EXPLORE THE CURRICULUM
Level 3 · CTF & specialist tracks
Practice web security, pwn, reversing, cryptography and forensics.
Before you begin Experience with introductory security labs · Step 176–303
128 lessons
Reset filtersL3Explore CTF disciplinesStep 176–1816 lessons
- 176 CTF First Taste 1: Five Web Challenges — Entering the Real ArenaExplain CTF's format (flags, categories, submission)
- 177 CTF Taste Test 2: Pwn Challenge (pwnable.kr) — First Encounter with a BinaryExplain the structure of a Pwn challenge (analysis file + target server)
- 178 CTF Taste Test 3: Reversing — Two crackmes + Ghidra — How to Read Without SourceExplain the difference between static analysis (reading without executing) and dynamic analysis (observing whi…
- 179 CTF Taste Test 4: Three Crypto Intros — Cryptography as Math PuzzlesExplain the difference between encoding and encryption
- 180 CTF Taste Test 5: Forensics & Misc 3 — Dissecting Suspicious FilesDetermine a file's real type from its magic bytes (file signature)
- 181 ★ Choosing Your Main Field + Deciding a Secondary — What Kind of Player Am I?Compare the five fields' characters (learning curve, competition weight, career links) in a table
L3Assembly & system foundationsStep 182–1909 lessons
- 182 Assembly 1: Registers, mov/push/pop/call/ret, Stack Frames — The Alphabet of the Common LanguageKnow the names and roles of the x86-64 general-purpose registers (rax, rdi, rsp, rbp, etc.)
- 183 Assembly 2: gdb Basics — A Microscope for Running ProgramsExplain what gcc -g -O0 means (-g: debug info, -O0: optimization off) and build a debugging binary
- 184 Assembly 3: Following a C Program Line by Line in gdb — Live Coverage of the Calling ConventionRead assembly source made with gcc -S side by side with gdb's disas output
- 185 The Stack, Fully Understood — A Complete Map of What Piles Up on a Function CallDraw the order of what piles up on the stack on a function call (local variables → saved rbp → RET)
- 186 ★ Reproducing a Buffer Overflow: RET Overwrite Success — Your First Memory AttackCompile a target binary with lab-only options and explain what each option means
- 187 Protections: NX, ASLR, Canary, PIE — A Map of the Four-Layer DefenseExplain the working principle of each of the four protections — NX, Canary, ASLR, PIE — in one sentence
- 188 pwntools 101: Connections, p64, Payload Automation — From Hand Attacks to ScriptsInstall pwntools in a venv and verify the installation
- 189 ★ Mini Project: Completing an Overflow Exploit Script — Turning a Hand Attack into EngineeringExplain the principle of the cyclic() pattern (a sequence of non-repeating chunks)
- 190 Finding/Forming a Team + the CTFtime Calendar — Turning a Solo Game into a Team SportRead CTFtime's competition calendar, team pages, and ranking structure
L3Advanced web securityStep 191–20212 lessons
- 191 PortSwigger Academy: Advanced SQLi — Blind, time-based, OOBDistinguish Blind SQLi's three oracles (true/false, time, OOB) by situation
- 192 Advanced XSS: CSP Bypass, DOM Deep Dive — Attacking Where Defenses ExistRead a CSP header's directives (script-src, 'self', etc.) and interpret their meaning
- 193 SSTI: Template Injection → RCE — When Your Input Becomes the Server's CodeExplain that SSTI shares the same root as SQL injection and XSS (input becomes code)
- 194 SSRF — Making the Server Your Proxy to Read the Internal NetworkExplain why SSRF arises from "features that send requests on your behalf"
- 195 XXE — The File-Reading Command Hidden in the XML ParserRead XML DOCTYPE and entity declaration syntax, and explain why external entities are dangerous
- 196 Deserialization Vulnerabilities — The Moment Data Becomes CodeExplain what serialization and deserialization are, and why deserialization leads to code execution
- 197 Advanced JWT Attacks — Becoming Admin via alg Confusion and Weak SecretsExplain the key-structure difference between HS256 (symmetric) and RS256 (asymmetric)
