CTF Writeups

Welcome to my CTF Writeups repository! Here, I document the solutions and methodologies used to solve various Capture The Flag (CTF) challenges. This repository is intended to serve as a learning resource for others interested in cybersecurity and CTF competitions. Capture The Flag (CTF) competitions are a popular way to practice and improve cybersecurity skills. These competitions present various challenges that require problem-solving, creativity, and technical knowledge.

Writeups

The writeups in this repository (located in the "writeups" folder) are categorised based on the nature of the challenge. Each writeup provides step-by-step solutions, along with explanations of the tools and techniques used. The difficulty rating associated with each challenge matches the difficulty rating given by the platform hosting the challenge/lab/ctf, therefore, take it with a grain of salt as some challenges rated as hard are actually easy, etc. The rating is out of 5, where 5 stars means the challenge is enjoyable and 1 being not enjoyable. Whilst this will of course have personal bias, my rating is not on the basis of whether I enjoyed it, it's more on the quality and realism of the challenge.

Disclaimer! In all honesty, some of these writeups are written poorly, mainly because I complete them to learn practical skills, not to practice reporting. When it comes to well written writeups, I recommend reading my most recent ones.

Where to Start

I recommend starting with the easy or medium rated challenges, there is honestly little difference between the two ratings for the most part. You can find challenges associated with each difficulty rating by clicking CTRL + F and pasting one of the following tags:

• 🟢 Easy
• 🟡 Medium
• 🔴 Hard

When it comes to what platform to use, that depends on your interests and skill level. For DFIR (digital forensics and incident response) and CTI (cyber threat intelligence) based challenges I highly recommend CyberDefenders, as it provides the most realistic challenges and often requires the use of VMs or a home lab. If you are a beginner, TryHackMe is a great place to start, as it often provides a VM or you can always use the AttackBox which comes preinstalled with a bunch of tools. Lastly, if you are intersted in becoming a blue teamer (stricly SOC operations), I recommend checking out blue team labs online (BTLO).

Table of Contents

• Endpoint Forensics
• Network Forensics
• Mobile Forensics
• IDS/IPS
• SIEM (ELK, Splunk, etc.)
• Cyber Threat Intelligence (CTI)
• Email Analysis
• Malware Analysis
• Reverse Engineering
• Pentesting
• Tools Used
• Personal Platform Profiles

Endpoint Forensics

These challenges mainly involve investigating compromised endpoints, primarily Windows and Linux, using a variety of forensic tools.

