🧛‍♀️ Brace yourselves, brave souls! The haunted season has returned, and with it, an all-new cybersecurity adventure—Halloween 2024: Return to Haunted Hollow. The sinister spirits of cyberspace await you in this terrifying sequel to our 2023 Halloween collection, The Haunted Hollow. This is no mere challenge—it’s an eerie expedition through 9 haunted labs designed to test your skills and sanity alike. Whether you're a seasoned crypt keeper of the cybersecurity world or a curious newcomer, there's a fright waiting for everyone in this immersive capture-the-flag experience!

🔮 From unraveling encrypted secrets to hunting ghosts in packet captures, every lab holds the key to defeating the horrors lurking within. Can you escape the Haunted Helpdesk, break the Encryption Enigma, or uncover the Spooky, Scary, Silly Snaps? Each step you take deeper into this digital graveyard will challenge your mind and test your courage, until you can break out of the park through the Emergency Exit!

🕷️ With a difficulty ranging from approachable to spine-chillingly tough, it’s not about conquering all the horrors—just enough to emerge from the shadows with your sanity intact. Gather your wits, grab your digital lantern, and get ready to explore the most terrifying corners of cyber horror!

🧛 Release Date: October 16th

⌛ Estimated Time to Complete: 5 hours

👻 Labs: 9, each more terrifying than the last

🎃 Difficulty Range: 2-6

🧟 Collection Type: Challenge

Lab details

Note: These labs can be completed in any order, but we have ordered them from most accessible to most challenging. The final lab can only be completed after the other labs have been completed. The prequel collection doesn’t need to be completed before you can dive into these labs, but if you're craving some extra chills and thrills, feel free to haunt them first!

Phishing for Treats

Difficulty: 2

Skills required: None – this lab should be accessible to all audiences

What's involved: This lab is a new phishing emails lab, with Halloween-themed emails. Users have to identify whether the email is 'safe' or 'spam' based on indicators from the emails.

PCAP Pandemonium

Difficulty: 4

Skills required: Packet capture analysis (Wireshark)

What's involved: In this lab, users will need to analyse multiple packet captures using Wireshark to identify answers to the questions from the network traffic.

Delving Deeper

Difficulty: 4

Skills required: Web application enumeration

What's involved: Users will need to explore a web application in order to gain access to a computer terminal within the application. From there, they'll need to interact with a simple API.

Encryption Enigma

Difficulty: 5

Skills required: Modern encryption/encoding techniques (Knowledge of how to use CyberChef will be useful)

What's involved: Users will need to identify the correct encoding and encryption technique used to obfuscate each message in an application, before decrypting/decoding each message.

Confusing Code

Difficulty: 5

Skills required: Linux enumeration techniques, reverse engineering (particularly using Ghidra)

What's involved: Users will need to use Linux enumeration techniques to identify a binary, before reverse engineering that binary to figure out how to exploit it. 

Haunted Helpdesk

Difficulty: 5

Skills required: Linux enumeration and privilege escalation techniques

What's involved: Users will be dropped into a restricted environment. From there, they'll need to figure out how to escape, and escalate their privileges to root.

Fearsome Forensics

Difficulty: 6

Skills required: OSINT, web application enumeration, modern encryption techniques, steganography

What's involved: In this lab, the user will need to explore the web application and discover clues using OSINT techniques. These clues will then be used to decipher encrypted messages, finally revealing how to extract a message hidden inside an image.

Spooky, Scary, Silly Snaps

Difficulty: 6

Skills required: AWS capabilities (particularly S3 and AWS permissions), Python scripting 

What's involved: Users will need to enumerate public S3 resources to identify credentials for an AWS account. From here, they'll need to interact with the AWS console, and identify a way of escalating their privileges on AWS.

Emergency Exit

Difficulty: 1

Skills required: None – this lab is a culmination of the preceding labs within the collection,  but no specific skills are required to complete this lab.

What's involved: In each of the labs in this collection, users would have been asked to make a note of a code. In this lab, they need to submit each of these codes. 

Share Your Thoughts

Did you escape the Haunted Hollow? We'd love to hear from you! Remember you can post in our Help & Support Forum for hints, tips & collaboration from your fellow community of experts.