- 198 GraphQL/API Security — Enter Through One Door, Read the Whole SchemaRead the structure of a GraphQL query and explain how it differs from REST
- 199 Webhacking.kr 1–15 — The Korean Wargame Sampler PackRead Webhacking.kr's challenge list structure (points, solve counts) and gauge difficulty
- 200 Webhacking.kr 16–30 — Creative Combinations of TechniquesList a problem's "visible defenses," build a table of bypass candidates, and eliminate them
- 201 Race Conditions & HTTP Request Smuggling — Attacks of the Instant and the MisalignmentExplain the structure of TOCTOU (time-of-check to time-of-use) with a diagram
- 202 ★ Midterm Check: Solve Three Intermediate Web Challenges Independently in a Row — The No-Write-up ZoneApply challenge-selection criteria that keep the check fair (randomness, pre-blocking by type)
L3Pwn & memoryStep 203–21412 lessons
- 203 Writing Shellcode: Hand-Crafting an execve Shellcode — The 29 Bytes That Spawn a ShellExplain the execve system call convention (rax=59, rdi, rsi, rdx)
- 204 ret2win: Calling the Function You Want — RET Overwrite That Even Hands Over the ArgumentExplain that in the System V calling convention, the first argument is passed via rdi
- 205 ROP 1: The Gadget Concept, ROPgadget/ropper — The Assembly Art of Code FragmentsKnow the definition of a gadget ("an instruction fragment ending in ret") and the kinds of useful gadgets
- 206 ROP 2: Calling system("/bin/sh") with a Chain — Past NX, Into a ShellExplain why ROP is the only road on an NX-enabled binary
- 207 ret2libc: Leaking the libc Address to Bypass ASLR — Tracing an Address That Changes Every RunProve with an ldd measurement how ASLR changes libc's address
- 208 Format String: Writing Memory with %n — An Attack That Writes Through a Print FunctionExplain why printf(buf) is vulnerable, in comparison with the correct code
- 209 Finishing pwnable.kr Toddler's Bottle — Graduation Day for the Beginner WargameSummarize the full Toddler's Bottle challenge list and the trap each one teaches
- 210 Understanding GOT/PLT and the GOT Overwrite — Hijacking Function CallsExplain the roles of the PLT (jump pads) and the GOT (address table), and the sequence of lazy binding
- 211 Heap Fundamentals: Allocator Behavior and the Use-After-Free Concept — Reusing Returned LandDraw the structure of a heap chunk (header + user data) and compute its size
- 212 A Taste of Heap Exploitation: tcache Poisoning — Overwriting the Queue's LedgerExplain that the tcache is a singly linked list, and where the next pointer lives
- 213 Three Easy pwnable.tw Challenges — Into a World Without SourceExplain the difficulty and structure differences between pwnable.kr and pwnable.tw
- 214 ★ Midterm Check: Independent Exploitation of a Canary+NX Binary — Leak It, Keep It Alive, Overwrite ItDesign the entire exploit process yourself, from protection identification (recon) to strategy
L3Reverse engineeringStep 215–22612 lessons
- 215 Ghidra In Depth: Function Analysis and Struct Recovery — Turning Machine-Made Names into Human LanguageRename functions (L) and edit signatures (Edit Function Signature) in Ghidra
- 216 x64dbg In Depth: Memory Breakpoints and Patching — Surgery on a Running ProgramPerform the routine of reverse-tracing comparison code via string search in x64dbg
- 217 10 crackmes (Easy Difficulty) — Building the Speed to Recognize PatternsDistinguish the three types of easy crackmes (direct comparison / transformed comparison / per-character branc…
- 218 10 crackmes (Medium Difficulty) — Reading Relations, Opening Gates One by OneDistinguish the three hallmarks of medium difficulty (relational verification, multi-stage checks, runtime-dep…
- 219 Anti-Debugging Techniques and Bypasses — Programs That Dodge Debuggers, and How to Break ThroughExplain what anti-debugging is and why it's used
