Capture The Flags | Information Security Lab

#1

Cryptography Basics

Decode the Base64 string.

RkxBR3tjcmlwdG9fYmFzaWNzfQ==

Concept: Base64 is a binary-to-text encoding scheme. It is easily recognizable by the alphanumeric characters and == padding at the end.
Task: Decode the string to reveal the flag.

Tool: Cryptii Base64 Decoder

#2

Web Inspection

Count word occurrences.

Concept: "Inspecting Element" allows you to view the raw HTML structure. Information is often hidden in comments or invisible text.
Task: View the source of the target page and count exactly how many times the word "of" appears in the HTML text.

Target Page: httpbin.org/html

#3

Steganography

Extract hidden data.

Concept: Steganography conceals a message within another file (like an image).
Task: Download the image below and use an online LSB (Least Significant Bit) decoder to find the text.

Tool: Steganography Online

⬇ Download Image

#4

Regex Pattern

Count 'admin' matches.

User log:admin_01 logged in, guest logged in, admin_99 logged in, root logged in, admin_07 logged in

Concept: Regular Expressions (Regex) match patterns. This pattern admin_[0-9]+ looks for matches count.
Task: Count how many usernames in the list above match this specific pattern.

Tool: Regex101

#5

OSINT

WHOIS Lookup: aih.edu.au

Concept: WHOIS is a query and response protocol that provides information about domain name ownership.
Task: Find the Registrant Name, IP Address, and Nameservers for aih.edu.au.

Tool: WHO.is Domain Search

#6

Rotational Cipher

Decrypt this ROT13 string.

SYNT{ebg13_vf_rnfl}

Concept: ROT13 is a simple letter substitution cipher that replaces a letter with the 13th letter after it in the alphabet.
Task: Decrypt the ciphertext to reveal the flag.

Tool: ROT13 Decoder

#7

Hex to Text

Convert Hexadecimal to ASCII.

46 4c 41 47 7b 68 65 78 5f 69 73 5f 66 75 6e 7d

Concept: Hexadecimal (Base16) is often used to represent binary data. Each pair of hex digits corresponds to one ASCII character.
Task: Convert these hex pairs back into human-readable text.

Tool: Hex to ASCII Converter

#8

Hash Identification

Identify this 32-char hash type.

5d41402abc4b2a76b9719d911017c592

Concept: A hash function maps data to a fixed-size string. The length of the hash often indicates the algorithm used.
Task: This hash is 32 characters (128 bits) long. Which common algorithm produced it? (e.g. md5, sha1, sha256).

Tool: Hash Type Identifier

#9

Linux Permissions

Convert to Octal Notation.

rwx r-x --x

Concept: Linux permissions are summed: Read(4) + Write(2) + Execute(1).
Task: Calculate the 3-digit octal value for: User (rwx), Group (r-x), and Other (--x).

Tool: Chmod Calculator

#10

Linux Distros

Identify the OS.

Concept: Penetration testers use specialized Linux distributions pre-installed with security tools.
Task: Name the most popular Debian-based distro used for hacking (features a dragon logo).

Reference: Kali Linux

#11

Network Scanning (Nmap)

Identify Open Ports.

Concept: Nmap ("Network Mapper") is the industry standard for network discovery and security auditing. It uses raw IP packets to determine what hosts are available and what services (ports) they are offering.
Task: Open your Kali Linux terminal and run the following command to scan the AIHE domain:

nmap aih.edu.au

Flag: Identify the open TCP ports from the scan result and list them in numerical order, separated by commas.

#12

IP Addresses

Localhost Address.

Concept: The "Loopback" address allows a computer to send network signals to itself for testing.
Task: What is the standard numeric IPv4 loopback address?

Reference: Localhost

#13

Protocols

UDP Characteristics.

Concept: TCP establishes a connection (handshake) before sending data. UDP sends data immediately without a handshake.
Task: Because UDP does not verify connections, it is referred to as a ________________ protocol.

Reference: What is UDP?

#14

TCP Handshake

The 3-Way Handshake.

Concept: To start a TCP connection, computers exchange three specific flags.
Task: Complete the sequence: 1. SYN (Synchronize) -> 2. ??? -> 3. ACK (Acknowledge).

Reference: TCP 3-Way Handshake

#15

Malware Types

Identify the threat.

Concept: A specific category of malware that encrypts a victim's files and demands payment for the decryption key.
Task: Name this malware type.

#16

Malware Types

Identify the threat.

Concept: Malware designed to provide continued privileged access to a computer while actively hiding its presence from administrators.
Task: Name this stealthy malware.

#17

Attack Vectors

The Human Factor.

Concept: Not all hacks are technical. Some rely on psychological manipulation to trick people into breaking security procedures.
Task: What is the term for manipulating people to divulge confidential information?

#18

Boolean Logic

Logic Gate Output.

Input: (True OR False)

Concept: In Boolean algebra, an OR operation returns True if at least one input is True.
Task: What is the final output of the logic above?

Tool: Logic Gate Simulator

#19

Forensics

File Signatures (Magic Bytes).

Concept: Computers identify file types by the first few bytes (the "signature" or "magic number"), not just the extension.
Task: Find the first two bytes (in Hexadecimal) of a standard JPEG file.

Reference: List of File Signatures

#20

Security Theory

The Weakest Link.

Concept: A chain is only as strong as its weakest link. In cybersecurity, this usually refers to the user, not the technology.
Task: In a security chain, what is consistently considered the weakest link?

Reference: The Element