Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
ESE medium
Medium CTF – Pick the Exploit Path During recon, you fingerprint a public-facing VPN appliance Nmap + banner info: You search your notes and find two items: A known vulnerability affects some FortiOS…
ESE hard
Hard CTF – Internet to Internal This challenge is about turning an external service foothold into real impact You have one public target in scope: Your recon notes: 1) Exposed Services 2) What you…
ESE easy 2
Easy CTF 2 – Default Creds, Real Consequences You find an externally reachable service on a target host A banner grab shows: When you visit , you get a browser authentication prompt (Basic Auth) Goal…
ESE easy 1
Easy CTF 1 – The Forgotten Admin Panel You’re doing external recon for a permitted engagement. A single public IP is in scope. A quick service check gives you this: Browsing shows a login page titled:…
EPS medium
Medium CTF - Detecting Low-and-Slow Sprays You are analyzing cloud sign-in logs from the past 24 hours. Summary: 1,200 failed logins across 300 users Attempts spread across many IP addresses User…
EPS hard
Hard CTF - Full Attack Chain Investigation You receive an alert for unusual cloud activity. Timeline: Further review shows the attacker used only a few common passwords during the initial phase.…
EPS easy 2
Easy CTF 2 - Login Pattern Analysis Security monitoring shows multiple failed sign-ins across different accounts. Each attempt happens every few minutes, and there are no lockouts triggered. Question…
EPS easy 1
Easy CTF 1 - Identifying Spray Behavior You are reviewing authentication logs from an internet-facing login portal. All attempts used the same password . Question What type of activity does this most…
CWS medium
Medium CTF – Post-Exploitation An attacker exploited a vulnerable web application and obtained a shell as the user . After some enumeration, they discover: is installed A script called can be run with…
CWS hard
Hard CTF – Full Server Compromise During an investigation, you are given these facts: The web server was vulnerable to SQL injection The attacker dumped the users table One of the passwords cracked…
CWS easy 2
Easy CTF 2 – Basic Log Investigation You are reviewing web server access logs after suspicious activity was reported. You find the following request: Shortly after, you see repeated access to:…
CWS easy 1
Easy CTF 1 – Simple Web Exploit A small company hosts a login page for internal staff. During testing, you notice that the login form behaves strangely when special characters are used. Your goal is…