Weekly scenarios: season 2
Each week you solve an incident at a mid-sized fictional company by following it through logs, traffic and systems, then apply a lasting fix.
Level 301 · 15 lessons · 15 practice labs
Lessons
Weeks 1–4
- Week 1, Kuzeyhan Hospital: a slow file server and an encrypted folder
- Week 2, Akcay Energy: unusual hours on remote access
- Week 3, Lacivert Bank: suspected session theft on the customer portal
- Week 4, Serin Foods: a fake invoice in a warehouse email
- Short task: propose one detection rule for each of the four incidents
Weeks 5–8
- Week 5, Turna Airways: excessive data from the booking API
- Week 6, Mercan Media: a persistent backdoor on the content server
- Week 7, Vadi University: data flowing out of the lab network
- Week 8, Ekin Retail: a tampered package in the build pipeline
- Short task: calculate time to detect for the incidents and how to shorten it
Weeks 9–12
- Week 9, Kartal Logistics: a compromised service account
- Week 10, Nehir Water Authority: a default password on the monitoring panel
- Week 11, Papatya Insurance: insider data copying
- Week 12, Bulut Games: password spraying against player accounts
- Capstone: unravel the attack chain linking two incidents and report it
Practice labs
- Kardelen Hastanesi: the first encrypted file and the account: In the hospital's file server records you find the first file whose extension changed and the account that did it and write them to the result file.
- Tanyeri Enerji: the command that deleted the backups: From process records you work out on which of the energy company's machines, with which command and by whom the backups were deleted and write it to the result file.
- Başak Tarım: the chain from attachment to encryption: You merge the farm cooperative's mail, endpoint and file server records and write the timeline from the opened attachment to the start of encryption to the result file.
- Dalga Havayolları: one key used from two places at once: In the airline's API logs you find the key used from two networks in the same minute and write the key ID and the foreign address to the result file.
- Kehribar Sigorta: policy records walked in sequence: In the insurer's API logs you count how many other customers' policies one account reached by trying numbers in sequence and write it to the result file.
- Gökkuşağı Medya: where the session was stolen: On the media company's lab copy you prove an editor's session was stolen by a script in the comment field, fix output encoding and submit the flag the checker gives.
- Pırlanta Perakende: a job that calls out at night: You find the outbound-connection command hidden among scheduled jobs on the retailer's till server and submit the target address as the flag.
- Yaprak Üniversitesi: a hidden command embedded in a key: On the university's lab server you find the command attached to a login key that runs at every session, decode it and submit the flag inside.
- Şimşek Oyun: a tampered package in the build cache: In the game studio's build cache you find the package whose hash doesn't match the lock file and the injected line and write them to the result file.
- Ufukhattı Lojistik: files copied to a removable drive: From the logistics firm's endpoint records you find the plugged-in drive's serial number and the number of files copied and write them to the result file.
- Çağlayan Su İdaresi: a large upload to personal storage: In the water authority's proxy logs you find an out-of-hours upload to personal storage, the user and the total size and write them to the result file.
- Mürekkep Yayınevi: an archive split and sent out through name queries: In the publisher's network capture you put in order and rebuild the data smuggled out inside subdomain names and submit the flag in it.
- Fesleğen Restoran: the one account that fell to spraying: In the restaurant chain's login records you find the source trying one password on many accounts and the one account that succeeded and write them to the result file.
- Denizyıldızı Marina: a service account used by hand at night: You write to the result file the hour an account meant only for automated jobs opened an interactive session on the marina's servers and the commands it ran.
- Kızılağaç Orman Ürünleri: a login approved out of fatigue: In the identity provider's records you write the accepted one among a burst of approval prompts and the actions that followed, in order, to the result file.
About this course
Each week you solve an incident at a mid-sized fictional company by following it through logs, traffic and systems, then apply a lasting fix.
What you will learn
- Weeks 1–4
- Weeks 5–8
- Weeks 9–12
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.