Black cats are prowling, pumpkins are glowing and witches are waltzing – it’s Halloween! Here at Immersive Labs, we love to celebrate the holidays. This year is definitely in need of some fun, so to whet your vampire-toothed whistle, we’ve put together a series of spook-tacular murder mystery CTF-style labs that require a range of cyber skills.
Here’s how it starts...
You and a friend have checked into a hotel for an infosec conference. At reception, you are invited to a Halloween-themed party. Later that evening, the event is well attended; everyone is dressed for the occasion, revelling in the fake-blood frivolities of the Halloween party. After dinner, you mingle with the other guests, drinking pumpkin punch and bloody Marys. The evening is all fun and games until a murder takes place… It’s your job to figure out who did it, but of course, the killer hasn’t made it easy for you. You’ll need to demonstrate your digital dexterity and coding competence to work out the murderer’s identity.
The first lab in the series focuses on infrastructure hacking, which is pretty simple when you know what you're looking for. Can you find any open ports after scanning the target IP address? What is that port commonly associated with? A quick look around the desktop should also provide you with a crucial tool. What could help you find out who was staying at the hotel?
Moving on from infrastructure to web app hacking, in part two you’ll need to use your knowledge of SQL injection to retrieve data about who attended the party. What parameter might be vulnerable? Following that, the third CTF is a nested archive challenge, sort of like a Linux-based Russian doll. What will you discover when you get to the center?
No murder mystery would be complete without some forensic DNA analysis. And of course, because this is a cyber challenge, the best way to access files of interest is through the aptly-named program Autopsy, through which you can undertake some cyber forensic analysis. See what we did there?
And finally, the fifth lab will reveal who the murderer is, provided you can craft some nifty server-side template injections. It seems that the killer is scarily into blogging and creepy literature. He’s also a bit of a poet, believe it or not. Can you find the poem he’s hidden?
All of these Halloween murder mystery labs are now available on Community mode, so if you’ve always fancied trying the platform but were unsure about how to access it, now’s your chance. It’s all completely free: no contracts, no cash, no commitments. All you need to get started is yourself, your email address, and the code GIMMEFREELABS.
Ready to solve the mystery?
30 October 2020
Latest Blog posts
Kaseya supply chain attack: Prepare to respond with the Cyber Crisis Simulator
27 July 2021
Disclosure Dilemmas: Vulnerable Stalkerware
19 July 2021
When Less Isn’t More: A Deep Dive into Exploiting the Less.js RCE
15 July 2021
Patch Newsday – 13 July 2021
14 July 2021
Stalkerware 101: Everything you need to know
13 July 2021
An investment into the cyber skilled workforce of the future
11 June 2021