SpyderSec: Challenge

  • Name: SpyderSec: Challenge
  • Date release: 4 Sep 2015

Please remember that VulnHub is a free community resource so we are unable to check the machines that are provided to us. Before you download, please read our FAQs sections dealing with the dangers of running unknown VMs and our suggestions for "protecting yourself and your network. If you understand the risks, please download!


(Size: 2.4 GB)

The Challenge:

You are looking for two flags. Using discovered pointers in various elements of the running web application you can deduce the first flag (a downloadable file) which is required to find the second flag (a text file). Look, read and maybe even listen. You will need to use basic web application recon skills as well as some forensics to find both flags.

Level: Intermediate


The virtual machine comes in an OVA format, and is a generic 32 bit CentOS Linux build with a single available service (HTTP) where the challenge resides. Feel free to enable bridged networking to have the VM automatically be assigned a DHCP address. This VM has been tested in VMware Workstation 12 Player (choose "Retry" if needed), and VirtualBox 4.3.

SHA1: f60f497f3f8fda0d0aeccfc84dad8e19ad164f55 Challenge.ova

Twitter: @SpyderSec

Removed HTTP download links - torrent only for the time being.

  • Filename: SpyderSecChallenge.ova
  • File size: 2.4 GB
  • MD5: C3370138A79E68C2F00BDF3A31F7809B
  • SHA1: F60F497F3F8FDA0D0AECCFC84DAD8E19AD164F55

  • Format: Virtual Machine (Virtualbox - OVA)
  • Operating System: Linux

  • DHCP service: Enabled
  • IP address: Automatically assign

Yes - 2x