Situation: Analyst Alex Mercer has gone dark. Their desk has been sealed and their devices seized as evidence. Intelligence suggests a foreign actor accessed part of the network, and analysts need help finishing the investigation before the shift ends.
You are joining the unit as a trainee analyst for the day. Each exercise below teaches a real skill used by cyber security professionals — you do not need any prior coding or hacking knowledge to complete any of them.
Study everything recovered from Alex's desk and work out their passcode. Not every item matters — and some might matter later. Teaches open-source intelligence (OSINT).
SKILL: OSINTLog into Alex's computer using what you found in Exercise 01 — but you'll need to work out the username yourself.
SKILL: CREDENTIALSVerify a photo's checksum against IT's records, discover it's been altered, then dig into the raw file to find out why. Teaches file integrity checking and basic forensics.
SKILL: FORENSICSInspect a web page's source code to find a hidden, fully-encoded memo. Teaches how to view page source and decode Base64.
SKILL: WEB INSPECTIONAll four exercises are self-contained HTML files — no internet connection, installation, or student accounts are required. They can be run from a USB stick, a school shared drive, or a simple local web server.
Exercise 01: passcode is 0409, from the post-it note (4th of September, entered as DDMM). The gym membership card is a decoy amount, not a code. The staff access card's employee number (48213) isn't needed yet — it's the username for Exercise 02, but the page never says so.
Exercise 02: login is employee ID 48213 / password Bellingen#94 (the password is still given directly in the phone note; the username now has to be inferred from the briefing hint plus the access card from Exercise 01).
Exercise 03: the recorded checksum is for the original, unmodified photo; the downloaded copy has a flag appended after the JPEG's end marker, so its checksum will never match. Flag: FLAG{HIDDEN_IN_PLAIN_SIGHT}. The checksum tool runs entirely in the browser via the Web Crypto API — no internet connection required.
Exercise 04: flag is FLAG{VIEW_SOURCE_MASTER}, found inside a Base64-encoded memo hidden in an HTML comment (the whole memo is encoded, not just the flag, so viewing source alone gives nothing readable). The page also checks answers by comparing SHA-256 hashes rather than storing the flag as plain text, so the answer can't be read directly out of the page's code either.