A quick reference for the tools and ideas you'll use across the labs.
Each lab drops you into a UNIX shell. You type a command, press Enter, and it runs. The prompt (the $) is where you type. For reference, typical commands are shown below.
To write a script, use the nano editor. A starter file attack.py already exists in your home directory:
To paste into the terminal, use Ctrl+Shift+V (not Ctrl+V). The terminal runs through ttyd in your browser, where Ctrl+C is reserved for stopping a command so paste is bound to Ctrl+Shift+V instead.
Inside a lab you also have these helper commands: mission (re-read the briefing), hint 1 / hint 2 / hint 3 (progressive nudges), and verify (submit your answer to complete the lab).
tcpdump is a packet sniffer. It puts your network interface into a listening mode and prints every packet that passes through including source, destination, ports, and more. On an unencrypted protocol, that means you can read the actual data, including passwords.
Remember: Flags combine. You can pick the interface, choose whether to show payloads as text, filter to the port you care about, and decide whether to watch live or write to a file.
In labs that involve sniffing, you can pipe the output to $CAP (e.g. ... | tee $CAP) and then click VIEW CAPTURE in the top bar to read it in your browser, where copying is easy.
nc ("netcat") is the swiss-army knife of TCP/IP. At its simplest it opens a raw connection to a host and port and lets you type directly at whatever service is listening. Because many classic protocols (Telnet, SMTP, HTTP) are just plain text, you can "speak" them by hand.
Example — connecting to a mail server and it greets you:
Telnet (RFC 854, 1970s) gave remote access to a machine's command line. Its fatal flaw: everything — usernames, passwords, keystrokes — travels as unencrypted plain text. Anyone sniffing the network sees it all. This is why SSH, which encrypts the session, replaced it. When a protocol is plaintext, a packet capture is all it takes to steal credentials.
SMTP (RFC 821, 1982) is how mail servers exchange messages — a plain-text, line based conversation. The server trusts whatever you type in MAIL FROM; there's no proof of identity. Combined with "open relays" that accept mail from anyone, this let attackers send email as literally anybody. The dialogue:
Modern defenses — SPF, DKIM, DMARC — exist precisely because SMTP itself verifies nothing.
TCP is a reliable connection. It starts with a three-way handshake:
Between steps 2 and 3 the server holds the connection half-open in a fixed-size queue. A SYN flood sends a torrent of SYNs and never completes the handshake, filling that queue so no real users can connect. Often the source IP is spoofed so the SYN-ACK goes nowhere. Tools like hping3 craft these raw packets:
Unlike TCP, UDP is connectionless. You send a packet and there's no handshake, no guarantee of delivery. That makes it faster, but also easier to abuse. The Character Generator protocol (chargen, RFC 864, port 19) replies to any UDP packet with a stream of characters. Send one small packet, get a much larger reply back: that ratio is called amplification. Forge the source address and the flood of replies gets aimed at a victim. One byte in, hundreds out from almost nothing.
Encryption scrambles data (plaintext) into unreadable ciphertext using a key; decryption reverses it with the same (or a related) key. In symmetric encryption the same secret key does both — so the whole scheme's strength depends on that key being hard to guess.
A key is just a number. Its size in bits sets how many possible keys exist. If that space is small enough, an attacker can simply try every key until one works — a brute-force attack. DES (Data Encryption Standard) used a 56-bit key, which was crackable by 1998 as hardware got faster. That's the whole vulnerability: too few bits.
Data at this level is often shown in hexadecimal (base-16, digits 0-9 and a-f) because it maps cleanly to raw bytes. You'll fetch a challenge with curl, an HTTP client:
Then a script brute-forces the remaining key space and recovers the plaintext.