Challenge library

Cloud security CTF challenges by domain

Browse sample AWS, GCP, and Azure challenges across identity, storage, networking, and containers. Each includes an isolated sandbox, optional hints, and a verified solution path.

AWSGCPAzure

Sample library

Sample challenge library

A representative slice of the full library. Contact us for access to the complete catalog and custom challenge paths.

  • IAM Privilege Escalation
    Hard
    Chain IAM permissions to gain admin access in a locked-down account.
    AWS2-4 hr
  • S3 Bucket Misconfig
    Medium
    A bucket policy grants public read access. Find the flaw and restrict it.
    AWS45 min
  • Overly Permissive KMS Key Policy
    Medium
    A key policy grants decrypt to the wrong principal. Find the exposure and tighten it.
    AWS1 hr
  • Public ECR Repository
    Easy
    An ECR repository allows anonymous pull. Locate the policy flaw and lock it down.
    AWS30 min
  • Lambda Execution Role
    Easy
    A Lambda function inherits excessive permissions. Scope the execution role.
    AWS30 min
  • GCS Bucket Misconfig
    Medium
    A Cloud Storage bucket allows public object listing. Find and fix the exposure.
    GCP45 min
  • Service Account Escalation
    Hard
    Chain IAM roles and service account permissions to reach project admin.
    GCP2-3 hr
  • Overly Broad RBAC Role
    Hard
    A Contributor assignment is wider than intended. Trace the path and tighten scope.
    Azure2-3 hr
  • Public Blob Container
    Medium
    A storage container allows anonymous read. Find the exposure and lock it down.
    Azure45 min

Coverage

Domains we cover

How it works

How challenges work

  1. 01

    Pick a challenge

    Browse by domain and difficulty. Each maps to a real cloud misconfiguration pattern.

  2. 02

    Launch your sandbox

    An isolated cloud environment spins up in minutes. No access to your production account.

  3. 03

    Investigate and exploit

    Use guided hints or go unguided. Practice the same skills you need during incidents.

  4. 04

    Verify and learn

    Submit your flag, review the solution path, and advance to harder tiers.

Ready to access the full library?

Contact us with your team size and training goals, or review how pricing works.

Contact usView pricing