Standard Lab Kit Instructor Guide

Module: Open Source Intelligence

Topic: Meta

Objective

Students will be able to use a metadata viewer to determine information about a photo that was taken.

Prompt

This challenge will give you experience with extracting metadata from an image file. You are given an image with contains metadata and you will need to use a metadata viewer to help answer the questions.

Questions & Answers

When was the image created? (Round to the nearest minute) Answer: 2015/05/15 02:14
What is the image size in pixels? (ex: 800x600) Answer: 1024x768
What is the make of the camera that took the picture? Answer: apple
What is the model of the camera that took the picture? Answer: iphone 5
What is the exposure time for the picture? (ex: 1/200) Answer: 1/640
Where was the picture taken? Please use only positive numbers with 4 decimal places. (ex: 45.4000N, 75.6667W) Possible answers: ● 39.8750N 20.0100E ● 39.8750N, 20.0100E ● 39 deg 52' 30.00" N, 20 deg 0' 36.00" E ● 39 deg 52' 30.00" N 20 deg 0' 36.00" E ● 39.8750 20.0100 ● N 39° 52' 30'' E 20° 0' 36'’ ● Latitude 39:52:30 Longitude 20:0:36 ● 39; 52;30 20;0; 36 ● 39º 52' 30.00" N, 20º 0' 36.00" E Incorrect answers: ● 39.8750 -20.0100 ● -39.8750 -20.0100 ● -39.8750N, 20.0

Extension Activities

Grade level	Extension Activity	Objective	Activity Steps
6-8	News Verification Lab	Distinguish between real and fake news using OSINT techniques.	Give students headlines or short articles. Ask them to: Reverse image search pictures Check sources Cross-reference news stories
9-12	OSINT Tools Treasure Hunt	Explore safe, open-source tools.	Tools: WHOIS lookup, Google Earth, The Wayback Machine, Social Search Engines (e.g., Social Searcher, IntelX) Activity: Create a challenge where students have to: Find who owns a domain Look at archived versions of a website (use wayback machine) Track public social posts for patterns

Walkthrough

Topic: Lookup

Objective

Students will be able to find and use a specification document to answer questions about DNS.

Prompt

Answer these questions about DNS. Make sure you enter the record type and not the description of the record type.

Questions & Answers

What type of DNS record hold the DNSSEC public signing key?

Answer: DNSKEY

What type of DNS record is used to map hostnames to IPv6 addresses?

Answer: AAAA

What type of DNS record is used to delegate a DNS zone?

Answer: NS or Name Server

Extension Activities

6-8	Username Investigation Game	Understand how usernames can reveal a digital trail.	Give a fictional username (e.g., “AlexGamer47”) and have students: Search for it on YouTube, Twitter (using screenshots), or game forums. Record patterns of use: hobbies, interests, locations. Discussion Prompt: Why do people reuse usernames? What can others learn from that?
9-12	Social Media Pattern Analysis	Understand how public posts create patterns.	Using a fictional account (set up by the teacher), have students: Map post times and locations Identify potential routines Connect hashtags to interests or communities

Walkthrough

Topic: Threat Intel

Objectives

Students will be able to use search tools to answer questions about security topics.

Prompt

Answer the following questions about security issues.

Questions & Answers

What is the CVE of the original POODLE attack?

How to solve: The answer to this question can be found on Wikipedia. Answer: CVE-2014-3566

What version of VSFTPD contained the smiley face backdoor?

How to solve: The answer to this question can be found on Wikipedia. Answer: 2.3.4

What was the first 1.0.1 version of OpenSSL that was NOT vulnerable to heartbleed?

How to solve: The answer to this question can be found on Wikipedia. Answer: 1.0.1g

What was the original RFC number that described Telnet?

How to solve: The answer to this question can be found on Wikipedia. You will have to search another linked Wikipedia page for more information related to when Telnet was first developed. Answer: 15

How large (in bytes) was the SQL Slammer worm?

How to solve: The answer to this question can be found on Wikipedia. Answer: 376

Samy is my…

How to solve: The answer to this question can be found on Wikipedia. Answer: hero

Extension Activities

6-8	Build-A-Hacker Workshop (Fictional Personas)	Understand how threat actors gather info.	Given a scenario (e.g., a hacker wants to target a school), students: Use fictional student or staff profiles. Identify what information is publicly available (e.g., school calendar, staff names).Outcome: Students write a short paragraph predicting how the hacker might use the info and how to defend against it. Have students share their writings.
9-12	Fake Job Post Scam Breakdown	Understand how cybercriminals target individuals.	Students analyze fake job posts or emails (pre-curated).Use OSINT to check company legitimacy (e.g., WHOIS, company site vs fake URL).Discussion Prompt: How do threat actors use platforms like LinkedIn to customize attacks?

Walkthrough

Topic: HTTP Headers

Objectives

Students will be able to find resources to understand different types of HTTP request headers.

Prompt

Solve these questions about HTTP headers.

Questions & Answers

What HTTP request header is used to denote what URI linked to the resource being requested?

Answer: referer *Note that the official specification for this header has “referrer” spelled incorrectly as “referer”

What HTTP request header is used to identify the client software that made the HTTP request?

Answer: user-agent

What HTTP request header is used to identify the acceptable content types that can be returned?

Answer: accept

Extension Activities

6-8	"What’s in a Web Request?" – Header Basics Lab	Introduce basic HTTP headers using simplified, printed mockups.	Present a mock HTTP GET request with headers like User-Agent, Host, and Referer. Ask students to decode what device/browser was used, what website was accessed, and where the request came from. Discussion Prompt: How could this data help someone track you online?
9-12	OSINT Header Case Study	Analyze how HTTP headers were used in a real-world investigation.	Setup: Use a public case (e.g., website misconfiguration or tech stack leakage). Activity: Provide captured headers from the case. Ask students to infer: Server type, Technologies in use, Possible vulnerabilities. Ethics Discussion: When is it okay to analyze headers? What should be off-limits?

Walkthrough

Topic: WHOIS

Objective

Students will be able to conduct a WHOIS query to learn publicly available information about a domain name.

Prompt

Conduct open source intelligence data collection about cityinthe.cloud. Answer the following questions as they relate to the cityinthe.cloud domain.

Questions & Answers

Who is the registrar of this domain?

Answer: Dynadot

On what day was this domain first registered?

Answer: 2016-02-16

What is this domain's registry domain ID?

Answer: D15CD1AC4DEB54207A5048A69B9FC0558-ARI

What is the Top-Level Domain (TLD) of this domain?

Answer: cloud

What organization manages the TLD used by cityinthe.cloud?

