SOC analysts and on-call engineers
Detection and incident response
Work incidents end to end from web, auth, audit, CI and git evidence using a shell. Each lab starts from a ticket and ends with scope and impact.
- 10/2
Reading web and auth logs
Separate attack traffic from normal traffic and attribute it.
- Investigate a credential-stuffing breachINV-01Detection & ResponsePractitionerNot solved
A customer list leaked. Use web, auth and audit logs to find the account, the attacker and what was exported.
- Find the SQL injection the WAF missedINV-03Detection & ResponsePractitionerNot solved
The WAF blocked a noisy sqlmap scan. Use web, WAF and database logs to prove whether anything got through.
- 20/2
Secrets and supply chain
Find how a credential leaked and everything it was used for.
- Trace a secret leaked by CIINV-02Detection & ResponseAdvancedNot solved
A deploy token was used at 2 a.m. from an unknown address. Find how it leaked, who used it and what was read.
- Trace a key leaked through git historyINV-04Detection & ResponsePractitionerNot solved
A live payments key was “removed” from the repo weeks ago. The repo went public today. Find out what happened.
- 30/2
Compromise and account takeover
Reconstruct a server compromise and an account takeover from the evidence.
- Investigate a web shell on the helpdeskINV-05Detection & ResponsePractitionerNot solved
A PHP helpdesk server called out to an unknown host. Find the uploaded shell, what the attacker ran and whose account they used.
- Investigate an account takeover via password resetINV-06Detection & ResponseAdvancedNot solved
A customer lost her account after clicking a genuine reset email. Work out how the attacker got the token and what they did with it.