Skip to content
vaultocean

Lab

Hands-on hacking labs and CTF in your browser. No VPN, no setup.

Leaderboard

5 challenges ready to play. Sign in to record your solves and earn Fathoms.

Sign in

Web2

easy50ƒ

Leaky Cookie

A session cookie is missing the flag that stops JavaScript from reading it.

0 solvesStart
medium150ƒ

Ghost in the Params

The staff API hands out records by id with no authorization. Climb to the top.

0 solvesStart

Crypto3

easy50ƒ

Spin Cycle

An intercepted note has been rotated. Spin it back.

0 solvesStart
easy75ƒ

Intercepted

A transmission was captured, but it is only encoded — not encrypted.

0 solvesStart
hardComing soon

RSA Twins

Two moduli, one shared prime. Factor them both.

0 solves

Forensics1

easy75ƒ

Evidence Dump

A raw hex dump was pulled from disk. Carve the flag out.

0 solvesStart

Reversing1

hardComing soon

Flat Earth

The binary is packed. Restore it and read the secret.

0 solves

Binary1

insaneComing soon

Abyssal Overflow

No canary, known libc. Redirect execution.

0 solves