Every technique in this lab is legal here and a crime somewhere
else. The difference is authorization. These challenges ask you to
judge scope, consent, and disclosure the way a professional has to.
Read the scenario, solve the task, then submit the flag you
found. Hints are there if you need them — every correct
answer ends with an explanation.
Your Progress
0/ 2
0 pts
ETH-01Medium150 ptsUnsolved
In Scope, Out of Scope
You are given an engagement letter for a penetration test and a
list of six actions a tester took. Decide which ones the letter
actually permits.
Lab
AUTHORIZATION FOR SECURITY TESTING
Client: Example University, IT Department
Tester: CYS401 Security Team
Scope (in): www.example-university.edu
portal.example-university.edu
Scope (out): all other hosts, including mail.example-university.edu
and any service hosted by third parties
Methods: web application testing only; no social engineering,
no denial-of-service, no physical access
Window: 22:00-06:00, 1-3 November
Contact: [email protected] (findings go here only)
Show hint
Read the scope clause literally. A subdomain that resolves to
a third-party host, and any test outside the agreed window,
are not covered however convenient they are.
What this challenge taught you
Authorization is specific, written, and bounded by systems,
methods, and time. Acting outside it removes your legal
protection entirely, no matter how good your intentions were.
ETH-02Medium150 ptsUnsolved
The Disclosure Dilemma
While solving an unrelated challenge you find a genuine flaw in
a live university service that exposes student records. Choose
the responsible sequence of actions.
Lab
While solving another challenge, you notice that a live
university web service shows other students’ names, ID
numbers, and grades when you change a number in the address
bar. You have not been asked to test this service.
Show hint
Ask at each step whether the action reduces harm to the people
whose data is exposed, and whether it gives the owner a fair
chance to fix the problem.
What this challenge taught you
Responsible disclosure means stopping at proof, not
extraction; reporting privately to the owner; giving
reasonable time to remediate; and never using the finding for
advantage. Confirming a flaw by downloading real records
causes the harm you were trying to prevent.
Flags are checked on the server: the page never holds the answers,
and your solves are saved to your account and counted on the
scoreboard.
Every track done?
Keep going, or check how many flags you have captured so far.