Answer: Aruba

Extension Activities

6-8	WHOIS Mystery Matching Game	Connect WHOIS records to fictional organizations.	Setup: Create 3–4 mock WHOIS records and 3–4 fictional website profiles. Activity: Students analyze clues like registrar location, organization name, or domain age. Match each WHOIS record to the correct fake website. Use cards or slides for a collaborative classroom game.
9-12	WHOIS in the Real World: Threat Intelligence Report	Apply WHOIS to a broader investigation.	Assign a simulated incident (e.g., spam email, fake site).Students gather WHOIS data, infer attacker profile traits (e.g., fast-registered domains, offshore registrars).Produce a 1-page “Threat Intel Summary.”

Walkthrough

Topic: PGP Lookup

Objectives

Students will query a public key database to identify the types of information stored there.

Prompt

Individuals use PGP to securely encrypt their emails, can you find out more about the following PGP keys?

Questions & Answers

What is the key fingerprint for security@cpanel.net?

Answer: B6709B4CC6F42077F69841919521BEDCABD94DDF

What email address is associated with the key fingerprint 7A39A56B73D1E097D57435CFCDE2DE1DCB2077F2?

Answer: hx@liber8tion.cityinthe.cloud

On what date does the above key expire (in UTC)?

Answer: 2050-12-26

Extension Activities

6-8	Understanding Digital Signatures	Introduce students to the concept of digital signatures and their role in verifying the authenticity of digital communications.	Discuss the basics of encryption and how digital signatures work. Use a simple analogy (like sealing a letter in an envelope) to explain how PGP ensures message integrity. Provide examples of how digital signatures are used in everyday life (e.g., software downloads, secure emails).
9-12	Analyzing PGP Key Metadata	Teach students how to extract and analyze metadata from PGP keys to gather OSINT.	Provide students with sample PGP public keys (ensure these are fictional or anonymized).Guide students through the process of examining key details such as creation date, associated email addresses, and key fingerprints. Discuss how this information can be used in digital investigations and the importance of ethical considerations.

Walkthrough

Topic: SSL

Objectives

Students will use a browser in order to analyze a SSL certificate chain.

Prompt

Solve the following questions about the Cyber Skyline SSL certificate.

Note: If you see references to "BitDefender" in the process of solving this challenge, that means your BitDefender software is intercepting your SSL/TLS connection and will produce incorrect results.

Questions & Answers

Who is the issuer for Cyber Skyline's SSL certificate?

Possible Answers: sectigo, comodo

How many bits long is the SSL key?

Answer: 2048

How many certificates are in the certificate chain?

Answer: 3

Extension Activities

6-8	“What's in a URL?” Sorting Game	Learn to distinguish between HTTP and HTTPS.	Provide a stack of fake or real URLs.Students sort into “Secure” (HTTPS) and “Not Secure” (HTTP).Discuss what might happen if you send personal data over an insecure connection.
9-12	Expired or Misissued Certificate Challenge	Understand how SSL certificate issues may indicate threats.	Provide samples of expired, self-signed, or misconfigured certificates (can be screenshots or from certificate transparency logs).Students determine what’s wrong and how that might signal phishing, misconfiguration, or a suspicious site.

Walkthrough

Topic: Barcode

Objective

Students will be able to use a barcode reader to identify hidden information.

Prompt

We intercepted a barcode we think might be hiding a flag. See if you can find it.

Questions & Answers

What format does the barcode use?

Possible Answers: code 39, code39, Code_39, USD-3, Code 3 of 9, Code 3/9, Alpha 39

What is the flag hidden in the barcode?

Answer: SKY-UZLU-5635

Extension Activities

6-8	Decode the Hidden Message (QR Detective)	Learn what QR codes are and how they encode information.	Students scan teacher-provided QR codes using school devices .Each QR code reveals a clue, message, or safe web link (e.g., a NASA fact, a riddle).Students work in teams to piece together a message or win a classroom scavenger hunt. Discussion: Why do we use QR codes? What kind of information can they hide?
9-12	Reverse Lookup of QR/Barcode Data	Investigate a product or web page linked via barcode or QR.	Scan or decode a real or simulated code. Conduct OSINT to find out: Who owns the domain or product? Where the item was manufactured or registered?Is the website or organization legitimate? Use WHOIS, Wayback Machine, and barcode prefix databases for investigation.

Walkthrough

Module: Cryptography

Topic: Number Bases

Objectives

Students will use tools to recognize and convert various number bases.

Prompt

Our analysts have obtained password dumps storing hacker passwords. After obtaining a few plaintext passwords, it appears that they are all encoded using different number bases.

Questions & Answers

User	Cipher Text	Answer
Nan	0x73636f7270696f6e	Answer: scorpion
Elliot	c2NyaWJibGU=	Answer: scribble
Steve	01110011 01100101 01100011 01110101 01110010 01100101 01101100 01111001	Answer: securely
Daniel	01100010 01000111 00111001 01110011 01100010 01000111 01101100 01110111 01100010 00110011 01000001 00111101	Answer: lollipop

Extension Activities

6-8	Color Code Encryption (Hex and RGB)	Use hexadecimal to encode color values and relate them to cryptographic codes.	Teach students how hex values map to RGB (e.g., #FF0000 = red).Create a color-coded message where each letter maps to a hex color.Students decode messages using hex charts.
9-12	Cryptographic Base Challenge	Understand base conversions and their role in encoding systems like Base64 and hexadecimal hashes.	Provide students with encrypted-looking strings (e.g., hex-encoded, binary). Challenge them to decode messages by identifying and converting base formats. Include layers (binary → decimal → ASCII → message).

Walkthrough

Topic: Shift

Objectives

Students will decode a Ceasar shift cipher.

Prompt

Our analysts have obtained password dumps storing hacker passwords. It seems to be using a pretty simple encryption scheme, see if you can crack them.

Questions & Answers

User	Password Ciphertext	Answer	Solution
Chris	iveghny ynxr	virtual lake	CyberChef.

Extension Activities

6-8	Code Wheel Construction & Cipher Fun	Learn letter shifting using a Caesar cipher wheel.	Students build a Caesar cipher wheel from a printable template (inner and outer alphabet circles).Encode a message by rotating the wheel to a shift value (e.g., shift of 3).Partner up: one student encodes, the other decodes.
9-12	Caesar Cipher + Frequency Analysis	Understand and exploit the vulnerabilities of shift ciphers.	Provide a Caesar-encrypted message without a known key. Students: Try all 25 possible shifts (“brute-force” method).Perform frequency analysis (e.g., looking for common letters like E or T).Discuss how frequency analysis led to the downfall of simple substitution ciphers.

Walkthrough

Topic: @bash

Objective

Students will decode an atbash shift cipher.

Prompt

Our analysts have obtained password dumps storing hacker passwords. See if you can crack them.