Challenge	Writeup	Challenge Link	Difficulty	Rating	Tags
KioskExpo7 Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	DB Browser for SQLite Registry Explorer MFTECmd Timeline Explorer PECmd Notepad++ R-Studio MFT Explorer
XMRig Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Built-in Linux Tools VirusTotal Photorec Linux Forensics
ConfluenceRCE Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	grep uniq cut VirusTotal Built-in Linux Tools Linux Forensics
Stealthy Ascent Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐	Built-in Linux Tools Linux Forensics
RepoReaper Lab	PDF	CyberDefenders	🔴 Hard	⭐⭐⭐⭐⭐	FTK Imager DB Browser for SQLite DCode Event Log Explorer MFTECmd Timeline Explorer VirusTotal Registry Explorer PECmd UAC Bypass Privilege Escalation
Maranhao Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	FTK Imager EvtxECmd Timeline Explorer DB Browser for SQLite MFTECmd VirusTotal Infostealer
TheTruth Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Autopsy DB Browser for SQLite DCode JADX Mobile Forensics Android Forensics
Malicious PyPi Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Notepad++ Event Log Explorer EvtxECmd Timeline Explorer ProcMon Registry Explorer PECmd VirusTotal
Job Trap Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	FTK Imager DB Browser for SQLite DCode Olevba EvtxECmd Timeline Explorer Notepad++
Andromeda Bot Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	MemProcFS EvtxECmd Timeline Explorer VirusTotal Memory Forensics
T1598.002 Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	oledump Google Admin Toolbox Messageheader
RevengeHotels APT Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	DB Browser for SQLite Event Log Explorer Timeline Explorer EvtxECmd dnSpy CyberChef
BankingTroubles Lab	PDF	CyberDefenders	🔴 Hard	⭐⭐⭐⭐⭐	Volatility 2 Strings Foremost peepdf pdf-parser jsunpack Memory Forensics
MrRobot Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Volatility 2 Outlook Forensics Wizard R-Studio Strings Notepad++ VirusTotal Process Injection Process Hollowing Memory Forensics
Chollima Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐	MemProcFS CyberChef Strings Memory Forensics
Chollima Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	FTK Imager Event Log Explorer Timeline Explorer MFTECmd VirusTotal Notepad++ Registry Explorer Python Analysis
PwnedDC Lab	PDF	CyberDefenders	🔴 Hard	⭐⭐⭐⭐⭐	Event Log Explorer Arsenal Image Mounter Outlook Forensics Wizard olevba scdbg Volatility 2 ClamScan VirusTotal HxD Resource Hacker Strings Python VBA Stomping yara
DetectLog4j Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Arsenal Image Mounter Registry Explorer Event Log Explorer CyberChef FakeNet Java Decompiler VirusTotal dnSpy CVE-2021-44228
Szechuan Sauce Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Volatility 3 Arsenal Image Mounter Registry Explorer EvtxECmd Timeline Explorer VirusTotal Wireshark NetworkMiner DS Internals PowerShell framework Crack Station Event Log Explorer FTK Imager Credential Dumping
Zerologon Lab	PDF	CyberDefenders	🔴 Hard	⭐⭐⭐⭐⭐	MFTECmd Timeline Explorer LECmd EvtxECmd CyberChef Notepad++ Event Log Explorer Windows Forensics
Phishy Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	FTK Imager Autopsy Registry Explorer WhatsApp Viewer CyberChef Olevba oledump.py BrowsingHistoryView PasswordFox VirusTotal Windows Forensics Macro analysis
Hammered Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Linux Command Line Tools Linux Forensics
SpottedInTheWild Lab	PDF	CyberDefenders	🔴 Hard	⭐⭐⭐⭐⭐	Arsenal Image Mounter PECmd MFTECmd EvtxECmd Timeline Explorer Strings CyberChef AnyRun CVE-2023-38831 bitsadmin Windows Forensics
Akira Lab	PDF	CyberDefedners	🟡 Medium	⭐⭐⭐⭐⭐	Volatility 3 MemProcFS EvtxECmd Timline Explorer Strings Text Editor Windows Forensics PsExec
IcedID 2 Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐	Volatility 3 MemProcFS Text Editor VirusTotal Windows Forensics
MinerHunt Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	EvtxECmd Timeline Explorer VirusTotal Windows Forensics Microsoft SQL Server IFEO WMI
LummaStealer Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	EvtxECmd Timeline Explorer DB Browser for SQLite Windows Forensics
VaultBreak Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	DB Browser for SQLite EvtxECmd Timeline Explorer MFTECmd Windows Forensics WMI Scheduled Tasks
IronShade	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐	Bash Linux Forensics
Hunter Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	FTK Imager Registry Explorer DCode EvtxECmd Timeline Explorer PECmd Sublime DB Browser for SQLite SysTools Outlook PST Viewer ShellBags Explorer JumpListExplorer Windows Forensics
