CyberWorld :: Training Range

FLLC Purple-Team OS // "Hack the impossible. Defend the future."

Tiers

Where to start

1. Open the gate at index.html. Log in with any handle and passphrase that pass local validation. The page is the audit surface; F01-F09 are observable here without leaving it.
2. You will be forwarded to lab.html. Each tier card links to its workbench.
3. For Tier 1 self-check, go to console.html and paste canonical observations into the rubric.
4. For Tiers 2 and 3, use the interactive challenges on crypto.html and intel.html.
5. For Tiers 4 and 5, the workbench is intercept.html. It carries the endpoint catalog and macros for the trickier exploit chains.
6. If you need a hint for any finding, the hint button next to each row loads hints.json on demand. Reading the file directly is a spoiler.

Safety and scope

• No credentials are accepted, transmitted, or stored. Anything you type into the gate is processed locally and discarded.
• The session token lives in window.sessionStorage only and expires in 5 minutes.
• The only network fetches are same-origin to ./assets/seal.png, ./manifest.json, ./hints.json, and the service-worker-served ./api/v1/*.
• The service worker at ./sw-ctf.js is the Tier-4 / Tier-5 backend. Its scope is /CyberWorld_login/. The site-wide service worker at /sw.js explicitly skips this directory.

Manifest verification

The public manifest.json ships with an HMAC-SHA-256 signature over its canonical JSON body. The key derivation is published:

K = SHA-256("cyberworld:training:v2:2026-05-26:personfu")
  = d8e02c04f74ec71feea211c61bb680261aa38f5e899b9f7100ae02e50ce86875

To verify locally:

python3 - <<'PY'
import json, hashlib, hmac
m = json.load(open("manifest.json"))
sig = m.pop("signature")
K = hashlib.sha256(b"cyberworld:training:v2:2026-05-26:personfu").digest()
print("ok" if hmac.compare_digest(
    hmac.new(K, json.dumps(m, separators=(",",":"), sort_keys=True).encode(),
             hashlib.sha256).hexdigest(),
    sig["value"]) else "MISMATCH")
PY

Finding commitments

The public manifest publishes a 32-bit commitment for every finding:

answer_sha256_prefix = SHA-256(canonical_token)[:4]
master_xor           = T1 XOR T2 XOR ... XOR T33   over GF(2)^32

Pasting a candidate token into the per-finding input on the Console or Intercept page hashes it locally and compares against the published prefix. Cryptographic challenges (RSA, ECDSA, HMAC, Vigenere, JWT) auto-confirm when their exploit response is detected; intel and audit findings accept short observation tokens.

Tier 5 -- new in v5

Resume framing

Designed and deployed a five-tier defensive-analyst CTF on GitHub Pages. The static-site service-worker backend simulates a small vulnerable HTTP API and exposes intentional vulnerabilities mapped to CWE / OWASP / MITRE ATT&CK / NIST SP 800-53 + 800-61 references. The challenge surface covers client-side audit, RSA / ECDSA / HMAC / Vigenere cryptanalysis, May-2026 threat intelligence (CVE attribution, ATT&CK technique mapping, NIST IR phase, threat-actor cluster, zero-width-space steganography), and a chained web-pentest path culminating in JWT key confusion, prototype pollution, and cache-vs-auth confusion. No credentials are accepted, transmitted, or stored. Manifest is HMAC-SHA-256 signed; finding commitments live in the public manifest, hints in a separate hints.json.

References

1. RFC 7515 -- JSON Web Signature (JWS)
2. RFC 7519 -- JSON Web Token (JWT)
3. RFC 8725 -- JWT Best Current Practices (HS/RS key confusion, alg=none)
4. RFC 9110 -- HTTP Semantics
5. NIST FIPS 180-4 -- SHA-256
6. NIST FIPS 186-5 -- ECDSA over NIST P-256
7. NIST FIPS 198-1 -- HMAC
8. NIST SP 800-53 -- Security and Privacy Controls
9. NIST SP 800-61 Rev.3 -- Computer Security Incident Handling Guide
10. NIST SP 800-115 -- Technical Guide to Information Security Testing
11. OWASP Top 10 -- A01 Broken Access Control / A02 Cryptographic Failures / A03 Injection / A07 Identification and Authentication Failures
12. OWASP ASVS v4 -- Architecture, Authentication, Session Management, Access Control, Validation
13. MITRE ATT&CK -- T1078 Valid Accounts, T1190 Exploit Public-Facing App, T1059 Command and Scripting Interpreter
14. MITRE D3FEND -- Authentication Hardening countermeasures
15. CISA Alert AA24-179A -- polyfill.io supply-chain compromise
16. Mandiant -- UNC5337 (Ivanti Connect Secure, Dec 2024 onward; CVE-2025-0282)
17. Vercel -- CVE-2025-29927 (Next.js middleware authorization bypass, Mar 2025)
18. Adam Back -- Hashcash, 2002
19. A. Shamir -- "How to share a secret", CACM 22(11), 1979
20. R. Rivest, A. Shamir, L. Adleman -- CACM 21(2), 1978
21. F. Kasiski -- Die Geheimschriften und die Dechiffrir-Kunst, 1863
22. W. F. Friedman -- The Index of Coincidence and its Applications in Cryptography, 1922

v5 // 2026-05-27 // Person / FLLC <https://fllc.net> // FLLC Purple-Team OS
provided as is for demonstration and educational purposes only.