A self-contained capture-the-flag learning activity designed for introductory cybersecurity students with no prior CTF experience. Tells a single continuous story across four progressive challenges, taking learners through a realistic mini-incident from initial probe to attacker taunt.
👉 Open activity/THE_BREACH_CTF.md and begin.
No setup required. You only need a terminal (Linux / macOS / WSL) or a browser with access to a tool like CyberChef.
the-breach-ctf/
├── README.md ← you are here
├── .gitignore
│
├── activity/
│ └── THE_BREACH_CTF.md ← the main challenge file
│
└── evidence/
│
│
└── verification/
└── decoding-verification.md ← proof every flag decodes correctly
| # | Challenge | Skill focus | Difficulty |
|---|---|---|---|
| 1 | First Footprints | Web access log analysis; recognising SQL injection in request strings | ⭐☆☆☆ |
| 2 | Dropped File | Base64 and hexadecimal decoding; encoding ≠ encryption | ⭐⭐☆☆ |
| 3 | The Vulnerable Endpoint | Secure code review (SQLi + path traversal in Flask) | ⭐⭐⭐☆ |
| 4 | The Attacker's Signature | Classical ciphers (ROT13); incident-report writing | ⭐⭐⭐⭐ |
Intro university cybersecurity students, or anyone curious who has used a terminal before. Total time: 45–90 minutes.
- Read the story and pick up your first case file.
- Work through the challenges in order — each one builds context for the next.
- Use hints (collapsed under
<details>tags) only when stuck. - Don't peek at the solutions until you've genuinely tried.
- Answer the reflection questions in writing — that's where the learning consolidates.
This activity was deliberately built to be a story, not a list of puzzles. Real cybersecurity work involves stringing disparate evidence into a coherent narrative, so the CTF mirrors that: the log, the dropped file, the vulnerable code, and the final cipher are all artefacts from the same fictional intrusion, and learners produce an incident report at the end.
Pedagogical choices:
- Hints are layered (1 → 2 → 3) so learners only get as much help as they need.
- Each challenge states its learning objective explicitly.
- Solutions explain why, not just what — including conceptual takeaways like "encoding ≠ encryption".
- Reflection questions push beyond mechanical answers into trade-offs, defence-in-depth, and self-assessment.
Every encoded artefact in this activity has been independently verified to decode to the flag claimed in the solutions walkthrough. See evidence/verification/decoding-verification.md for command-line proof.