Situation: Analyst Alex Mercer has gone dark. Their desk has been sealed and their devices seized as evidence. Intelligence suggests a foreign actor accessed part of the network, and analysts need help finishing the investigation before the shift ends.
You are joining the unit as a trainee analyst for the day. Each exercise below teaches a real skill used by cyber security professionals. You do not need any prior coding or hacking knowledge to complete any of them. Each one opens in a new tab, so this hub stays open here, so bring your flags back to this page once you find them.
Study everything recovered from Alex's desk and work out their passcode. Not every item matters — and some might matter later.
SKILL: OSINT Opens in a new tab ↗Log into Alex's computer using what you found in Exercise 01 — but you'll need to work out the username yourself.
SKILL: CREDENTIALS Opens in a new tab ↗Verify a photo's checksum against IT's records, discover it's been altered, then dig into the raw file to find out why.
SKILL: FORENSICS Opens in a new tab ↗Inspect a web page's source code to find a hidden, fully-encoded memo.
SKILL: WEB INSPECTION Opens in a new tab ↗Examine a photo's hidden metadata to work out where — and when — it was taken.
SKILL: METADATA Opens in a new tab ↗Crack a Tifinagh cryptogram — solve one symbol and every matching symbol in the message updates automatically.
SKILL: CRYPTOGRAPHY Opens in a new tab ↗Enter each flag you've found, then press "Check flags." All six need to be correct at the same time. Flags aren't case sensitive.
MISSION ACCOMPLISHED
Well done, agent — Operation Southern Watch is officially closed. If six exercises barely scratched the itch, the Australian Signals Directorate runs genuine puzzles and challenges for people exploring a career in cyber security: asd.gov.au/puzzles-and-challenges