CrownJewel1	PDF	HackTheBox	🟢 Easy	⭐⭐⭐⭐⭐	Hayabusa Timeline Explorer EVTXCmd MFTECmd Event Viewer ntds.dit Volume Shadow Copies
Lockbit Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	EVTXCmd Timeline Explorer Notepad ++ VirusTotal
DarkCrystal Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Volatility3 Timeline Explorer EVTXCmd
QBot Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Volatility3 VirusTotal Malicious Excel Document
ELPACO-team Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	EVTXCmd Timeline Explorer MFTECmd VirusTotal
Retracted	PDF	TryHackMe	🟢 Easy	⭐⭐	Event Viewer
Unattended	PDF	TryHackMe	🟡 Medium	⭐⭐⭐	Registry Explorer Autopsy
Disgruntled	PDF	TryHackMe	🟢 Easy	⭐	cat
Secret Recipe	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐	Registry Explorer
Critical	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐⭐	Volatility3 strings
Tempest	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐⭐	Timeline Explorer WireShark Brim CyberChef VirusTotal
Boogeyman 2	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐⭐	text editor Olevba Volatility2
Ramnit	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐	Volatility3 VirusTotal
Reveal	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐	Volatility3 Timeline Explorer VirusTotal
FakeGPT	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	ExtAnalysis CyberChef
Brave	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐	Volatility3 HxD
Redline	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐	Volatility3 Timeline Explorer VirusTotal
Memory Analysis	PDF	LetsDefend	🟡 Medium	⭐⭐⭐⭐⭐	Volatility3 VirusTotal Crackstation
Lockbit	PDF	LetsDefend	🟢 Easy	⭐⭐⭐⭐	Volatility3 VirusTotal
WinRar 0-Day	PDF	LetsDefend	🟡 Medium	⭐⭐⭐	Volatility3 CyberChef
BlackEnergy Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐	Volatility3 Timeline Explorer VirusTotal
Memory Analysis - Ransomware	PDF	BTLO	🟡 Medium	⭐⭐⭐⭐	Volatility3
Tardigrade	PDF	TryHackMe	🟡 Medium	⭐	Linux command-line
Sysinternals	PDF	CyberDefenders	🟡 Medium	⭐⭐	Autopsy AppCompatParser AmCacheParser VirusTotal
REvil Corp	PDF	TryHackMe	🟡 Medium	⭐⭐⭐	Redline VirusTotal
Forensics	PDF	TryHackMe	🔴 Hard	⭐⭐⭐⭐⭐	Volatility3 strings
Dead End?	PDF	TryHackMe	🔴 Hard	⭐⭐⭐	Volatility3 FTK Imager VirusTotal
Insider Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐	FTK Imager
Seized Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐	Volatility3 strings
Browser Forensics - Cryptominer	PDF	BTLO	🟢 Easy	⭐⭐⭐	FTK Imager
Kraken Keylogger Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐	DB Browser for SQLite LECmd text editor
HireMe Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐	FTK Imager Registry Explorer LECmd RegRipper OST Viewer
DumpMe Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Voltiliaty2 VirusTotal
AfricanFalls Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐	FTK Imager rifiuti2 Browsing History View PECmd ShellBags Explorer
Injector Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	FTK Imager Volatility3 Registry Explorer cut
NintendoHunt Lab	PDF	CyberDefenders	🔴 Hard	⭐⭐	Volatility2 Strings
DeepDive Lab	PDF	CyberDefenders	🔴 Hard	⭐⭐	Volatility2 VirusTotal
CorporateSecrets Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	FTK Imager MFTECmd Timeline Explorer RegRipper PECmd
Bruteforce	PDF	BTLO	🟡 Medium	⭐⭐⭐⭐⭐	Timeline Explorer cat
Silent Breach	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	FTK Imager Browsing History View DB Browser for SQLite Strings Grep
Amadey Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐	Volatility3
DiskFiltration	PDF	TryHackMe	🔴 Hard	⭐⭐⭐⭐	Autopsy Timeline Explorer MFTECmd Exiftool HxD
Volatility Traces Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	Volatility 3 Defense Evasion
MeteorHit Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Registry Explorer Timeline Explorer EVTXCmd MFTECmd VirusTotal NTFS Forensics Sysmon Defense Evasion
Fog Ransomware Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	DB Browser for SQLite MFTECmd Timeline Explorer EvtxECmd VirusTotal
NetX-Support Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	DB Browser for SQLite FTK Imager MFTECmd EVTXCmd PECmd CyberChef Registry Explorer LECmd
Beta Gamer Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	DB Browser for SQLite FTK Imager MFTECmd EVTXCmd
Trigona Ransomware Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	EVTXCmd Timeline Explorer Registry Explorer MFTECmd PECmd AmcacheParser
Deep Blue	PDF	BTLO	🟢 Easy	⭐⭐⭐	deepbluecli Event Viewer
Brutus	PDF	HackTheBox	🟢 Easy	⭐⭐⭐⭐⭐	grep awk sed sort uniq last grep auth.log wtmp
Crownjewel-2	PDF	HackTheBox	🟢 Easy	⭐⭐⭐⭐⭐	EvtxECmd Timeline Explorer
Operationa Blackout 2025: Phantom Check	PDF	HackTheBox	🟢 Easy	⭐⭐	EvtxECmd Timeline Explorer

