Miscellaneous CTF Challenges · Interactive Exercises

🧩

Challenge Categories

3 questions

CTF challenges cluster into a handful of recognisable categories — web, cryptography, reverse engineering, vulnerability exploitation, and flag retrieval — each demanding a different toolkit.

A "web application challenge" in CTF terms typically requires participants to:

1 mark

Analyse malware behaviour

Find and exploit vulnerabilities to gain access to sensitive data or elevate privileges

Crack a password or decode an encrypted message

Carefully observe an image to find a hidden flag

A "reverse engineering challenge" requires participants to:

1 mark

Exploit a live web vulnerability

The image's colour palette only

Decode a Base64 string

Hidden text, zooming in for clues, and whether the image itself needs to be deciphered

In CTF "flag retrieval" challenges, participants typically:

1 mark

Crack a password hash

Reverse-engineer a compiled binary

Write exploit code for a buffer overflow

Carefully observe an image, file, or piece of text to find a hidden flag

Challenge Categories score

0/3

Social engineering manipulates people, not machines. OSINT (Open-Source Intelligence) gathers information from public sources — and both show up regularly as CTF challenge categories.

Social engineering, as defined in the lecture, is:

1 mark

Writing secure application code

The psychological manipulation of unsuspecting victims into divulging confidential information

A type of firewall configuration

A network scanning technique

Which of these are named as ways social engineering can operate? (select all)

2 marks

Trickery or flattery, playing on fears/desires

Exerting force to make a victim feel compelled to share information

Automatically patching software vulnerabilities

Gaining unrestricted access to a victim's devices to steal information

OSINT stands for:

1 mark

Open-Source Intelligence

Online Security Intelligence Network Toolkit

Operational System Integrity

Offensive Security Internal Testing

Who, according to the slides, can practise OSINT?

1 mark

Only state intelligence agencies

IT security experts, state-sanctioned operatives, malicious hackers, and students/novices alike

Only malicious hackers

Only law enforcement

Which of these is listed as an OSINT tool in the lecture?

1 mark

DNS Dumpster

Metasploit

fcrackzip

Ghidra

Which OSINT resource lets you view historical/archived snapshots of a website (useful for finding "the first version" of a site)?

1 mark

TheHarvester

Recon-ng

Internet Archive (Wayback Machine)

DNS Dumpster

Q10

Why are keystrokes and mouse movements a security concern, per the lecture?

1 mark

A vigilant attacker who monitors them can exfiltrate sensitive data like passwords and screen patterns

They slow down the computer

They are always encrypted, so pose no risk

They cannot be logged by any software

Social Engineering & OSINT score

🔩

Hardware & Real-World Cases

4 questions

Not every CTF challenge is purely digital — some involve physical hardware, and real-world incidents show how far these attacks can reach.

Q11

The Olympic CTF 2014 "shredded paper" challenge is used as an example that some CTF puzzles require:

1 mark

No computer knowledge at all — just patience and a keen eye

Advanced quantum computing

A specialised reverse-engineering toolchain

Knowledge of assembly language

Q12

Hardware-based CTF challenges may involve:

1 mark

Only web browser exploits

Social media analysis only

Purely theoretical questions with no physical component

Participants examining a thumb-drive/hard-disk, or attacking/defending a physical testbed

Q13

The "Industroyer" attack by the Sandworm group targeted:

1 mark

A hospital's patient records

A cryptocurrency exchange

A state-run power station in Ukraine, causing power failure in part of Kyiv

A university's exam database

Q14

MITRE, known for the ATT&CK framework, is also mentioned as leading efforts in which growing CTF area?

1 mark

Hardware-based / embedded CTF (eCTF) challenges

Social engineering CTFs

Purely cryptographic CTFs

Legal compliance CTFs

Hardware & Real-World Cases score

0/4

🧠

Mindset & Tips

6 questions

Misc challenges are often the hardest because they don't fit a predictable pattern — success comes down to a deliberate approach and a willingness to expect (and work around) failure.

Q15

When approaching an unfamiliar CTF challenge, the lecture's first recommended step is to pause and think about:

1 mark

Immediately trying every tool you know

What category the challenge likely falls under, and what clues/techniques are relevant

Giving up if it is not obvious in 30 seconds

Asking someone else to solve it

Q16

A common terminology confusion the lecture warns novices about is:

1 mark

HTTP vs HTTPS

TCP vs UDP

IPv4 vs IPv6

Root vs Admin (and the different meanings of "user")

Q17

"Murphy's Law," as invoked in the lecture, means:

1 mark

All CTF challenges are solvable in under 10 minutes

Only experienced hackers can solve misc challenges

Anything that can go wrong will go wrong — so expect failure and plan to mitigate it

CTF challenges never involve real-world scenarios

Q18

Why are miscellaneous ("misc") CTF challenges often considered among the hardest category?

1 mark

They always require the most expensive tools

They are always the shortest challenges

They require abstract thinking, may need multiple skillsets, and don't fit a predictable pattern

They never have a definitive answer

Q19

Which of these is explicitly named as a technique used in social-engineering-flavoured CTF challenges?

1 mark

SQL injection

Buffer overflow

Dumpster diving

Port scanning

Q20

For image-based misc challenges, the lecture suggests checking for:

1 mark

Only the file's creation date

The image's colour palette only

Whether the image was taken on a smartphone

Hidden text, zooming in for clues, and whether the image itself needs to be deciphered

Mindset & Tips score

0/6

—

Complete all questions to see your final score