelligence (CTI) | OpenCTI | |
| | Mitre ATT&CK Matrix | |
| | | |
| | URLHaus | |
| | IPInfo | |
| | Cisco Talos | |
| | Shodan | |
| | Kasperky Threat Intelligence Portal | |
| | Tria.ge | |
| | Malpedia | |
| | Malware Bazaar | |
| Malware Analysis | pestudio | |
| | Detect It Easy | |
| | capa | |
| | Floss | |
| | ProcDOT | |
| | Olevba | |
| | Oledump | |
| | IDA Free | |
| | scdbg | |
| | Radare2 | |
| | Cutter | |
| | Ghidra | |
| | AnyRun | |
| | FakeNet | |
| | dnSpy | |
| | Hybrid Analysis | |
| | Joes Sandbox | |
| Forensics and Incident Response | Autopsy | |
| | EZ Tools | |
| | | |
| | 2 | |
| | MemProcsFS | |
| | FTK Imager | |
| | Browsing History View | |
| | CLEAPP | |
| | PasswordFox | |
| | WhatsApp | |
| | Event Log Explorer | |
| | NirSoft Tools | |
| | R-Studio | |
| | DB Browser for SQLite | |
| | Hindsight | |
| Mobile Forensics | ALEAPP | |

Personal Platform Profiles

TryHackMe | Top 1%

BlueTeamLabs | Top 10%

CyberDefenders | Top 10 Aus

项目信息

开发语言：未知

Star 数：60

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This repository contains detailed Capture The Flag (CTF) writeups for challenges completed on CyberDefenders, TryHackMe, BTLO, and more. The writeups are provided in PDF format and cover areas such as digital forensics, malware analysis, network analysis and much more. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。