Network Forensics

This category focuses on packet analysis through PCAP files and zeek logs. Tools like Wireshark, Zeek, and Brim are frequently used.

Challenge	Writeup	Challenge Link	Difficulty	Rating	Tags
XXE Infiltration Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	Wireshark Zui
JetBrains Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	Wireshark Zui CVE-2024-27198
Openfire Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	Wireshark Zui CyberChef CVE-2023-32315
Trident Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Wireshark Zui NetworkMiner VirusTotal IDA Pro scdbg CVE-2021-40444 shellcode analysis
NukeTheBrowser Lab	PDF	CyberDefenders	🔴 Hard	⭐⭐⭐⭐⭐	Wireshark Zui VirusTotal scdbg CVE-2005-2127 shellcode analysis
HoneyBOT Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Wireshark Zui NetworkMiner VirusTotal scdbg CVE-2003-0533 shellcode analysis
Malware Traffic Analysis 5 Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐	Wireshark Zui VirusTotal Oledump Thunderbird
Malware Traffic Analysis 4 Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Wireshark Zui NetworkMiner VirusTotal
Malware Traffic Analysis 3 Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Wireshark Zui NetworkMiner VirusTotal GHex pesec Python
Malware Traffic Analysis 2 Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Wireshark Zui NetworkMiner VirusTotal
Malware Traffic Analysis 1 Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Wireshark Zui NetworkMiner VirusTotal
WireDive Lab	PDF	CyberDefenders	🟡 Medium	⭐	Wireshark
Acoustic Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐	Wireshark Zui VoIP Command line
RetailBreach Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	Wireshark Zui CyberChef VirusTotal
RCEMiner Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Wireshark VirusTotal
BlueSky Ransomware Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Wireshark Zui Event Log Explorer CyberChef VirusTotal
HawkEye Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Wireshark Zui NetworkMiner VirusTotal
PacketMaze Lab	PDF	CyberDefenders	🟡 Medium	⭐	Wireshark NetworkMiner
Boogeyman 1	PDF	TryHackMe	🟡 Medium	⭐⭐⭐	Thunderbird lnkparse cat Wireshark
PacketDetective	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐	Wireshark
DanaBot	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐	Wireshark VirusTotal Network Miner
Web Investigation	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	Wireshark MaxMind GeoIP database
WebStrike	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐	Wireshark
PoisonedCredentials	PDF	CyberDefenders	🟢 Easy	⭐⭐	Wireshark
TomCat Takeover	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	Wireshark
PsExec Hunt	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐	Wireshark
Shellshock Attack	PDF	LetsDefend	🟢 Easy	⭐	Wireshark
HTTP Basic Auth	PDF	LetsDefend	🟢 Easy	⭐⭐	Wireshark
Brute Force Attack	PDF	LetsDefend	🟡 Medium	⭐⭐⭐⭐	Wireshark cat grep
OpenWire Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐	Wireshark
Network Analysis - Web Shell	PDF	BTLO	🟢 Easy	⭐⭐⭐⭐	Wireshark
XMLRat Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	Wireshark VirusTotal CyberChef
Network Analysis - Ransomware	PDF	BTLO	🟡 Medium	⭐⭐	Wireshark
l337 S4uc3 Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Wireshark Network Miner Brim volatility 2
Piggy	PDF	BTLO	🟢 Easy	⭐⭐⭐	Wireshark VirusTotal
Shiba Insider	PDF	BTLO	🟢 Easy	⭐⭐	Wireshark exiftool
Tshark Challenge II: Directory	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐⭐	Tshark VirusTotal
TShark Challenge 1: Teamwork	PDF	TryHackMe	🟢 Easy	⭐⭐	Tshark VirusTotal
TShark	PDF	TryHackMe	🟡 Medium	⭐⭐⭐	Tshark
Carnage	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐⭐	Wireshark VirusTotal
Warzone 2	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐⭐	Brim Network Miner Wireshark VirusTotal CyberChef
Warzone 1	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐⭐	Brim Network Miner Wireshark VirusTotal
Masterminds	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐⭐	Brim VirusTotal
Zeek Exercises	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐⭐	zeek CyberChef VirusTotal

