Cyberbanak

Level 1 Web CTF

LinkPreview Inc

LinkPreview Inc. has an SSRF vulnerability: its URL previewer fetches user-supplied URLs from the server, allowing access to a localhost-only admin dashboard. The challenge teaches SSRF, internal service access, and safer URL handling.

Level 5 Web CTF

MicroCorp

MicroCorp demonstrates a multi-stage attack: SSRF via a PHP Health Checker reaches an internal Node.js API, while missing authentication and CSRF protection enable privilege escalation from guest to admin and access to the dashboard and flag.

Level 4 Web CTF

Secure Notes

CSRF attack on SecureNotes: A crafted webpage exploits the lack of CSRF protection to change the admin password. The attacker can then log in as admin and retrieve the secret flag from the notes.

Level 3 Hardware walkthrough

Silicon Secrets

Hidden credentials in the SmartLock Pro firmware are obfuscated with single-byte XOR. Analyze the dump, find the protected section, and brute-force the key to reveal the secret flag!

Level 5 Hardware walkthrough

Phantom Wire

The device isn’t hiding much—just speaking in code. Watch the boot messages carefully, spot the encoding, and translate the gibberish. Decode the signal, and the flag will quietly reveal itself.

Level 2 Hardware CTF

Ghost Protocol

The device isn’t hiding much—just speaking in code. Watch the boot messages carefully, spot the encoding, and translate the gibberish. Decode the signal, and the flag will quietly reveal itself.

Level 4 Forensic CTF

Phantom Protocol

The ghost left breadcrumbs in code and chaos. Each file hides part of the truth—scrambled, reversed, and encrypted. Rebuild the pieces, follow the traces, and you’ll uncover the Phantom’s final secret flag.

Level 2 Forensic CTF

Down The Rabbit Hole

Keep digging through the files! Each layer hides another clue. Unzip, decode, and explore—you’ll find the secret flag waiting at the very bottom of the rabbit hole.

Level 1 Forensic CTF

Whispers in The Wire

Look past the image—PNG files end with IEND chunk, but extra bytes after that stay hidden from viewers. Strings command on suspicious_memo.png pulls out the flag lurking in the tail end.

Welcome to Cyberbanak