GitHub Security Lab

Capture The Flag

Do you want to challenge your vulnerability hunting skills? We created these CTF challenges to allow you to do exactly that, while helping you to quickly learn CodeQL.

Currently playing

Stay tuned, our next CTF is coming in early May!

Past challenges

You can still enjoy these past challenges, to practice CodeQL, or just for the fun!

• CTF 1: SEGV Hunt - Find a critical buffer overflow bug in glibc. Language: C - Difficulty level:
• CTF 2: U-Boot Challenge - Follow in the footsteps of our security research team and discover 13 vulnerabilities un U-Boot. Language: C - Difficulty level:
• CTF 3: XSS-unsafe jQuery plugins - Find variants of jQuery plugins that expose their clients to undocumented XSS (cross-site scripting) vulnerabilities. Language: JavaScript - Difficulty level:

Documentation

If you want to learn more about writing CodeQL queries before getting started with these CTF challenges, you may find the following articles and documents useful:

• Introduction to CodeQL
• CodeQL detective tutorials
• Writing a basic CodeQL query for C/C++
• Python code analysis - Introduction to CodeQL

Getting Help

If you find yourself stuck writing in the QL language or on any part of the CTF and would like some help, email us at ctf@github.com