Mobile Forensics

This section focuses on investigating mobile devices.

Challenge	Writeup	Challenge Link	Difficulty	Rating	Tags
AndroidBreach Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐	ALEAPP jadx CyberChef Android Forensics
The Crime lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	ALEAPP
Eli Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐	CLEAPP

IDS/IPS

Writeups here explore intrusion detection and prevention systems like Snort. These labs simulate network-based attacks and help develop skills in detecting and repsonding to suspicious traffic patterns and rule-based alerts.

Challenge	Writeup	Challenge Link	Difficulty	Rating	Tags
Snort Challenge the Basics	PDF	TryHackMe	🟡 Medium	⭐⭐	Snort
Snort Challenge live attacks	PDF	TryHackMe	🟡 Medium	⭐⭐⭐	Snort

SIEM (ELK, Splunk, etc.)

These challenges involve using SIEMs like Splunk, ELK, and Wazuh to identify threats.

Challenge	Writeup	Challenge Link	Difficulty	Rating	Tags
T1110-003 Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐	ELK password spraying RDP
REvil Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	ELK
HafinumAPT Lab	PDF	CyberDefenders	🔴 Hard	⭐⭐⭐⭐⭐	ELK
GitTheGate Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐	ELK CVE-2019-7609
Kerberoasted Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	ELK Kerberoasting
ElasticCase Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	ELK
Monday Monitor	PDF	TryHackMe	🟢 Easy	⭐⭐⭐	Wazuh CyberChef
NerisBot Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐⭐⭐	Splunk Zeek Suricata VirusTotal
Peak	PDF	BTLO	🟡 Medium	⭐⭐	ELK
Defaced	PDF	BTLO	🟢 Easy	⭐⭐	ELK
SOC Alpha 3	PDF	BTLO	🟡 Medium	⭐⭐⭐⭐⭐	ELK VirusTotal
SOC Alpha 2	PDF	BTLO	🟢 Easy	⭐⭐⭐⭐⭐	ELK
SOC Alpha 1	PDF	BTLO	🟢 Easy	⭐⭐⭐	ELK
Middle Mayhem	PDF	BTLO	🟢 Easy	⭐⭐⭐	ELK
Boogeyman 3	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐⭐	ELK
New Hire Old Artifacts	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐⭐	ELK
PS Eclipse	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐⭐	ELK
Conti	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐⭐	ELK
SlingShot	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐	ELK CyberChef
Benign	PDF	TryHackMe	🟡 Medium	⭐⭐⭐	ELK
Investigating with Splunk	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐⭐	Splunk
ItsyBitsy	PDF	TryHackMe	🟡 Medium	⭐⭐⭐	ELK

Cyber Threat Intelligence (CTI)

These labs focus on cyber threat intelligence, you will learn how to use threat intelligence platforms like VirusTotal, Malpedia, MITRE ATT&CK, and much more. Most of these challenges involve tracking malware campaigns, attributing malware to threat actors, etc.

