The Scenario
A short, realistic situation to work through, with a difficulty rating, a point value, and a hint if you need one.
Learning by Capturing Flags
An Educational CTF Lab, Built for Practice
The Mini Capture-the-Flag (CTF) Security Lab Platform turns cybersecurity theory into something you do. Each challenge presents a realistic scenario, hides a flag inside it, and explains the lesson once you have captured it.
About the Platform
A CYS401 Group Project
The CTF Security Lab is our semester project for CYS401: Fundamentals of Cybersecurity. This site presents the four challenge tracks, shows how flag submission and progress tracking work, and documents how the platform was built.
Explore Challenges- Course
- CYS401: Fundamentals of Cybersecurity
- Institution
- Prince Sultan University
- Programs
- IS, CS & SE
- Semester
- 261
- Instructor
- Dr. Basmah Ibrahim Alkanjr
- Coursework
- Group project · 15%
Anatomy of a Challenge
The Flag
A hidden string in the form CYS401{...}. Finding it proves you solved the task; submitting it scores the points.
The Explanation
Educational feedback shown after a correct submission, covering why the flaw existed and how it is prevented.
What the Platform Does
Challenges & Hints
Twelve challenges across four categories, each with a scenario and an optional hint.
Flag Validation
Submitted flags are checked and answered immediately, right or wrong.
Progress & Scoreboard
Solved challenges, points earned, and completion status are tracked as you go.
Challenge Categories
Twelve challenges, four tracks, 1,200 points in total.
Web Security
Injection, broken authentication, and exposed data in a deliberately vulnerable web application.
4 challenges · 350 ptsCryptography
Encoding mistaken for encryption, classical ciphers, and keys handled badly on purpose.
3 challenges · 300 ptsSecurity Awareness
Phishing emails, weak passwords, and social engineering you have to spot before you fall for them.
3 challenges · 250 ptsCybersecurity Ethics
Authorization and scope, responsible disclosure, and the legal limits of security testing.
2 challenges · 300 pts