Forensics practice: first puzzles
Short unguided puzzles reinforce file identification, hashing, metadata and log reading; for each flag you note how you found it.
Level 101 · 12 lessons · 12 practice labs
Lessons
File puzzles
- The flag in a picture with a changed extension
- Find the one file out of a hundred whose hash matches
- Find where a photo was taken
- Short task: a flag hidden in a zip inside a zip
Log puzzles
- Find the one successful attempt in auth.log
- Who opened the admin page in the access log
- A command history someone tried to delete
- Short task: work out the attacker’s time zone from the logs
Mixed puzzles
- Recover a deleted file from a small disk image
- Find a password in a memory fragment with strings
- Put the events in the right order
- Capstone: build one incident story from five pieces of evidence
Practice labs
- The flag in an image with a changed extension: Open the file by finding its real type and read the flag inside.
- Find the matching hash among a hundred files: Find the file with the given SHA-256 hash and submit the flag inside it.
- A flag in a zip in a zip: Open the nested archives in turn, find the password from the hint in the previous layer and reach the flag.
- Find where the photo was taken: Find the city name from the photo's location metadata and write it as the flag.
- A flag hidden in the document's author: Scan the metadata of three office documents and find the field carrying the flag.
- The old picture in the thumbnail: Extract the embedded thumbnail of a cropped photo and read the flag in the cropped-out part.
- The one successful attempt in auth.log: Find the username and address of the successful login among hundreds of failed attempts.
- Who opened the admin page: Find the address and time that got a 200 response for the admin page in the web access log.
- The command history someone tried to wipe: Rebuild in order the commands someone tried to erase from the shell history and remaining traces.
- Find the password in a memory fragment: Scan a small memory fragment with strings and find the flag shaped like a password.
- Recover a deleted file from a disk image: Recover the deleted file in a small image and read the flag inside.
- One incident story from five pieces of evidence: Tell the incident by ordering the clues in a log, file, metadata, image and memory fragment correctly.
About this course
Short unguided puzzles reinforce file identification, hashing, metadata and log reading; for each flag you note how you found it.
What you will learn
- File puzzles
- Log puzzles
- Mixed puzzles
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.