Challenge	Writeup	Challenge Link	Difficulty	Rating	Tags
Trooper	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐	Open CTI
Yellow RAT	PDF	CyberDefenders	🟢 Easy	⭐⭐	VirusTotal
GrabThePhiser	PDF	CyberDefenders	🟢 Easy	⭐⭐⭐	Sublime
Red Stealer	PDF	CyberDefenders	🟢 Easy	⭐⭐	VirusTotal MalwareBazaar
PhishStrike Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	Sublime URLhaus VirusTotal
Tusk Infostealer Lab	PDF	CyberDefenders	🟢 Easy	⭐	Kaspersky Threat Intelligence Portal VirusTotal
Oski Lab	PDF	CyberDefenders	🟢 Easy	⭐⭐	VirusTotal any.run
IcedID	PDF	CyberDefenders	🟢 Easy	⭐	VirusTotal Tria.ge Malpedia

Email Analysis

This section dives into investigating emails, primarily phishing emails. You will learn how to extract headers, decode payloads, verify SPF/DKIM records, and asess malicious indicators in emails.

Challenge	Writeup	Challenge Link	Difficulty	Rating	Tags
Greenholt Phish	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐⭐	Thunderbird mxtoolbox VirusTotal
Snapped Phish-ing Line	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐	VirusTotal text editor
Phishing Analysis	PDF	BTLO	🟢 Easy	⭐⭐⭐⭐⭐	Sublime URL2PNG
Phishing Analysis 2	PDF	BTLO	🟢 Easy	⭐⭐⭐⭐⭐	Sublime CyberChef
Phishy v1	PDF	BTLO	🟡 Medium	⭐⭐⭐

Malware Analysis

This section focuses on static and dynamic malware analysis. These writeups document the analysis of malicious PE files, scripts, macros, and more.

Challenge	Writeup	Challenge Link	Difficulty	Rating	Tags
TeleStealer Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	DIE ProcMon Wireshark Python
AgentTesla Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	DIE AutoIT Extractor PE-sieve Process Explorer CFF Explorer dnSpy CyberChef ProcMon
MalaCrypt Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	PE Studio Floss Strings CyberChef VirusTotal ProcMon Cutter Capa
XWorm Lab	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	PE Studio DIE dnSpy ANY.RUN VirusTotal
MalBuster	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐	pestudio detect it easy VirusTotal CTF Explorer capa floss
Mr. Phisher	PDF	TryHackMe	🟢 Easy	⭐	LibreOffice Writer
Dunkle Materie	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐	ProcDOT VirusTotal
Maldoc101	PDF	CyberDefenders	🟡 Medium	⭐⭐⭐⭐⭐	oledump VirusTotal olevba CyberChef
Downloader	PDF	LetsDefend	🔴 Hard	⭐⭐⭐⭐⭐	IDA Pro
Malicious Doc	PDF	LetsDefend	🟢 Easy	⭐	VirusTotal
PowerShell Script	PDF	LetsDefend	🟢 Easy	⭐⭐	text editor VirusTotal
Suspicious USB Stick	PDF	BTLO	🟡 Medium	⭐	text editor VirusTotal peepdf
Reverse Engineering - A Classic Injection	PDF	BTLO	🟢 Easy	⭐⭐⭐⭐⭐	pestudio detect it easy IDA Pro Procmon CyberChef
PowerShell Analysis - Keylogger	PDF	BTLO	🟢 Easy	⭐⭐	text editor
Injection Series Part 3	PDF	BTLO	🟡 Medium	⭐⭐⭐⭐⭐	cutter IDA Pro CyberChef
Injection Series Part 4	PDF	BTLO	🟢 Easy	⭐⭐⭐⭐⭐	IDA Pro CyberChef
Reverse Engineering - Another Injection	PDF	BTLO	🟢 Easy	⭐⭐⭐⭐	detect it easy strings IDA Pro CyberChef
Malware Analysis - Ransomware Script	PDF	BTLO	🟢 Easy	⭐⭐⭐	text editor
Nonyx	PDF	BTLO	🟢 Easy	⭐⭐⭐⭐	volatility 2
Anakus	PDF	BTLO	🟢 Easy	⭐⭐⭐	detect it easy VirusTotal sigcheck timeline explorer

Reverse Engineering

Challenges in this section involve understanding program logic and uncovering hidden functionality from binaries. They often require IDA Pro, Ghidra, or Radare2.