Questions & Answers

User	Password Ciphertext	Answer	Solution
Christian	hzuvob lyerlfh xzev	safely obvious cave	CyberChef

Extension Activities

6-8	Binary to Text Bash Simulation	Explore how computers use binary to represent letters.	Give students ASCII codes in binary. Simulate Bash decoding using a chart or worksheet. Discuss how computers turn data into readable info via shell tools.
9-12	Build a Bash Password Vault	Use Bash to securely store and retrieve hashed passwords.	Script idea: Accept a username and password. Hash the password. Store it in a file. Later, compare a login attempt to the stored hash.

Walkthrough

Topic: Beep

Objective

Students will recognize and decode morse code.

Prompt

Our analysts have intercepted an encoded message. See if you can decode it.

Questions & Answers

User	Password Ciphertext	Answer	Solution
Helen	- .... . / ... . -.-. .-. . - / --- ..-. / --. . - - .. -. --. / .- .... . .- -.. / .. ... / --. . - - .. -. --. / ... - .- .-. - . -.. / ... -.- -.-- / -.. -.- ...- -... / ----. ---.. .---- -.…	THESECRETOFGETTINGAHEADISGETTINGSTARTEDSKYDKVB9816	CyberChef

Extension Activities

6-8	Beep Morse Code Challenge	Encode and decode messages using sound.	Teach students basic Morse code (e.g., A = .-).Use a simple tone generator app, physical buzzer, or your own voice (short/long beeps).In teams, students send coded beeps across the classroom; others decode the message.
9-12	Sonic Modem & Tones	Learn how modems used sound for data transfer.	Play samples of old dial-up modem sounds. Discuss how tones carried data across phone lines. Try encoding binary into a sequence of tones using tools like Audacity. Optional: build a tone-to-binary decoder in Python or spreadsheet format.

Walkthrough

Topic: Fencing

Objective

Students will recognize and decode a rail fence cipher.

Prompt

Our analysts have obtained encrypted messages. We saw hand-written notes that indicated the keys as being "3" and "5". See if you can crack them.

Questions & Answers

User	Password Ciphertext	Answer	Solution
Eve	`Cair eruSA-0org sgaeudrpesr K-II98ue cn seYQ3`	Courage is grace under pressure SKY-AIQI-9380	CyberChef
Nan	`F daS-eefn n KZ3eheadty.YI8lta oiwy-Q0 r aI2`	Feel the fear and do it anyway. SKY-IQIZ-3802.	CyberChef

Walkthrough

Topic: French

Objective

Students will decrypt a Vigenère cipher.

Prompt

Our analysts have obtained an encrypted message. We know that the key, qizkwcgqbs was used. See if you can crack them.

Questions & Answers

User	Password Ciphertext	Answer	Solution
Matt	Y ln xkv lubj swlzqvkht, A vmzb pjk bbua we ddgs ILQ-GQYU-8026	I do not fear computers, I fear the lack of them SKY-QIZK-8026	CyberChef

Extension Activities

6-8	Vigenère Cipher Challenge	Encrypt/decrypt using a repeating keyword	Using a Vigenère square, students pick a keyword and encode a message so each letter shifts differently. They compare it to Caesar and discuss why a repeating key resists simple frequency analysis — a first taste of "polyalphabetic" thinking.
9-12	RSA in Real Life (Digital Certificates Demo)	Understand how RSA protects secure websites.	Use a browser to explore HTTPS certificates (lock icon → certificate).Identify the public key and certificate authority. Students answer questions: Who signed it? What does the public key do?

Walkthrough

Topic: RSA

Objective

Use an understanding of key encryption to break a weak implementation of RSA.

Prompt

Our analysts have obtained several artifacts from a message that was encrypted with RSA. We need you to decrypt the message and figure out what the hackers are up to.

n = 1079
e = 43
c = 996 894 379 631 894 82 379 852 631 677 677 194 893

Questions & Answers

What is the value of p (the smaller prime)?

Answer: 13

What is the value of q (the larger prime)

Answer: 83

What is the plaintext of the encrypted message?

Answer: SKY-KRYG-5530

Extension Activities

6-8	RSA Role Play Game: Lock & Key Simulation	Understand public and private key mechanics.	Give each student a "public key" (a lock) and keep their "private key" (the key) hidden. Classmates can write secret messages and "lock" them (put in an envelope marked with your public key).Only the student with the matching private key can open the envelope and read it. Discussion: How does this simulate online encryption?
9-12	RSA in Real Life (Digital Certificates Demo)	Understand how RSA protects secure websites.	Use a browser to explore HTTPS certificates (lock icon → certificate).Identify the public key and certificate authority. Students answer questions: Who signed it? What does the public key do?

Walkthrough

Module: Linux

Topic: DIR

Objective

Students will use commands via the Linux Command Line (CLI) to analyze files and directories.

Prompt

One of our analysts had their laptop damaged. However, we were able to recover and mount the hard drive. Access the terminal and recover various flags from the disk.

Questions & Answers

What are the contents of flag1.txt, found in root's home directory?

How to solve: Run cat flag1.txt from root’s home directory

Answer: SKY-FNKC-3207

What are the contents of flag2.txt, found in the root directory?

How to solve: Use cd / to navigate to the root directory and then run cat flag2.txt.

Answer: SKY-NPEJ-2501

What are the contents of flag3.txt, found in an archive in /var/log?

How to solve: Navigate to /var/log and then run tar -zxvf flag.tar.gz to extract the files from the archive.

Answer: SKY-FVHR-3562

What are the contents of flag4.txt, found in the flag user's home directory?

How to solve: Navigate to the /home/flag directory and then run cat flag4.txt.

Answer: SKY-SXIJ-6142

What flag is printed when you run the flag5 program?

How to solve: Run the flag5 program with the command flag5

Answer: SKY-UDSV-9689

What is the full path to the flag5 program?

How to solve: Run which flag5

Answers:

/usr/bin/flag5
/usr/bin/

Incorrect: ./usr/bin/flag5

Extension Activities

6-8	Linux Adventure Story	Use commands like dir to progress through a narrative.	Students role-play as secret agents or explorers.Each directory contains parts of a story.Students unlock new parts by listing contents (dir) and making choices (cd cave, cd castle).
9-12	Linux Forensics Mini-Challenge	Find files based on clues using dir, ls, find, and grep.	Create a mystery scenario (e.g., “Find who deleted the secret file”).Students navigate directories, list contents (dir), and read logs (cat logfile.txt).Combine clues to solve the case.

Walkthrough

Topic: File Edit

Objective

Students will use nano and Vim via the command line to create and edit files.

Prompt

Learn how to use command line file editors.

NOTE: The terminal session is logged. Please do not perform any denial of service attacks on the Linux server provided, malicious attempts to attack the Cyber Skyline platform will result in disqualification.