- 220 Packing and Unpacking — UPX and Finding the OEPExplain the structure of a packer — a compressed payload plus an unpacking stub
- 221 Keygen — Serial Algorithm Analysis and Writing a GeneratorExplain the standard structure of a serial verification program (input → transform → compare)
- 222 Reversing .NET and Python Binaries — Binaries That Aren't Machine CodeExplain and identify the differences between native / .NET / Python binaries
- 223 A First Taste of Android APK Analysis — jadxExplain an APK's internal structure (AndroidManifest.xml, classes.dex, resources)
- 224 Strategies for Analyzing Obfuscated Code — Read It Head-On and You LoseDistinguish the three types of obfuscation (name destruction, string encryption, control-flow flattening)
- 225 Static Malware Analysis (Isolated Lab Required) — Reading the Insides Without Running ItExplain the three rules of an isolated lab (network isolation, snapshots, dedicated environment) together with…
- 226 ★ Mid-Check: Independently Dissecting a Medium-Difficulty crackme — No Solutions, All the WaySelect a crackme that makes for a fair test (difficulty, architecture, solution-count criteria)
L3Cryptography & CryptoStep 227–23812 lessons
- 227 Math Foundations: Modular Arithmetic, the Euclidean Algorithm, Euler's Theorem — Crypto's Minimum ArmamentUnderstand modular arithmetic as "clock arithmetic" and compute with Python's % and pow(a, b, n)
- 228 Full RSA Implementation: From Key Generation to Encryption/Decryption — The Textbook, by My Own HandsGenerate 512-bit primes yourself with Miller-Rabin primality testing
- 229 RSA Attacks 1: Small e, Common Modulus — The Moment Implementation Mistakes Become Mathematical WeaknessesRecover plaintext via the integer cube root when e=3 and m^3 < n
- 230 RSA Attacks 2: Fermat Factorization, Wiener's Attack — When Key Generation Is Botched, the Math CollapsesImplement Fermat factorization and explain the relationship between the p–q distance and the iteration count
- 231 Completing Cryptopals Set 1 — The Textbook of XOR Attacks, in My CodeConvert freely among hex ↔ bytes ↔ base64 and explain each format's role
- 232 Cryptopals Set 2: ECB/CBC, the Padding Oracle — Piercing the Block Cipher's CracksImplement PKCS#7 padding and explain why the true/false of validity checking leaks information
- 233 AES Structure and Mode-Specific Vulnerabilities — Anatomy of the World Standard and a Map of FailuresState AES's block and key sizes and the round counts (10/12/14) they correspond to
- 234 Hash Attacks: Length Extension and Collision Concepts — What Happens When You Use a Hash as a "Signature"Explain that Merkle-Damgård hashes "carry forward internal state"
- 235 DH Key Exchange and an MITM Simulation — Making a Secret on an Eavesdropped Channel, and Its LimitsImplement the DH key-exchange procedure (exchange g^a mod p → share g^ab mod p) in code
- 236 A Taste of ECC: Addition on an Elliptic Curve — Adding Points to Build a CipherEnumerate every point of an elliptic curve y² = x³ + ax + b (mod p) over a finite field
- 237 10 Real CTF Crypto Problems — The Day You Deploy Your Arsenal in the FieldNarrow a Crypto problem's type candidates down to two by looking at the given numbers (parameter sizes and sha…
- 238 ★ Midterm Check: Independently Solving 5 Medium Crypto Problems — The Write-up Forbidden ZoneApply problem-selection criteria (random, pre-exposure blocked) for a fair check
L3Digital forensicsStep 239–25012 lessons
- 239 Hex and File Signatures: file, binwalk, Manual Carving — An Identity Check on Six BytesName the file type from the magic bytes of 10 major formats
- 240 Steganography: LSB, zsteg, Audio Spectrograms — The Letter Behind the Visible PictureExplain the principle of LSB embedding and hide and extract data yourself in Python
- 241 Advanced pcap Analysis: Wireshark Advanced Filters, tshark — Reconstructing an Incident from Ten Thousand PacketsDecide "where to dig first" with -z io,phs (protocol hierarchy) and -z conv,tcp (conversation list)