Challenge	Writeup	Challenge Link	Difficulty	Rating	Tags
Reversing ELF	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐	radare2 strings
DLL Stealer	PDF	LetsDefend	🟡 Medium	⭐⭐⭐⭐⭐	dotPeek
Beginner Crackme	PDF	Crackmes.one	🟢 Easy	⭐	IDA Pro

Pentesting

This section contains writeups focused on penetration testing. Challenges are typically boot2root which involve scanning, enumeration, vulnerability analysis and exploitation, privilege escalation, and more. Great for building foundation penetration testing skills and learning common attacks.

Challenge	Writeup	Challenge Link	Difficulty	Rating	Tags
Basic	PDF	HackThisSite	🟡 Medium	⭐⭐⭐	burp suite
Silver Platter	PDF	TryHackMe	🟢 Easy	⭐⭐⭐	Nmap GoBuster ssh privilege escalation
Dav	PDF	TryHackMe	🟢 Easy	⭐⭐⭐	Nmap GoBuster hydra privilege escalation
Wgel CTF	PDF	TryHackMe	🟢 Easy	⭐⭐⭐	Nmap dirb ssh privilege escalation
Lookup	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐	Nmap hydra searchsploit metasploit privilege escalation
Toolsrus	PDF	TryHackMe	🟢 Easy	⭐⭐⭐	Nmap dirbuster hydra nikto metasploit msfvenom
Raven 1	PDF	VulnHub	🟡 Medium	⭐⭐⭐⭐⭐	arp-scan Nmap GoBuster wpscan nikto hydra ssh mysql
Pickle Rick	PDF	VulnHub	🟢 Easy	⭐⭐⭐⭐⭐	Nmap GoBuster nikto privilege escalation
Mr Robot	PDF	VulnHub	🟡 Medium	⭐⭐⭐⭐	arp-scan Nmap GoBuster nikto wpscan hydra hashcat privilege escalation
Photographer	PDF	VulnHub	🟡 Medium	⭐⭐⭐⭐⭐	arp-scan Nmap GoBuster nikto enum4linux SMB burp suite
Lazy Admin	PDF	VulnHub	🟡 Medium	⭐⭐⭐⭐⭐	Nmap GoBuster hash-identifier searchsploit privilege escalation
IDE	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐⭐	Nmap FTP searchsploit ssh privilege escalation
Easy peasy	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐⭐	Nmap GoBuster hash-identifier CyberChef steghide ssh privilege escalation
Colddbox Vulnhub	PDF	VulnHub	🟢 Easy	⭐⭐⭐⭐⭐	Nmap GoBuster wpscan hydra privilege escalation
Colddbox THM	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐⭐	Nmap GoBuster wpscan hydra privilege escalation
Bounty Hacker	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐	Nmap FTP hydra privilege escalation
Blogger1	PDF	VulnHub	🟢 Easy	⭐⭐⭐⭐⭐	arp-scan Nmap GoBuster wpscan privilege escalation
Basic Pentesting	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐	Nmap GoBuster enum4linux SMB hydra john privilege escalation
Anonymous	PDF	TryHackMe	🟡 Medium	⭐⭐⭐⭐	Nmap enum4linux SMB FTP privilege escalation
Agent Sudo	PDF	TryHackMe	🟢 Easy	⭐⭐⭐⭐	Nmap curl hydra FTP binwalk steghide ssh privilege escalation

Tools Used

Some of the tools used in these writeups include (not limited to):