Questions & Answers

What key should you press in addition to the CTRL key to trigger the combination to exit nano?

Answer: x

What vim mode allows you to write new characters in the file?

How to solve: Search online for “vim mode to write new characters”.

Answer: insert

What keyboard combination will save and quit the file with vim?

How to solve: Search online for “how to save and quit with vim” and read the descriptions for the different keyboard combinations.

Answers:

What keyboard combination will delete an entire line in vim?

How to solve: Search online for “vim delete line” and then read the descriptions for possible keyboard combinations. See the Trove for more detailed guidance.

Answer: dd

What command would you use to rename a file?

How to solve: Search online for “linux how to rename a file” and read about the most common commands. See the Trove for more detailed guidance.

Answer: mv

Extension Activities

6-8	Echo & Redirect Challenge	Use echo to write text to a file.	Run commands like echo "I love coding!" > myfile.txt.Append text using echo "And Linux!" >> myfile.txt.Display contents with cat myfile.txt.Discussion: What’s the difference between > and >>?
9-12	File Permissions and Editing	Explore how permissions affect file editing.	Create files with different permission settings (chmod).Try to edit them and observe what happens.Discuss why permissions are important for security.

Walkthrough

Topic: Basic Commands

Objective

Use open source tools and Linux command line knowledge to string Linux commands together.

Prompt

Learn the common basic commands used on the Linux command line.

Questions & Answers

What character can you use to redirect the output of one program as the input to another program?

How to solve: Search online for this question as-is. Make sure to find an answer that is specific to redirecting from output from one program to another program (and not to a file). See the Trove for additional guidance.

Answer: |

What character can you use the redirect the output of a program to a file?

How to solve: Search online for this question as-is. Make sure to find an answer that is specific to redirecting from output from one program to a file (and not to another program). See the Trove for additional guidance.

Answer: >

How many people have a first name of Jordan in names.csv?

How to solve: Use cut to grab only the column of first names, then use grep to search for “Jordan” and then use wc -l to get a line count.

cut -d "," -f 1 < names.csv | grep Jordan | wc -l

Answer: 2

Extension Activities

6-8	Linux Command Bingo	Familiarize with common Linux commands.	Create Bingo cards with commands like ls, pwd, cd, mkdir, rm.Call out definitions or tasks (“Show me files in the folder”), students mark corresponding commands.First to bingo explains one command in detail.
9-12	Linux Trivia & Command Line Quiz	Reinforce command knowledge.	Prepare a quiz with multiple choice and practical terminal commands.Use interactive platforms or classroom polling.Include “Identify the command” from output examples.

Walkthrough

Topic: Strings

Objective

Use the strings command to find hidden information in a file.

Prompt

The hackers have hidden a message in this image. Find out what it is.

Questions & Answers

What is the hidden flag in the image?

How to solve: Run the strings command on the image and search for text that contains “SKY”.

strings STEG1.jpg | grep SKY

Answer: SKY-RCLO-4839

Extension Activities

6-8	Guess the File Type	Use strings output to guess the type of file.	Give several files without extensions. Students use strings to extract text clues. Guess file types based on the strings (e.g., image metadata, code snippets, document text).
9-12	Build Your Own Binary File	Create a file with hidden text and practice extraction.	Use a hex editor or programming language (e.g., Python) to embed text inside a binary file. Use strings to extract it. Reflect on how data can be hidden and recovered.

Walkthrough

Module: Log Analysis

Topic: SSH

Objective

Students will analyze the contents of an SSH log to identify adversarial behavior.

Prompt

Analyze this SSH log file to answer the following questions.

Questions & Answers

What is the hostname of the ssh server that was compromised?

Answer: myraptor

Oct 11 10:12:00 myraptor sshd[29459]: Server listening on 0.0.0.0	port 22.

What was the first IP address to attack the server?

Answer: 169.139.243.218

Oct 11 10:12:25 myraptor sshd[29465]: Failed password for harvey from 169.139.243.218 port 57273	ssh2

What was the second IP address to attack the server?

Answer: 56.13.188.38

What was the third IP address to attack the server?

Answer: 30.167.206.91

Which user was targeted in the attack?

Answer: harvey

Oct 11 10:12:25 myraptor sshd[29465]: Failed password for harvey from 169.139.243.218 port 57273	ssh

From which IP address was the attacker able to successfully log in?

Answer: 30.167.206.91

Oct 11 10:36:59 myraptor sshd[30003]: Accepted password for harvey from 30.167.206.91 port 55326	ssh2

Extension Activities

6-8	Log Line Match Game	Learn SSH terminology and log meanings.	Match terms like Accepted password, Failed password, port, user, IP to their meanings. Color code log lines by type (green for success, red for failed attempts).
9-12	Create Your Own SSH Log Puzzle	Design and share SSH log puzzles with classmates.	Students write their own fake SSH logs with a narrative: attack, success, mistake, etc. Swap puzzles and analyze each other’s scenarios.

Walkthrough

Topic: Login

Objective

Students will use command line tools to analyze a custom application log format.

Prompt

Analyze a custom application login event log to help us understand user behavior.

Questions & Answers

How many total login attempts were made in this log?

How to solve: Get the line count of the log. (Reminder: at the end of the command, that is a lower case ‘L’ not a number 1)

cat login.log | wc -l

Answer: 6063

How many unique usernames appear in this log?

How to solve: Extract the third field (with the usernames) of the log, sort the usernames, get the unique usernames, and then get a line count of the number of unique usernames.

cat login.log | cut -f 3 | sort | uniq | wc -l

Answer: 1879

What is the username with the most login attempts?

How to solve: Extract the third field (with the usernames) of the log, sort the usernames, get a frequency count of each unique username, and then sort the unique usernames by frequency.

cat login.log | cut -f 3 | sort | uniq -c |sort -n

Answer: ntory

How many attempts were made for the username with the most login attempts?

cat login.log | cut -f 3 | sort | uniq -c |sort -n

Answer: 124

What is the date with the most login attempts?

How to solve: Extract the first field (with the date+time) of the log, extract just the date, sort the dates, get a frequency count of each unique date, and then sort the unique dates by frequency.

Answer: 2011-03-23

What is the username that had logins from the most unique IP addresses?

How to solve: Extract the second field (with the IP address) and third field (with the username) of the log, sort the IP/username pairs, get the unique IP/username pairs, then extract just the usernames from each pair, sort the usernames, get a frequency count of how many unique pairs each username has, and then sort by frequency.

Answer: wlfla0190

Extension Activities

6-8	Login Color Code	Visually interpret log entries.	Print or display several log lines.Students highlight: Green: Successful logins Red: Failed logins Blue: IP addresses Discuss: What can logs tell us about system usage?
9-12	User Behavior Profile	Analyze and profile user activity.	Provide anonymized logs for 2–3 users. Students summarize: Login times Access locations (IP)Behavior patterns Discuss: What’s normal vs suspicious?