- 242 Memory Forensics: Volatility 3 — How to Catch Evidence That Vanishes When the Power Goes OffEnumerate the kinds of evidence that exist only in memory (processes, connections, command lines, cleartext da…
- 243 Disk Forensics: Autopsy, Deleted-File Recovery — What's Deleted Isn't GoneExplain structurally that filesystem deletion is "deallocation," not "data erasure"
- 244 Windows Forensics: Registry, Event Logs, Prefetch — Digging Through the Archive of Execution TracesExplain three kinds of Windows execution traces (Prefetch, UserAssist, event logs) using the term artifact
- 245 Log Analysis Scenario: Reconstructing an Intrusion Timeline — Scattered Puzzle Pieces into a Single Line of StoryRead one line of a web access log (Apache format) and an authentication log (auth.log format)
- 246 EXIF/Metadata and Document Forensics — Reading the Fingerprints Engraved Inside FilesExplain what EXIF and document metadata are and why they become evidence
- 247 Encrypted-Artifact Recovery Techniques — Three Keys That Open Locked EvidenceRecover a single-byte XOR-encrypted file with brute force (256 tries)
- 248 Five Comprehensive Forensics Challenges — Linking the Chain of Techniques on Your OwnPhysically perform the investigative order that starts with a signature check when handed an unknown file
- 249 Network Breach Analysis Simulation — Reconstructing the Incident Inside PacketsState the five phases of the IR process (preparation → detection → containment → recovery → lessons learned)
- 250 ★ Mid-Track Check: Solving a Comprehensive Forensics Challenge Independently + Report — Becoming Someone Who ProvesSelect and start a comprehensive forensics challenge without help
L3Practice machines & pentestingStep 251–27828 lessons
- 251 TryHackMe Intro Path + 3 Easy Rooms — Opening the Door to Real MachinesExplain the structure of a TryHackMe room (tasks, questions, hints, machines)
- 252 THM Easy ×5 (8 Cumulative) — Engraving the Routine into Your FingersApply the same routine to machines of different types (web-centric, SMB-centric, etc.)
- 253 THM Linux Privesc Rooms (13 Cumulative) — After the Shell, All the Way to rootRun the first command set right after getting a shell (sudo -l → SUID → cron → passwd permissions) in order
- 254 THM Windows/AD Intro Rooms (18 Cumulative) — Meeting the Protagonist of Corporate EnvironmentsBuild an approach strategy upon seeing a Windows machine's signature service ports (SMB 445, RDP 3389, WinRM 5…
- 255 Hack The Box Starting Point Complete Run — Up to a Stage One Level HigherExplain the structural differences between HTB and THM (hints, machine operation, flag style)
- 256 HTB Easy ×2 — Alone to root: The First Complete Run Without GuidanceExplain the boundary between allowed and forbidden resources under "solving alone"
- 257 HTB Easy x2 (Cumulative 4) — Widening Your Repertoire of Entry PointsClassify initial access vectors (entry points) by type and diagnose the skew in your own experience
- 258 HTB Easy x2 (Cumulative 6) — Time-Limit Training: Solving with the Clock OnSet per-phase time allocations (recon/exploitation/escalation) and enforce them with alarms
- 259 Linux Privilege Escalation, Fully Conquered — From Patterns to a ChecklistList the eight patterns of Linux privilege escalation and the discovery command for each
- 260 Windows Privilege Escalation, Fully Conquered — Doors of Services, Tokens, and SettingsRead whoami /priv output and understand what SeImpersonatePrivilege means
- 261 Active Directory 1 — Understanding Domain StructureDraw the relationship between domain, tree, forest, and domain controller (DC) as a diagram
- 262 Active Directory 2 — Kerberoasting and AS-REP RoastingExplain, on top of the Kerberos flow, why Kerberoasting is "abuse of a normal feature"
- 263 Active Directory 3 — Pass-the-Hash and BloodHoundExplain why the NTLM challenge-response structure creates "hash = password"