Category	Tool Name	Link
Network Scanning & Enumeration	Nmap	https://Nmap.org/
	GoBuster	https://www.kali.org/tools/gobuster/
	WPScan	https://wpscan.com/
	enum4linux	https://www.kali.org/tools/enum4linux/
Vulnerability Scanning and Exploitation	Burp Suite	https://portswigger.net/burp
	Metasploit	https://www.metasploit.com/
	Nikto	https://www.cisa.gov/resources-tools/services/nikto
	Hydra	https://www.kali.org/tools/hydra/
	John the Ripper	https://www.openwall.com/john/
Packet Analysis and Network Monitoring	Wireshark	https://www.Wireshark.org/
	TShark	https://www.Wireshark.org/docs/man-pages/tshark.html
	Snort	https://www.snort.org/
	Zeek	https://zeek.org/
	Zui/Brim	https://www.brimdata.io/download/
	NetworkMiner	https://www.netresec.com/?page=NetworkMiner
Binary Analysis	Binwalk	https://github.com/ReFirmLabs/binwalk
Log Analysis and SIEM	ELK	https://www.elastic.co/elastic-stack
	Splunk	https://www.splunk.com/
	Wazuh	https://wazuh.com/
	Event Viewer	https://learn.microsoft.com/en-us/shows/inside/event-viewer
	Sysmon-View	https://github.com/nshalabi/SysmonTools
Cyber Threat Intelligence (CTI)	OpenCTI	https://github.com/OpenCTI-Platform/opencti
	Mitre ATT&CK Matrix	https://attack.mitre.org/
	VirusTotal	https://www.VirusTotal.com/gui/home/upload
	URLHaus	https://urlhaus.abuse.ch/browse/
	IPInfo	https://ipinfo.io/
	Cisco Talos	https://talosintelligence.com/
	Shodan	https://www.shodan.io/
	Kasperky Threat Intelligence Portal	https://opentip.kaspersky.com/
	Tria.ge	https://tria.ge/
	Malpedia	https://malpedia.caad.fkie.fraunhofer.de/
	Malware Bazaar	https://bazaar.abuse.ch/browse/
Malware Analysis	pestudio	https://www.winitor.com/download
	Detect It Easy	https://github.com/horsicq/Detect-It-Easy
	capa	https://github.com/mandiant/capa
	Floss	https://github.com/mandiant/flare-floss
	ProcDOT	https://www.procdot.com/downloadprocdotbinaries.htm
	Olevba	https://github.com/decalage2/oletools/blob/master/oletools/olevba.py
	Oledump	https://github.com/DidierStevens/DidierStevensSuite/blob/master/oledump.py
	IDA Free	https://hex-rays.com/ida-free
	scdbg	https://sandsprite.com/blogs/index.php?uid=7&pid=152
	Radare2	https://rada.re/n/
	Cutter	https://cutter.re/
	Ghidra	https://ghidra-sre.org/
	AnyRun	https://any.run/
	FakeNet	https://github.com/mandiant/flare-fakenet-ng
	dnSpy	https://github.com/dnSpy/dnSpy
	Hybrid Analysis	https://hybrid-analysis.com/
	Joes Sandbox	https://www.joesandbox.com/#windows
Forensics and Incident Response	Autopsy	https://www.autopsy.com/
	EZ Tools	https://www.sans.org/tools/ez-tools/
	Volatility3	https://github.com/volatilityfoundation/volatility3
	Volatility 2	https://github.com/volatilityfoundation/volatility
	MemProcsFS	https://github.com/ufrisk/MemProcFS
	FTK Imager	https://www.exterro.com/ftk-product-downloads/ftk-imager-4-7-3-81
	Browsing History View	https://www.nirsoft.net/utils/browsing_history_view.html
	CLEAPP	https://github.com/markmckinnon/cLeapp
	PasswordFox	https://www.nirsoft.net/utils/passwordfox.html
	WhatsApp Viewer	https://github.com/andreas-mausch/whatsapp-viewer
	Event Log Explorer	https://eventlogxp.com/
	NirSoft Tools	https://www.nirsoft.net/
	R-Studio	https://www.r-studio.com/Data_Recovery_Download.shtml
	DB Browser for SQLite	https://sqlitebrowser.org/
	Hindsight	https://github.com/obsidianforensics/hindsight
Mobile Forensics	ALEAPP	https://github.com/abrignoni/ALEAPP

Personal Platform Profiles

• TryHackMe | Top 1%
• BlueTeamLabs | Top 10%
• CyberDefenders | Top 10 Aus