Challenge Track 03 · Security Awareness

Spot the Trap Before You Click

Most breaches start with a person, not a machine. These challenges give you the emails, passwords, and phone calls an attacker would use, and ask you to catch what is wrong with them.

New to this topic? Read the Security Awareness workshop first →

Challenges

3

Points Available

250

Difficulty

Easy → Medium

Flag Format

CYS401{...}

Challenges

Capture the Flags

Read the scenario, solve the task, then submit the flag you found. Hints are there if you need them — every correct answer ends with an explanation.

Your Progress

0 / 3

0 pts

AWR-01 Easy 50 pts Unsolved

Urgent: Verify Your Account

An email claiming to be from the university IT desk warns that your account closes in 24 hours. Four details in it give the sender away; naming them reveals the flag.

Lab 

From: "PSU IT Service Desk" <[email protected]>
To: you
Subject: ACTION REQUIRED: Your account will be suspended in 24 hours

Dear Student,

Our system detected unusual sign-in activity on your university account.
To prevent permanent suspension, you must verify your identity within
24 hours using the secure link below:

    Verify my account  →  https://psu-edu-login.verify-account.co/secure

You will be asked for your username and current password.
Accounts that are not verified will be closed without further notice.

Thank you,
PSU IT Service Desk

Which details show this is a phishing email? Select all that apply.

Show hint

Compare the display name with the actual address, hover the link without clicking, and ask why a real IT desk would need your password at all.

AWR-02 Easy 75 pts Unsolved

Password Audit

You are handed a list of account passwords from a staff audit. One of them survives a wordlist attack that breaks the rest — identify it.

Lab 

1.  Summer2026!
2.  P@ssw0rd123
3.  Psu#2026
4.  Qwerty!234
5.  violet canyon harbor lamp seven
6.  Adm1n$tr4tor

A wordlist attack with common substitutions cracked five of these. Which password survived?

Show hint

Substituting 3 for E and 4 for A is the first thing a cracking tool tries. Look instead at which password is simply much longer.

AWR-03 Medium 125 pts Unsolved

The Helpful Caller

Read a transcript of a call from someone claiming to be a new IT contractor. They never ask for a password directly, but they leave with enough to reset one. Work out what they collected.

Lab 

Caller:  Hi, this is Omar from TechServe. We are the new contractor moving
         the staff email to the new system this week. Is this Sara?
Sara:    Yes, speaking.
Caller:  Great. I just need to confirm a few details so your mailbox moves
         across correctly. You are in the Finance office, reporting to...?
Sara:    Dr. Al-Harbi.
Caller:  Perfect. And for the security record, your date of birth?
Sara:    14 March 1998.
Caller:  Thanks. The new system shows a picture on the login page, a lot of
         people use their pet. Did you have a first pet I can set it to?
Sara:    Ha, yes, Luna, my cat.
Caller:  Lovely. Last thing: which phone do you use for the verification
         texts, the one ending in 47?
Sara:    No, it ends in 82.
Caller:  Got it. You are all set. Never share your password with anyone,
         by the way, IT will never ask for it!

The caller never asked for a password. Which details did they collect that could help reset Sara’s account or impersonate her? Select all that apply.

Show hint

List every fact the caller learned, including the ones that sound harmless. Account recovery questions are built from exactly this kind of detail.

Flags are checked on the server: the page never holds the answers, and your solves are saved to your account and counted on the scoreboard.

Flags captured. Ready for the next track?

Keep going, or check how many flags you have captured so far.

Next: Cybersecurity Ethics challenges View Progress