The Case of the Contaminated Report

A training portal contains clues, controlled mistakes, and flags. Your task is not to “break in”: observe, correlate, document.

38 total flags30 flags to complete the missionreport required

Mission

You are a small cyber defence team. Collect at least 30 flags, explain where they are, what risk they represent, and what remediation you would propose.

First hint: the page source is part of the evidence. Not everything lives in the visible interface.

Observation

Visible HTML, source code, comments, non-rendered clues.

Web discovery

Public files and metadata: robots, sitemap, security, humans.

Correlation

Assets, encoding, images, logs, demo APIs, fake backend, XSS lab.

day0-hunt briefing

analyst@day0:~$ observe → collect evidence → explain risk → propose remediation
hint: a flag found without explanation is just a collectible sticker.

Final delivery

Each group must submit a table with: flag, location, method, risk, remediation.

Open flag checker Read rules