Walkthrough

Topic: VSFTPD

Objective

Students will analyze a VSFTPD log file.

Prompt

Analyze a VSFTPD log file that we obtained.

Questions & Answers

What IP address did "ftpuser" first log in from?

How to solve: Search for any entries that include “ftpuser”. One of these lines should include an IP address. cat vsftpd.log | grep ftpuser

Answer: 10.0.0.123

What is the first directory that ftpuser created?

cat vsftpd.log | grep ftpuser | grep -i mkdir | head -n 1

Answer: TreeSizeFree

What is the last directory that ftpuser created?

cat vsftpd.log | grep ftpuser | grep -i mkdir | tail -n 1

Answer: 110D300S

What file extension was the most used by ftpuser?

How to solve: Search for successful file upload entries from ftpuser, extract the file extension for those uploads, and then get the frequency count for each unique file extension

cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD' | awk -F ',' '{print $2 }' | awk -F "." '{print $2}' | sort | uniq -c | sort

Possible Answers: jpeg, jpg, Joint Photographic Experts Group

What is the username of the other user in this log?

cat vsftpd.log | awk '{print $8}' | sort | uniq

Answer: jimmy

What IP address did this other user log in from?

cat vsftpd.log | grep jimmy

Answer: 10.0.0.214

How many total bytes did this other user upload?

How to solve: Search for successful file upload entries from jimmy, extract the number of bytes transferred, then sum the bytes cat vsftpd.log | grep jimmy | grep 'OK UPLOAD' | awk -F ',' '{print $3 }' | awk '{s+=$1} END {print s}’

Answer: 105750628 bytes

How many total bytes did ftpuser upload?

cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD' | awk -F ',' '{print $3 }' | awk '{s+=$1} END {print s}’

Answer: 13980839165 bytes

How many total bytes did ftpuser download?

cat vsftpd.log | grep ftpuser | grep 'OK DOWNLOAD' | awk -F ',' '{print $3 }' | awk '{s+=$1} END {print s}’

Answer: 6008032 bytes

Identify the IP address of the suspicious login (the login with no subsequent activity).

How to solve: Search for all of the successful login attempts, extract the IP address used to log in, then sort and unique the IP addresses to identify IP addresses for manual inspection

cat vsftpd.log | grep 'OK LOGIN' | awk -F '"' '{print $2 }' | sort | uniq

Answer: 10.3.0.6

Extension Activities

6-8	FTP Role-Play Activity	Act out FTP log scenarios and decode them.	Assign roles (Client, Server, Logger).Simulate login attempts and file transfers.Logger writes log entries, others guess what actions they represent.
9-12	Create Your Own FTP Log Puzzle	Design a VSFTPD log mystery for peers.	Students generate fictitious VSFTPD logs with:Students generate fictitious VSFTPD logs with:One suspicious loginOne normal userA fake attack attemptPeers analyze the log and identify the risky event.

Walkthrough

Topic: Nginx

Objective

Students will analyze an nginx access log.

Prompt

Analyze an nginx access log and answer questions about what happened.

Questions & Answers

How many different IP addresses reached the server?

Answer: 47

How many requests yielded a 200 code?

How to solve: Extract the third field after double quotes as the delimiter (which includes the HTTP codes), sort the codes, get the unique values with a count of the occurrences of each. Optional: sort in descending numeric order.

Answer: 19

How many requests yielded a 400 code?

Answer: 38

What IP address rang at the doorbell?

cat access.log | grep "bell"

Answer: 186.64.69.141

What version of the Googlebot visited the website?

cat access.log | grep "Googlebot"

Answer: 2.1

Which IP address attempted to exploit the shellshock vulnerability?

How to solve: Search online for details about the Shellshock vulnerability. You should be able to find that the presence of this sequence of characters () { :; }; is an indication of an attempted exploitation of this vulnerability. With this knowledge, search the log for any lines with that sequence of characters.

cat access.log | grep '() { :; };'

Answer: 61.161.130.241

What was the most popular version of Firefox used for browsing the website?

How to solve: Search the log for all lines that contain “Firefox” and the following characters which make up the version number, sort those values, and then get a unique count.

cat access.log | grep -o "Firefox/.*" | sort | uniq -c

Answer: Firefox/31.0

What is the most common HTTP method used?

How to solve: Extract the 6th field (with the HTTP method), sort, get the unique values with a count of the occurrences of each value, and then sort in descending numeric order.

cat access.log | awk -F " " '{print $6}' | sort | uniq -c | sort -rn

Answer: GET

Incorrect: POST, PUT, HEAD, DELETE, CONNECT

What is the second most common HTTP method used?

cat access.log | awk -F " " '{print $6}' | sort | uniq -c | sort -rn

Answer: CONNECT

Incorrect: GET, POST, PUT, HEAD, DELETE

How many requests were for \x04\x01\x00P\xC6\xCE\x0Eu0\x00?

Note that that command requires two backslashes for each original backslash to perform a proper escape sequence for the backslash.

cat access.log | grep '\\x04\\x01\\x00P\\xC6\\xCE\\x0Eu0\\x00' | wc -l

Answer: 6

Extension Activities

6-8	Website Detective	Match access log lines to website actions.	Give students fictional scenarios (e.g., visiting a page, clicking a link).Match them to the correct NGINX access log line. Match errors to mis-clicks (e.g., 404 for broken links).
9-12	Traffic Pattern Analysis	Analyze a set of access logs for usage trends.	Provide a few dozen real or simulated NGINX access log lines. Have students: Count total visits Identify top-requested URLs Chart visit frequency over time Use spreadsheets or visual tools for analysis.

Walkthrough

Topic: History

Objective

Students will use SQL commands to analyze a SQlite database.

Prompt

Analyze a Firefox SQlite history database and answer questions about what happened. It you are not familiar with SQL you may want to learn more about SQL here: https://www.tutorialrepublic.com/sql-tutorial/

Questions & Answers

What did the user search for on craigslist?

Answer: bitcoin

What was the current price (USD) of bitcoin when the user was browsing?

Answer: $239.50

What Bitcoin exchange did the user log in to?

Answer: Coinbase

What is the email that was used to log into the exchange?

Answer: b1gbird@gmail.com

What was the ID of the Bitcoin transaction that the user looked at?

Answer: 5274cfba585a4b5681527a37f95c76340428916bb7480cef6c545f0a28dcd2d7 blockchain.info

What was the total BTC value of all the inputs of the Bitcoin transaction?

Answer: 0.22616302

Which Bitcoin address received the majority of the Bitcoin in the transaction?

