Live Process Triage
forensics · easy · +30 XP
Target
GET /api/lab/live-triage-101/ps (mock ps aux)
GET /api/lab/live-triage-101/netstat (mock netstat -anp)
POST /api/lab/live-triage-101/submit body {rogue_pid, c2_host}
Goal: one PID is bound to a high-port TCP socket to an external IP. The matching netstat row shows the C2 host. Submit both for the flag.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/live-triage-101/
// reuse on the cli
// submit flag
// no solves yet
3 of 13 · forensics