Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
IS medium
Medium CTF - SIEM Alert Triage Your SIEM fires an alert. You pull the correlated events and see the following timeline for the account : Question Looking at this sequence, what is the correct order of…
IS hard
Hard CTF - Full Campaign Reconstruction Your team has been called in after an incident. You are given logs from a 72-hour window. Piece together what happened. Cloud event logs show: DAY 2 - 09:02 -…
IS easy 2
Easy CTF 2 - Header Hunt You are analyzing the raw headers of an internal email flagged by your SIEM. The email claims to be from the IT helpdesk asking users to verify their VPN credentials. Question…
IS easy 1
Easy CTF 1 - Suspicious Sender A user reports receiving a strange email. You pull it up and see the following: You check the email logs and notice that john.martinez has not logged into his…
CPF medium
Medium CTF - Credential Pivot You are on an internal Windows machine as a low-privilege user. You run Snaffler and it comes back with a hit on a network share: You check Active Directory and find that…
CPF hard
Hard CTF - Full Credential Hunt You are a security analyst investigating a breach. The attacker has already been evicted, but you need to reconstruct what happened. You have access to endpoint logs,…
CPF easy 2
Easy CTF 2 - Log Digging You are reviewing application debug logs on a compromised server. The development team left verbose logging enabled in production. You find the following entry: Question Which…
CPF easy 1
Easy CTF 1 - File Recon You have just gained a low-privilege shell on a target Linux machine during a penetration test. You start poking around the filesystem and come across the following file at :…
ATM medium
Medium CTF - OAuth Token Abuse A company uses OAuth 2.0 to allow a third-party reporting tool to access employee data. During a security review, you capture the following authorization request being…
ATM hard
Hard CTF - Kerberos Silver Ticket You have compromised a Windows host on a corporate network. Using Mimikatz, you extract the following from memory: The account is the service account running the…
ATM easy 2
Easy CTF 2 - Token from Local Storage You are reviewing the source code of a web application. You notice the following JavaScript running on the login page after a successful authentication: Later in…
ATM easy 1
Easy CTF 1 - Weak JWT Secret A developer built a login system that issues JWTs to authenticated users. You intercept the following token during testing: You decode the payload and get: You run the…