Bootcamp CTF: A jeopardy-style capture-the-flag built from one real-looking breach.

Bootcamp CTF is a cybersecurity capture-the-flag you play in the browser. A company has been breached and you are the incident-response analyst. The evidence is a jeopardy board of 25 challenges: packet captures, encoded strings, DNS lookups, firewall rules, SOC logs, evidence hashes, a JWT, a leaked user table, code from the exposed app and the risk paperwork the board will ask about. Every flag you recover rebuilds one more step of the attack. Flags are generated for your play, so answers can't be shared.

25 challenges · one 72-hour window per play · solo or a team of up to 3 · $10 (₹981.76 incl. GST) for 6 plays · Start

How a play goes

1. Read the briefing: The company has been breached and you were called in after hours. The briefing sets the scene for every challenge.
2. Pick a challenge: The whole board is open from the start. Points run from 100 to 500, 6,500 in all. Solve them in any order.
3. Open the evidence: Each challenge hands you an artefact: a .pcap, a log, an email header, a config or a piece of code. Read it in the browser or download it into your own tools, such as Wireshark.
4. Submit the flag: Flags look like BART{...}. You get 3 tries per flag, and every flag is generated for your play.
5. Read the debrief: See which challenges you solved, your ending and the Bootcamp class each challenge came from, so you know what to revisit.

The board

• Network (3): Read packet captures: logins sent in clear, DNS records on the wire, Basic auth headers. Challenges: Plaintext Pete (100), DNS Gossip (100), Basic Instinct (150).
• Crypto (2): Peel back encodings that pretend to be encryption, and break a repeating-key XOR. Challenges: Base Camp (100), Key Party (250).
• Vulns (1): Score a published vulnerability from its CVSS v3.1 vector. Challenges: Score Keeper (200).
• Concepts (1): Sort incidents by confidentiality, integrity and availability. Challenges: CIA Triage (200).
• Web (3): Find secrets left in page source, read a JWT and spot an insecure direct object reference. Challenges: Peek the Source (100), Token of Trust (250), Guess the ID (300).
• Blue team (2): Work out which firewall rule matches first, and find the brute force in the SOC logs. Challenges: Hole in the Wall (300), Needle in the Logs (300).
• IR (1): Put the incident response lifecycle in order. Challenges: Lifecycle Shuffle (200).
• GRC (3): Do the risk maths (SLE, ARO, ALE), judge whether a control pays for itself and map work to NIST CSF 2.0. Challenges: ALE Pay (200), Control or Not (300), Framework Bingo (400).
• Forensics (2): Prove evidence integrity with SHA-256 and reconstruct data smuggled out over DNS. Challenges: Chain of Custody (400), Exfil (500).
• Linux (2): Read a shell history and audit a misconfigured SUID binary. Challenges: Bash to the Past (150), Set User ID (300).
• Python (2): Read Python by hand and spot the unsafe call in a code review. Challenges: What Does It Print (200), Eval of All Evil (300).
• Pwn (3): Defensive code review of memory-safety bugs: a stack overflow, a use-after-free and a race condition. Challenges: Mind the Gap (350), Free Twice (450), Time of Check (400).

Levels

• Recruit: Every hint for every challenge. The place to start if CTFs are new to you.
• Operator: One hint per challenge. You know the tools; the hint only points the way.
• Elite: No hints at all. Just the evidence and the flag box.

Your tools

• Packet viewer: Open a capture inside the challenge: frames, protocols and payloads, or download the .pcap for Wireshark.
• Toolbox: A CyberChef-style decoder: From Base64, From Hex, ROT13, URL Decode, XOR, SHA-256 and more, chained as a recipe.
• Scoreboard: Your score, flags captured, rank and one overall countdown, with a live leaderboard for your level.

Scoring

• Each challenge is worth its points when the flag is exactly right. A wrong flag scores nothing and uses one of your 3 tries.
• Flags are drawn for your play, so a flag from someone else's play never works here.
• Your ending depends on which of the big challenges you clear: Rookie, Contender or Champion.
• Every finished play keeps a debrief that maps each challenge to the Bootcamp class it practises, and a certificate when your score clears the bar.

Defensive analysis only. Every challenge reads, decodes or reasons about evidence it hands you. Nothing attacks a real system, and nothing needs to be installed.

Questions

Do I need CTF experience?

No. Start at Recruit: every challenge comes with hints, and the first column needs nothing more than reading a capture. The challenges follow the Core Skills Bootcamp of the Bartman cybersecurity track, then go further.

How long does a play take?

A play is one 72-hour window from when you start it, and you can stop and come back inside it. Plan on about six hours for the full board.

What do I get for one purchase?

6 plays: 2 at each of the three levels. Each play generates its own flags.

Can I play with others?

Yes. Each play lets you invite 2 people, so a team of up to 3 works the same board together.

Do I need to install anything?

No. The packet viewer and the decoder run in the browser. You can download any artefact to use your own tools if you prefer.

Is this hacking?

No. It is defensive analysis: you read evidence from a breach that already happened. The code-review challenges ask you to spot a bug, never to exploit a live system.

Something looks wrong. Who do I tell?

Use Report a problem from the challenge, or write to team@bartman.ai.