Answer: 18z6bTFjxkXCmhfp8YBetR2wgmoVjXGJZz

Extension Activities

6-8	Log Story Sequencing Game	Reconstruct a digital activity timeline.	Provide: Cut-out log line cards with mixed-up order. User logs in at 8:00User opens a document. User edits document. User deletes a file User logs out Activity: Students rearrange the cards into the correct order. They write a one-paragraph summary of what happened based on the log.
9-12	Command Frequency Analysis	Determine behavior based on command frequency.	Provide a long history list with command repetition. Students: Tally top 5 used commands. Infer the user’s job (developer, admin, attacker?). Discuss what's "normal" vs "abnormal" usage.

Walkthrough

Topic: Squid

Objective

Students will analyze a Squid proxy log.

Prompt

Analyze this Squid proxy log to answer the following questions.

Questions & Answers

In what year was this log saved?

How to solve: Take any of the Epoch timestamps and convert them into a human-readable date. An online tool, such as Epoch Converter, can be used to do this.

Answer: 2010

How many milliseconds did the fastest request take?

How to solve: Extract the second field (the response time) and then sort the results numerically

cat squid_access.log | awk '{print $2}' | sort -n

Answer: 5

How many milliseconds did the longest request take?

How to solve: Same as the question above.

cat squid_access.log | awk '{print $2}' | sort -n

Answer: 41762

How many different IP addresses did the proxy service in this log?

How to solve: Extract the third field (the IP address of the proxy client), sort, get the unique values, and then get the line count.

cat squid_access.log | awk '{print $3}' | sort | uniq | wc -l

Answer: 4

How many GET requests were made?

How to solve: Extract the 6th field (the HTTP Request type), sort, and then get the unique values with a count of their occurrences. cat squid_access.log | awk '{print $6}' | sort | uniq –c

Answer: 35

How many POST requests were made?

Answer: 78

What company created the antivirus used on the host at 192.168.0.224?

How to solve: The name of the company is found within the URLs of the requests made 192.168.0.224 . cat squid_access.log | grep "192.168.0.224"

Answer: Symantec

What URL is used to download an antivirus update?

How to solve: Use the command from the question above and then find the URL that includes “virus” and “definitions”

Answer: http://liveupdate.symantecliveupdate.com/streaming/norton$202009$20streaming$20virus$20definitions_1.0_symalllanguages_livetri.zip

Extension Activities

6-8	URL Scavenger Hunt	Explore responsible internet use.	Provide fake Squid logs with safe and unsafe URLs .Students highlight URLs that are: Educational Entertainment Suspicious or inappropriate Discussion: Why might schools block certain content?
9-12	Attack Simulation: Malicious Site Detection	Detect unsafe browsing behavior.	Some logs include suspicious URLs (e.g., phishing sites).Students must: Identify risky URLs Explain why they are suspicious Suggest how the network should respond (block? notify? educate?)

Walkthrough

Topic: Log Payments

Objective

Students will analyze a SOAP log using the command line and a spreadsheet editor.

Prompt

A payment transaction log was compromised in a data breach. Help us determine what information was stolen.

Questions & Answers

How many transactions are contained in the log?

How to solve: Count the number of lines that start with PPAPIService: Request:

Answer: 192

What is the transaction ID of the largest purchase made in the log?

Answer: 3a4da8c8-6934-4655-9ec5-335ab4540a2b

Which state made the greatest number of purchases?

Answer: massachusetts Incorrect: maryland

Extension Activities

6-8	Budget Match	Practice real-world math and budgeting.	Each student is given a budget (e.g., $20/week).They "shop" using log entries from a store list.Keep track of their spending and create their own log lines.
9-12	Policy Designer	Understand how rules protect users and systems.	After analyzing fictional logs, students propose:Spending limitsDaily caps on categories (e.g., junk food)Rules to prevent refunds/gift card abusePresent their “fraud prevention policy” to the class

Walkthrough

Module: Network Traffic Analysis

Topic: DNS

Objectives

Students will analyze a network packet capture to communicate an understanding of DNS.

Prompt

DNS is what enables us to access much of the internet without remembering IP addresses, analyze the network packet capture to understand more about DNS.

You can read this guide to learn more about computer networking.

Questions & Answers

What is the type of the DNS query requested?

Answer: AXFR

What domain was requested?

Answer: etas.com

How many items were in the response?

Answer: 4

What is the TTL for all of the DNS records?

Answer: 3600

What is the IP address for the "welcome" subdomain?

Answer: 1.1.1.1

Extension Activities

6-8	Guess That Domain!	Identify which domain names are real vs. suspicious.	Show 10 domains (e.g., netflix.com vs. netf1ix-login.xyz).Students vote whether it's safe or suspicious. Discuss how DNS could be used in phishing. Extension: Create their own fake (but safe!) domains and test each other.
9-12	Model a DNS Spoofing Attack	Understand how DNS can be exploited.	Students map out: How the spoofing occurs What the attacker gains How it can be prevented (e.g., DNSSEC, user awareness)Output: Students can write or present their scenario.

Walkthrough

Topic: FTP Traffic

Objective

Students will analyze a network packet capture to communicate an understanding of FTP traffic.

Prompt

We found some interesting FTP traffic, analyze the network packet capture to identify what was transferred.

You can read this guide to learn more about computer networking.

Questions & Answers

What was the first username:password combination attempt made to log in to the server? ex. 'user:password'

Possible answers: user1/cyberskyline, user1:cyberskyline

What software is the FTP server running? (Name and version)?

Answer: FileZillaServer0.9.53

What is the first username:password combination that allows for successful authentication?

Possible answers: user1/metropolis, user1:metropolis

What is the first command the user executes on the ftp server?

Answer: dir, list

What file is deleted from the ftp server?

Answer: bank.cap

What file is uploaded to the ftp server?

Answer: compcodes.zip

What is the filesize (in bytes) of the uploaded file?

Possible Answer:

3303628E25D43BE4E11CC8878C5C5878
28183
28183 bytes

What file does the anonymous user download?

Answer: compcodes.zip

Extension Activities

6-8	"Guess the Protocol" Sorting Game	Compare how FTP works with other network services.	Provide printed “network traffic cards” with clues (e.g., "transfers files", "sends web pages", "sends email").Students sort them into categories (FTP, HTTP, SMTP, etc.). Highlight that FTP sends data in plain text, unlike HTTPS.
9-12	FTP vs. SFTP Comparison Lab	Understand the difference between FTP and SFTP.	Show examples (screenshots or logs) of FTP and SFTP sessions. Students identify: What data is visible in FTP (e.g., usernames, files)What’s encrypted in SFTP Extension: Propose a school policy recommendation: should your school block unsecured FTP?

