Real hands-on challenges you solve right in your browser — no install, no VM needed. Find flags, crack passwords, read logs, and triage malware. Every solve earns XP and ranks you up toward 1337 Ethical Hacker.
Some secrets hide in plain sight. This very page has a flag hidden in its HTML source. Right-click → "View Page Source" (or press Ctrl+U) and hunt for FLAG{...}.
Web servers leave a robots.txt file telling crawlers where not to look — which is exactly where people hide things. Open this robots.txt ↗ and find the flag.
We intercepted this message: secret-message.txt ↗. It looks scrambled, but it's just Base64 — encoding, not encryption. Decode it (try an online base64 decoder, or base64 -d) to reveal the flag.
Photos carry hidden metadata. Download evidence-photo.png ↗ — the flag isn't in the picture, it's in the file's metadata. Try an EXIF/metadata viewer, or strings / exiftool.
We pulled this password hash from a breached database:
0571749e2ac330a7455809c6b0e7af90
It's an unsalted MD5 of a common password. Crack it (try CrackStation or hashcat) and enter the plaintext password as your flag.
A "stronger" algorithm doesn't save a weak password. Crack this SHA-1 hash:
098c3fdea75ea905a838bc4833abcb13ca6cdcfc
Enter the plaintext password as your flag. Hint: a mythical fire-breathing creature followed by the current year.
This message used a Caesar cipher (letters shifted by a fixed amount):
SYNT{jurry-bs-ebzr-gheaf}
It's shifted by 13 (ROT13). Decode it for the flag.
Someone brute-forced their way into this server. Open auth.log ↗ and find the IP address that hammered failed logins before getting in. Enter the attacker's IP as your flag.
Same auth.log ↗. After breaking in, the attacker logged into one account and used it to copy the backups out. Which username did they compromise and use to exfiltrate data? Enter the account name.
A scheduled task showed up on a client's machine. Read suspicious-command.txt ↗, decode the Base64 PowerShell payload, and figure out what it is. The flag is FLAG{...} describing the technique (hint: it's an encoded PowerShell download cradle).
Head to the Scam Email Museum ↗ and study the first five specimens in the "Legit or Scam?" game. Count how many of those five are scams, then enter the flag in this format: FLAG{N-of-five-were-fakes} where N is the number spelled out (e.g. "three").
Six progressive, hands-on web levels — the kind you'd find on Hack This Site or OverTheWire, rebuilt safely in the browser. Each level is its own page with a real (deliberately broken) gate. Beat it the intended way, grab the flag{...}, and submit it here. No setup, nothing to install.
The browser shows you the page — and hands you its source. Open Level 1 ↗ and find the flag hidden in the page's own HTML.
A "members-only" button is disabled — but the lock lives entirely in your browser. Open Level 2 ↗ and edit the DOM to flip it.
The admin panel is gated by a role cookie sitting on your machine. Open Level 3 ↗ and promote yourself.
A demo app loads a config bundle straight to your browser — and a careless dev left credentials in it. Open Level 4 ↗ and read what shouldn't be there.
You're shown your invoice by ID — but the app never checks it's yours. Open Level 5 ↗ and walk the IDs to a record you shouldn't see.
Boss level. The app accepts JWTs with "alg":"none" — no signature checked. Open Level 6 ↗, forge an admin token, and walk in.
An incident screenshot looks ordinary — but image files carry hidden metadata chunks. Download incident-screenshot.png ↗ and read its metadata (try exiftool, strings, or any online EXIF/PNG metadata viewer). The flag is in a text chunk.
This image hides a message in the least-significant bit of each pixel's blue channel — invisible to the eye. Download hidden-message.png ↗ and extract the LSB data (try a stego tool, or read the blue-channel LSBs in order until you hit a null byte). The recovered text is the flag.
Hit a new rank and you can mint a verifiable Cyber Range badge — signed, shareable, and impossible to fake.
See the Ranks →