All labs

Crypto

Decode a leaked secret, brute-force a cipher, pull a hidden address out of malware, crack a password dump and break RSA — each with the tool an analyst would reach for.

Briefing

A flag is hidden in each challenge, and you have an analyst's toolkit to get it out. You decode a leaked secret, brute-force a cipher, pull an address out of malware, crack a password dump, and break a small RSA key — one tool per job.

You'll learn to

  • Tell encoding (base64, hex) from encryption, and reverse it
  • Break a shift cipher by trying every key, and a one-byte XOR key by frequency
  • Recognise and crack a hashed password against a wordlist
  • Factor a small RSA modulus and recover the message
0 of 7 steps done0%
Start: Base64 is not a lock
Before you break codesOptional warm-upBytes and hex, XOR, remainders, and why splitting a number into primes is hard. Ten minutes.

  1. Base64 is not a lock

    Up next

    The Kubernetes secret that wasn’t

  2. Twenty-five keys

    Why a small key is no key at all

  3. One byte of secret

    How malware hides where it phones home

  4. You know how it starts

    Breaking a longer key with a crib

  5. The leaked database

    Why hashing a password is not enough

  6. RSA with small primes

    Public keys, and why their size is everything

  7. What to use instead

    The rules that would have saved every file here