- 264 Pivoting, Deepened — Through the Compromised Machine into the Internal NetworkExplain with a diagram why pivoting is needed in a dual-network structure (an internal network inside the DMZ)
- 265 One HTB Medium Machine — Solve It Independently, Even If It Takes DaysExplain the structural differences between Easy and Medium (chains, misdirection, enumeration demands)
- 266 Medium Review + Re-Attack — How to Learn After SolvingReconstruct a timeline from your progress log and quantify "where the time went"
- 267 One HTB Medium Machine (Cumulative 2) — Read the Starring Service, Turn Stuck Points into StatisticsIdentify the machine's type (web-focused / service-focused / AD, etc.) and its "starring service" from the fir…
- 268 One HTB Medium Machine (Cumulative 3) — The Depth of EnumerationDistinguish enumeration's "wide" from "deep," and choose the side that fits the kind of stuck
- 269 One HTB Medium Machine (Cumulative 4) — Vulnerability ChainingExplain the concept of vulnerability chaining and the representative pattern (information disclosure → authent…
- 270 One HTB Medium Machine (Cumulative 5) + Medium Graduation ReviewIndependently attack a fifth Medium machine
- 271 One HTB AD-Track Machine — The Standard Route to Domain TakeoverRead an AD machine's scan results (SMB, LDAP, Kerberos ports) and judge that it's a domain environment
- 272 Completing Your Own Pentest Playbook — Taking a Photo of Your Current SkillIntegrate scattered routine documents into a playbook with an 8-section structure
- 273 HTB Hard Challenge 1 — Enumerate Deeper, Test HypothesesExplain the three traits that make Hard different from Medium (unknown techniques, hidden entrances, multi-sta…
- 274 HTB Hard Challenge 2 — Repaying Technical Debt: Turn What You Don't Know into a List and Pay It OffExtract "what I couldn't do because I didn't know" from an attack log using [UNKNOWN] tags
- 275 HTB Hard Debrief — Analyzing Top Players' Write-ups: Read the Reasoning, Not the ResultsApply a dissection method that reads a write-up not as an "answer key" but as "a record of a thought process"
- 276 Speed Training: Easy in Under 4 Hours — Push Your Routine to AutopilotBuild and keep a stage-by-stage budget table for a 4-hour Easy time attack
- 277 Speed Training: Medium in Under 8 Hours — Stamina and Pace Allocation for the Long GameBuild a stage-by-stage budget table for a Medium 8-hour run (enum 2h / foothold 3.5h / privesc 2h / slack 0.5h…
- 278 ★ Real-World Check: Medium Time Attack + Presentation Practice — Solving and Explaining Are Different MusclesAssault a Medium machine in an 8-hour time attack while simultaneously collecting presentation evidence (captu…
L3CTF competitions & reflectionStep 279–30325 lessons
- 279 ★ CTF Competition #1: Full Weekend Participation — The Goal of Your First Competition Is Finishing, Not RankingRun a checklist that inspects environment, tools, and playbook before the first competition
- 280 CTF Debrief Block A: Digging Three Unsolved Problems to the Bottom — Skill Grows in the Debrief, Not the CompetitionApply the criteria for selecting the 3 highest-debrief-value problems from a competition log
- 281 ★ CTF #2: This Time as a Team — The Day You Learn the Efficiency of Division and the Cost of Communication at OnceAgree on field assignments and clue-sharing rules in a 30-minute kickoff meeting
- 282 CTF Debrief Blocks A + B: Writing Three Write-ups — A Reproducible Write-up Is Proof of SkillApply the 6-part structure of a write-up a reader can reproduce (problem info / observation / attempts / failu…
- 283 ★ CTF #3: Team Debut + Goal Setting — Only Measurable Goals Grow a TeamDistinguish ranking goals from behavior goals, and design competition goals out of behavior goals only
- 284 CTF Debrief Block A + Team Meeting: Weakness Analysis — Drawing the Team's Map with Data, Not GutOrganize three competitions' results into a per-field table of attempts / successes / time taken
