Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
kerberoasting medium
Medium CTF – Offline Password Cracking You extracted a Kerberos service ticket hash from memory and saved it to a file After running an offline cracking tool, you get the following result: Question…
kerberoasting hard
Hard CTF – Domain Escalation Path You successfully cracked a service account password: Further investigation shows: The account is local admin on hosts a service running as SYSTEM Domain admins…
kerberoasting easy 2
Easy CTF 2 – Ticket Extraction You are monitoring activity from a compromised domain user account Shortly after login, the following event appears in the logs: This event happens multiple times in a…
kerberoasting easy 1
Easy CTF 1 – Finding SPNs You have access to a Windows domain as a low-privileged domain user During basic Active Directory enumeration, you run a command to list Service Principal Names (SPNs) and…
IPS medium
Medium CTF - Evade the Lockout Your organization has an account lockout policy: 5 failed attempts within 10 minutes locks the account for 30 minutes. A UEBA alert fires, flagging "anomalous…
IPS hard
Hard CTF - Full Internal Spray Campaign You are a senior analyst on an incident response call. An alert fired from your deception platform — a honeypot account called (which has never been used by any…
IPS easy 2
Easy CTF 2 - Spray the Lab You are reviewing authentication logs from your SIEM after it triggered a low-priority alert. You notice the following pattern over a 20-minute window: No single account was…
IPS easy 1
Easy CTF 1 - Account Enumeration You are a junior analyst reviewing Kerberos traffic on your internal network. A colleague flagged an unusual spike in packets coming from a single workstation over a…
CH medium
Medium CTF - Memory Dump Analysis Your SIEM triggers an alert on a workstation in the accounting department. The alert reads: You pull the process list from that machine around the same time: You also…
CH hard
Hard CTF - Full Credential Chain You are a SOC analyst investigating a potential breach. Here is a timeline of events reconstructed from logs across multiple systems: Contents of (retrieved from file…
CH easy 2
Easy CTF 2 - Credential in a Share An attacker has gained low-level access to a workstation inside a company network. They run Snaffler to scan accessible file shares. The tool returns the following…
CH easy 1
Easy CTF 1 - Exposed Config File You are doing a security review of a company's internal file share. While browsing through the directory, you come across a PowerShell script called . Inside the…