Walkthrough

Topic: HTTP

Objective

Students will analyze a network packet capture to communicate an understanding of HTTP.

Prompt

HTTP is how we're sending you this message, analyze the provided capture to answer the following questions about a HTTP download.

You can read this guide to learn more about computer networking.

Questions & Answers

What Linux tool was used to execute a file download?

How to solve: Apply thehttp.request filter and looking at the HTTP dissection. The “User-Agent” field in the HTTP portion of the packet is used to identify the software making the HTTP request.

Answer: wget

What is the name of the web server software that handled the request?

How to solve: Apply the http.response filter and looking at the HTTP packet dissection. The “Server” field in the HTTP portion of the packet is used to identify the software responding to the HTTP request.

Answer: nginx

What IP address initiated request?

How to solve: Apply the http.response filter and looking at the HTTP packet dissection. The Destination is the IP address that initiated the request.

Answer: 192.168.1.140

What is the IP address of the server?

How to solve: Apply the http.response filter and looking at the HTTP packet dissection. The Source is the IP address of the server.

Answer: 174.143.213.184

What is the MD5 sum of the file downloaded?

How to solve: Copy data into Cyberchef and add the following operations to the Recipe: Ensure data is in Hex, Determine file type, Calculate MD5 sum.

Answer: 966007c476e0c200fba8b28b250a6379

Extension Activities

6-8	"HTTP vs. HTTPS: Spot the Difference" Scavenger Hunt	Understand the difference between HTTP and HTTPS.	Have students visit a list of sample websites (teacher-approved) and record:Which ones use HTTP Which ones use HTTPS (look for padlock in the URL bar) Create a chart or tally board. Discussion: Ask: What does the padlock mean? Why is HTTPS better for logging into websites?
9-12	HTTP vs. HTTPS Debate	Analyze the pros and cons of different web protocols.	Students research and prepare arguments for a debate:Should all websites be required to use HTTPS?Is HTTP ever acceptable?Roles: Debate teams + moderator + audience voters.

Walkthrough

Topic: Telnet

Objective

Students will analyze a network packet capture to communicate an understanding of Telnet.

Prompt

Telnet is an older protocol that allowed an interactive text-oriented communication with remote systems, use the provided capture to answer the following questions about telnet.

Questions & Answers

What is the username that was used to log in?

Answer: test

What is the password that was used to log in?

Answer: capture

What command was executed once the user was authenticated?

Answer: uname

In what year was this capture created?

Answer: 2011

What is the hostname of the machine that was logged in to?

Answer: cm4116

What CPU architecture does the remote machine use?

Answer: armv4tl

Extension Activities

6-8	Telnet Time Capsule	Understand Telnet as part of Internet history.	Students research and create a short presentation or timeline: When and why Telnet was invented Why it’s not used much anymore What replaced it Extension: Build a “then vs. now” chart comparing Telnet and SSH.
9-12	Telnet Intercept Role-Play	Simulate a man-in-the-middle attack.	One student sends credentials via “Telnet” (on paper).Another student intercepts and reads it.Contrast with a scenario where the message is encrypted (SSH version: pass sealed envelopes).Discuss how attackers capture credentials using packet sniffers.

Walkthrough

Topic: Packet Dissection

Objectives

Students will analyze a portion of a packet to identify how IP packet headers are structured.

Prompt

Dissect an IP packet header to understand how the protocol works.

You can read this guide to learn more about computer networking.

Data

Offsets	0	1	2	3
0	01000101	00000000	00000000	00111100
4	10101001	10011010	01000000	00000000
8	01000000	00000110	01001111	10010011
12	11000000	10101000	10000000	10000000
16	10011111	11001011	01100000	10011010

Questions & Answers

What is the header checksum in hexadecimal representation?

Answer: 4F93

What is the TTL of the packet?

Answer: 64

What is the source IP address?

Answer: 192.168.128.128

What is the destination IP address?

Answer: 159.203.96.154

Extension Activities

6-8	“What’s in a Packet?” Envelope Simulation	Understand that data sent over the internet is broken into packets.	Give students envelopes labeled as "packets. "Inside, place mock data: sender address, receiver address, content (e.g., “Hello World”), packet number. Students “send” the envelopes across the classroom. Others act as routers, forwarding based on destination. Some envelopes are “intercepted” by the “network analyst” who reads them aloud (to simulate unencrypted traffic).
9-12	Dissect a Protocol Worksheet	Identify how different protocols appear in packet structure.	Provide a simplified table with different protocol packets (e.g., DNS, HTTP, FTP).Students match: Protocol Typical ports Data shown in payload Risk level (e.g., “clear text,” “encrypted”) Rank the protocols by security

Walkthrough

Module: Software Security

Topic: Bytes

Objective

Students will analyze a Python script to identify the value that will return ‘True’ from the program.

Prompt

Determine the secret password that will validate successfully against the verify function. We've been having trouble getting it to run, but we saw it running properly on a different system. The code seems to be a bit old, maybe you can find the right environment/configuration to get it to run.

Questions & Answers

What language is this program written in?

Answer: Python

What is the password that will successfully pass the verify function?

Answer: 534b592d484558482d35363830

Extension Activities

6-8	Byte Builder Game	Understand how bytes store data.	Students use cards or tiles to build bytes (e.g., 01101100) and match them to letters using an ASCII table. Extension: Convert a secret message from text to bytes and exchange with peers to decode.
9-12	Secure or Suspect? Byte Tampering Simulation	Understand how changing a few bytes can change software behavior.	Provide a small Python or C program with an embedded message or function. Task: Modify the byte pattern to alter behavior (harmless examples), then suggest protections like checksums or hashes. Extension: Discuss real-world tampering and software integrity checks.

Walkthrough

Topic: Python 1

Objective

Students will analyze a Python script to calculate an input that will authenticate with the program.

Prompt

We have created a python script for you to break into as training. See if you can figure out a password that will authenticate with the program. Note: The password cannot contain special characters.

#!/usr/bin/python
import sys

def main():
if len(sys.argv) != 2:
print("Invalid args")
return
password = sys.argv[1]
builder = 0
for c in password:
builder += ord(c)
if builder == 1000 and len(password) == 10 and ord(password[1]) == 83:
print("correct")
else:
print("incorrect")

if **name** == "**main**":
main()

Questions & Answers

What is a secret key that will pass validation?

Possible Answer: mSeeeeeeee (multiple answers exist)

Extension Activities

6-8	Code Detectives: Spot the Unsafe Python	Understand what unsafe coding looks like—even without writing code.	Students receive simplified Python code snippets (e.g., saving a password in plain text, printing private data to screen).Task: Highlight “unsafe” lines and explain why they’re risky.Extension: Rewrite one unsafe line as a "safe" version (e.g., masking a password).
9-12	Secure or Suspect? Analyze Python Code for Risks	Practice identifying real-world security flaws.	Provide code samples involving:SQL injection vulnerabilitiesHardcoded credentialsLack of input validationTask: Students annotate and explain each flaw, then refactor code to improve security.

