Core
Core is a four-profile progression through web investigation, trust boundaries, and applied cryptography. Each profile contains six modules; some depend on earlier evidence as described below. Work only against the assigned Pocket CTF device and preserve useful requests, responses, and calculations as evidence.
Choose the profile first: Easy, Medium, Hard, or Insane. The six stations shown after that choice are the modules for that profile; they are not one unbroken list of 24 modules.
Learning goals
By the end of this track, you will be able to:
- inspect HTML, cookies, headers, methods, parameters, and files as evidence;
- distinguish encoding and checksums from cryptographic protection;
- identify authorization decisions based on client-controlled data;
- reason about signatures, randomness, parser behavior, and protocol state; and
- explain defensive controls for each weakness you demonstrate.
Before you begin
Use the student guide for browser, HTTP, encoding, hashing, and local Python recipes. Join only the network assigned by your instructor. The profiles are ordered by expected background, but modules within Easy, Medium, and Hard can usually be divided among a group.
Insane is different: its first four modules form a dependency chain. Preserve the key material and artifacts returned by each stage. Nonce Encore and Chained Forgery are independent of that chain.
Recommended tools
- A browser with page-source, storage, and network inspection.
- An HTTP client capable of custom methods, headers, cookies, and form bodies.
- Python 3 for bounded searches, encoding, hashing, and modular arithmetic.
- A text editor or notebook for retaining exact values and observations.
Profile map
| Profile | Modules | Focus | Estimated time |
|---|---|---|---|
| Easy | 6 | Browser-visible trust and basic encoding | 120 min |
| Medium | 6 | HTTP behavior and authorization boundaries | 150 min |
| Hard | 6 | Integrity, bounded search, and chained clues | 180 min |
| Insane | 6 | Parser and cryptographic composition failures | 270 min |
Easy profile
Start here for browser-visible evidence, basic encoding, cookies, and simple server trust mistakes.
Medium profile
These modules focus on HTTP behavior, request manipulation, and authorization boundaries.
Hard profile
These modules add integrity checks, bounded local searches, chained evidence, and more deliberate request construction.
Traversal Trap and Signed Sidecar include linked operational documents on the board. Read them for scenario facts, then decide which facts matter to the endpoint under investigation. The module guides support that process without requiring a separate instructor handoff.
Insane profile
This profile covers parser ambiguity and cryptographic composition failures. The first four modules form a dependency chain; the final two are independent.
Suggested pacing
Run Easy and Medium as guided investigations, Hard as paired labs, and Insane as an advanced capstone. Pause after each profile for learners to compare the evidence they used, the trust assumption they broke, and a suitable defense.
Completion and reflection
Completion means recording all six flags for the selected profile and being able to reproduce each result from a clean session. A flag alone is not enough: retain the decisive observation, explain why the test worked, and name a server-side control that would prevent or detect the issue.