- 285 ★ CTF #4: The Weakness-Field Assault Competition — The Courage to Set Your Strengths Down for a WhileExplain the principle of deliberate discomfort training and apply it to a competition
- 286 CTF Debrief Block B: Reaching 30 Accumulated Write-ups — Records Grow by Compound InterestCount the current total with an accumulation tally and plan how to fill the shortfall
- 287 ★ CTF #5: The Main-Field Depth Confirmation Match — A Competition That Measures Where Our Ceiling IsQuantify "current weight class" by measuring success rates per difficulty within one field
- 288 CTF Debrief Block A + Focused Weakness Work: A 10-Problem Boot Camp on the Type You Keep Missing — Chronic Ills Are Cut by Concentrated RepetitionSelect the TOP failure-frequency types from debrief records using data
- 289 ★ CTF #6: The Midterm Evaluation Competition — Aiming for the Top 50%, the Team That Reads the Scoring Structure Harvests the PointsExplain the difference between static scoring and dynamic scoring, and what each means for solving strategy
- 290 CTF Debrief Blocks A + C: Tidying Exploit Code — Turning Improvisation into AssetsApply the debrief block A routine (digging unsolved problems to the bottom) to the midterm competition
- 291 ★ CTF #7: Live-Fire Library Validation — An Asset's Value Is Proven Only at a CompetitionOpen the library index as the competition starts and reach a type-match verdict within 10 seconds
- 292 CTF Debrief Blocks A + B: 40 Write-ups Accumulated — Writing That Gets Read Is Proof of SkillDig three unsolved problems from competitions #6–#7 to the bottom with the block A routine and close them as w…
- 293 ★ CTF #8: The Team Tactics Experiment — Role Rotation, Trading Points for a Map of the TeamFix the prior agreements of a role-rotation experiment (purpose, assignments, rules) in a document
- 294 CTF Debrief Block A + 50 Write-ups + Blog Tidy-Up — The Moment Records Become a CareerDig competition #8's unsolved problems to the bottom with the debrief block A routine and reach 50 write-ups
- 295 ★ CTF #9: The Top-30% Goal Competition — A Testing Ground for Measuring Your Weight ClassBuild a per-field expected-scoring table from recent competition data, grasping your strength in numbers
- 296 CTF Debrief Block A + Team Strategy Checkup: Operations Improvement — Reducing Friction, Not Just Tech, Is Also PointsExtract operational metrics from chat logs — clue response times, buried clues, status-board update intervals
- 297 ★ CTF #10: 10th Competition Special — The Full Retrospective — Growth Is Not Linear, It Is a Cycle of Plateaus and LeapsEnter the 10th competition with your usual routine intact, securing comparable data
- 298 Preparing for Domestic Qualifiers: Solving CODEGATE/CCE Past Exams — Past Exams Are the Best TextbookCollect problems from CODEGATE/CCE public past-exam archives and structure the list
- 299 Qualifier Speed Training: 10-Problem Time Attack — The Technique of a Pace That Sweeps Easy Problems FirstDesign a mixed-field 10-problem set matching the qualifier format
- 300 ★ CTF #11: Qualifier Dress Rehearsal — A Rehearsal Validated at 80% PowerOperate a competition as "a simulation of the qualifier" — matching even the time slots and rest plan
- 301 CTF Debrief Blocks A + B: The Final Reinforcement — Sealing the Leaks and Building the Battle PackDebrief competition #11 with the block A (dig unsolved problems to the bottom) and block B (Write-up) routines
- 302 ★ CTF #12: The Goal-Attainment Competition — Top 30%, Season FinaleExecute the fixed strategy as-is, without experiments — blocking the temptation to modify strategy mid-competi…
- 303 ★ Level 3 Comprehensive Evaluation: Score Analysis of the Last 3 Competitions + Level 4 Plan — Close with Data, Open with DesignVerify the Level 3 completion eligibility conditions (12 competition logs, 12 retrospectives, 3 Hard-tier Writ…