Walkthrough

Topic: Python 2

Objective

Students will analyze a compiled Python script to calculate an input that will authenticate with the program.

Prompt

We have created a python script for you to break into as training. See if you can figure out a password that will authenticate with the program.

Questions & Answers

What is a secret key that will pass validation?

Possible Answers:

mysupersecretpassword
m_s[persecreZpass]ord
m_supersecretpassword

Incorrect: M_supersecretpassword

Extension Activities

6-8	Cyber Hero Comic: “Fixing the Python Bug”	Introduce the concept of secure coding through storytelling.	Students create a short comic where a character finds a cybersecurity bug in a Python app and saves the day.Topics to Include: Weak passwords, missing updates, phishing via Python app.
9-12	Threat Modeling a Python App	Use critical thinking to anticipate attacks.	Students choose or are assigned a basic Python app (e.g., to-do list, chat system, calculator).Identify: Assets to protect (user data, access levels)Threats (malicious input, unauthorized access)Mitigations (authentication, logging, error handling)

Walkthrough

Topic: Python 3

Objective

Students will analyze a Python script to calculate an input that will authenticate with the program.

Prompt

We have created a python script for you to break into as training. See if you can figure out a password that will authenticate with the program.

Questions & Answers

What is an input to this program that will result in a correct validation?

Possible Answers:

N>>>>>>>>>>
NOTC0FFEE

Incorrect:

NAAAAAAAANZ

Extension Activities

6-8	Safe Login Flowchart	Model secure authentication steps without needing to code.	Students draw a flowchart of a secure login system for a Python app. Include: Username/password check Two-factor authentication Password retry limits
9-12	Ethics in Software Security: Class Debate	Explore legal and ethical issues in Python development.	Debate Prompts: “Should ethical hackers be paid for finding bugs in open-source Python code?” “Is it ethical to reverse-engineer someone else’s Python software for research?” Task: Prepare arguments and consider ethical, technical, and business perspectives.

Walkthrough

Topic: egov

Objective

Students will utilize web cookies to check the permission level of the user.

Prompt

Conduct a security audit on the egov login panel.

Note: This challenge is limited to HTTPS in scope, please do not attack any other ports on this server.

Questions & Answers

What is the flag obtained from logging in?

Answer: ⚠️ The flag is randomly generated so the correct flag for you will be different.

Extension Activities

6-8	What Is eGov? Digital Government Scavenger Hunt	Discover how governments provide digital services.	Provide students with a list of real eGov services to explore (e.g., paying taxes online, renewing licenses, voter registration).For each service, they identify:What information is collected?What kind of data is most sensitive?Discuss: What happens if that data is stolen?
9-12	Threat Modeling: Secure the eGov Portal	Think like a security architect.	Provide a sample eGov system diagram (e.g., for tax filing or online voting).Students identify:Assets (personal data, government records)Threats (SQL injection, data leaks, phishing)Protections (HTTPS, code validation, firewalls)Create a “threat model chart.”

Walkthrough

Topic: Never Winter Bank

Objective

Analyze Java script code on a website to find an exploit to utilize.

Prompt

You have been hired to run a pentest on this bank's old out of date system. Can you find the vulnerability in the code and drain this user's account?

Questions & Answers

What is the path of the leaked file?

Answer: /dev/rel.js

What is the flag?

Answer: ⚠️ The flag is randomized, follow the guide to capture the flag

Extension Activities

6-8	Password Protection Relay	Understand how secure passwords protect financial systems.	Teams create a strong password using rules (e.g., 12+ characters, mix of symbols, no common words).Relay Game: Each team passes a “password baton” and explains: Why their password is strong What could make it better Extension: Add a quick "Phishing Alert" round where students respond to fake email examples.
9-12	Digital Heist Simulation: Red Team vs. Blue Team	xperience ethical hacking vs. defense thinking.	Divide students into: Red Team: Identifies ways to exploit insecure software in the bank Blue Team: Proposes countermeasures (patches, protocols, training)Scenario: The bank has just updated its app—what could go wrong? Follow-up: Reflect on real-life cybersecurity careers (penetration tester, software security analyst).

Walkthrough

Topic: Metro Lottery

Objective

Analyze Javascript on a webpage in order to exploit trusted client input.

Prompt

Players of the Metropolis online lottery are able to get a win percentage of more than 80% resulting in more people winning than should be statistically possible. Conduct a security audit to determine the cause.

Note: This challenge is limited to HTTPS in scope, please do not attack any other ports on this server and do not brute force attack this web server.

Questions & Answers

What is the flag obtained after winning the lottery?

Answer: ⚠️ The flag is randomly generated so the correct flag for you will be different.

Extension Activities

6-8	Tamper Alert Game	Learn what tampering means in digital systems.	Create a card game or worksheet where some “lottery entries” are altered.Students identify which entries are valid and which might be fraud.Discuss: Why would someone cheat? How can software detect that?
9-12	Lottery Fraud Case Study	Analyze real-world lottery frauds to identify software flaws.	Example: The 2017 Iowa Hot Lotto insider fraud (Eddie Tipton case).Students research:What system was hacked?How was random number generation compromised?What could have prevented it?Deliverables: Slide presentation or short paper with solutions.

Walkthrough

Topic: Metro Clinic

Objective

Craft SQL statements in order to exploit a vulnerability in an organization’s database.

Prompt

Conduct a security audit on the city's medical directory system.

Note: This challenge is limited to HTTPS in scope, please do not attack any other ports on this server and do not brute force attack this web server.

Questions & Answers

What is the name of the only Orthopedist?

Answer: Tracy Gill

What is Katie Cain’s profession?

Answer: Neurologist

How many medical professionals can be found in this registry?

Answer: 11

What is the name of the person who has a password of "greyblob"?

Answer: Kim Jenkins

What is Mike Torres' password?

Answer: SKY-VJDT-4472

Extension Activities

6-8	Build a Secure Login System (Unplugged Coding)	Model basic authentication logic.	Use flowcharts to plan how the clinic software should check usernames and passwords. Add "Too many failed attempts? Lock account!" logic. Materials: Paper, pens, optional online flowchart tools like Lucidchart or Draw.io.
9-12	Code Investigation: Find the Flaw	Identify security weaknesses in sample code.	Students are given pseudocode or beginner Python code for a login system at Metro Clinic Task: Identify at least three security flaws (e.g., storing plain text passwords, lack of input validation).Suggest how to fix each issue.

Walkthrough