The rest of the map

You have now covered the big five. The challenge board has more categories, and each could fill a course of its own. You don't need to master them now. What matters is knowing what each one is about, and where to start when you meet one.

• OSINT / Misc

  Given a photo of a street, find the name of the café in it. Everything you need is public, you just have to find it.

  Start with: Reverse image search, search engine operators like site: and filetype:, and looking at old versions of pages.

• Network Security

  Find which services are exposed on a target you’re given, then log in to the one using weak settings.

  Start with: Learn nmap for scanning the target you were given, and Wireshark for reading traffic.

• Mobile Security

  An Android app has a login screen and an API key hidden inside it. Unpack the app and find it.

  Start with: An .apk is really a ZIP file. jadx turns one back into readable Java.

• Hardware / IoT

  You are given a firmware dump from a smart camera, with a password buried in its files.

  Start with: Use binwalk to unpack the firmware, then treat it like forensics, with strings and grep.

• Blockchain / Web3

  A smart contract holds some funds. Find the bug in its code and drain them to prove it.

  Start with: Learn to read basic Solidity. The Ethernaut wargame by OpenZeppelin is a good place to begin.

• Cloud Security

  A company’s storage bucket was left public. Read what’s inside, and use the credentials you find.

  Start with: Learn the basics of storage buckets and access roles (IAM), and the aws command line.

• Programming

  A server fires 100 math problems at you and gives you one second for each. Far too fast for a human, so you write a script.

  Start with: Learn enough Python to read from a connection, work out an answer and send it back.

• Mixed

  The Base64 in a web page’s cookie leads to a file, and the file holds an image with a password hidden in it. Each stage needs a different skill.

  Start with: Nothing new: use every skill you have, one step at a time.

To show how small these scripts can be, here is a complete solution to that math challenge, using the pwntools(opens in a new tab) library from the pwn lesson. It reads a line like What is 41 + 7?, works it out and sends the answer back, 100 times.

import re
from pwn import *

io = remote("prog.challenges.example", 9002)

for _ in range(100):
    line = io.recvline().decode()
    a, b = re.findall(r"\d+", line)
    io.sendline(str(int(a) + int(b)).encode())

print(io.recvall().decode())   # the server rewards you with the flag

Try a little of everything at first. Then follow what you enjoy, because that is what will keep you practicing. If you are unsure, these match up well with what you may already like:

• Built a website before? Start with Web.
• Like math or puzzles? Try Crypto.
• Enjoy detective stories? Forensics and OSINT are for you.
• Curious how computers really work? Reversing, and then Pwn.