Browser History Carve from RAM
forensics · medium · +45 XP
Target
GET /api/lab/browser-carve-101/dump (heap strings from chrome.exe)
POST /api/lab/browser-carve-101/submit body {c2_url}
Goal: scan for http(s):// URLs in the heap. Ignore CDN + Google noise. One URL points to a .onion-style or suspicious bare-IP path (e.g., http://185.x.x.x:8443/panel/login). Submit it.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/browser-carve-101/
// reuse on the cli
// submit flag
// no solves yet
9 of 13 · forensics