Cryptography protects data only when it is used properly. These
challenges hand you messages protected badly on purpose, and ask you
to recover what is inside.
Read the scenario, solve the task, then submit the flag you
found. Hints are there if you need them — every correct
answer ends with an explanation.
Your Progress
0/ 3
0 pts
CRY-01Easy50 ptsUnsolved
Base of Operations
A configuration file ships with a value the developer described
as “encrypted”. It is a run of letters and digits
ending in two equals signs.
Lab
[database]
host = db.internal.campus.local
user = svc_portal
; password stored "encrypted" so nobody can read it
password = Q1lTNDAxe2I0c2U2NF9oMWRlc19uMHRoMW5nfQ==
Recover the value the developer thought was encrypted.
Show hint
Those trailing equals signs are padding. This is an encoding
with a well-known name, and every terminal and browser console
can reverse it.
What this challenge taught you
Encoding converts data into another format for transport. It
uses no key and protects nothing. Only encryption, with a key
kept secret, provides confidentiality.
CRY-02Easy100 ptsUnsolved
Caesar’s Message
An intercepted note reads as nonsense, but the word lengths and
punctuation survive intact. Each letter has moved a fixed
distance through the alphabet.
Each letter has been shifted by the same amount. Digits and
punctuation were left alone.
Show hint
There are only twenty-five possible shifts. Try them all, or
count which letter appears most and assume it started as E.
What this challenge taught you
A shift cipher has a key space small enough to exhaust by
hand. Modern algorithms are judged partly on key space, which
is why key length matters as much as the algorithm.
CRY-03Medium150 ptsUnsolved
The Reused Key
Two messages were encrypted with the same short key by XOR. You
have both ciphertexts and know how one message begins.
Both messages were XOR-encrypted with the same repeating key,
which is only
4 bytes long. You know
message 1 begins with
Meet.
Show hint
XOR the two ciphertexts together and the key cancels out,
leaving the two plaintexts combined. The known opening gives
you the rest.
What this challenge taught you
A one-time pad is unbreakable only if the key is truly random,
as long as the message, and never reused. Reuse leaks the
relationship between plaintexts, which is enough to recover
both.
Flags are checked on the server: the page never holds the answers,
and your solves are saved to your account and counted on the
scoreboard.
Flags captured. Ready for the next track?
Keep going, or check how many flags you have captured so far.