Start here
You are on the Human Expedition. Collaborate inside your registered team. Every accepted flag adds its challenge value to your team score.
Sign in with Okta for an independent account on each track. You may visit Human, Noob, and Human+AI in any order.
Honor rule: Noob is a zero-point learning track. Competitive entrants agree not to use its solutions, Ilma helper guidance, or hints to improve their results in Human or Human+AI.
For help, post in #ask-security and tag @security-oncall.
CTF details
Forty hands-on web and API challenges. Okta signs you into a separate progress and scoreboard record for each event.
- Pick a challenge. Read its description, tags, files, and Connection Info. Use the official hints inside each challenge when you need actionable help.
- Investigate the listed target. Use your browser, developer tools, command-line tools, or Burp.
- Find the flag. Copy the complete value beginning with
FLAG_. - Submit it in CTFd. Open the challenge again, paste the flag, and select Submit.
Rules and authorized scope
LlamaRange is a Vanta-hosted CTF. Keep every request inside the active challenge.
- Only the targets, files, downloads, and accounts listed in the active challenge's Connection Info are in scope; everything else is outside scope.
- No denial of service, destructive changes, persistence, phishing, credential reuse, or high-volume automated scanning.
- Do not share flags across events. Collaborate only within your registered team when the active event uses teams.
Install and use Burp Community Edition
Burp lets you observe and safely replay a challenge's HTTP requests.
- Install. Download Burp Suite, choose the installer for your operating system and CPU, run it, and select Community Edition.
- Start. Choose Temporary project, select Next, choose Use Burp defaults, then select Start Burp.
- Limit scope. In Target > Scope, add the current challenge origin. Include subdomains only when Connection Info says they are part of the challenge.
- Open the built-in browser. In Proxy > Intercept, select Open browser. It is already configured for Burp and HTTPS.
- Inspect traffic. Turn Intercept on to edit, Forward, or Drop a request. Turn it off for normal browsing; Proxy > HTTP history still records traffic.
- Replay a request. Right-click it in HTTP history, select Send to Repeater, change one input, select Send, and compare the response.
Use an external browser
Confirm the proxy listener is 127.0.0.1:8080, proxy HTTP and HTTPS to it, visit http://burpsuite through that browser, and install Burp's CA certificate. The built-in browser is simpler and needs no certificate setup.
Ask Security in Slack
For access, scoring, suspected broken flags, or help with a challenge, contact us in Slack.
Post in #ask-security and tag @security-oncall. Include the event, challenge name, approximate time, and what you observed.
Okta sign-in automatically reconnects one active, visible, unlinked player account with the same verified company email, preserving its team and history. Administrator accounts, unavailable accounts, and conflicting matches still need an organizer to verify and explicitly link the exact Okta identity on that track.
Do not post flags, passwords, session cookies, access tokens, or other challenge secrets in a public channel.