Ping of Cloud drops you into an external perimeter assessment against a cloud-hosted diagnostic utility. The target presents a simple reachability interface, but what appears to be an isolated tool is merely the front door to an entire cloud footprint. Your mission is straightforward: find the flaw, gain a foothold, move laterally through the infrastructure, and retrieve the hidden assets.
One entry point. One chained attack. Every stage bridges the gap between traditional application exploitation and offensive cloud tradecraft. There are no shortcuts and no skipping steps, just you, the target, and the clock. Ping of Cloud is the proving ground for security researchers ready to turn a single unvalidated input into a full cloud compromise.
Players should have hands-on penetration testing skills, including web application exploitation, Linux command-line proficiency, network enumeration, and a working understanding of basic cloud concepts.
Goal
Goal of the Competition
/Exploit the exposed web interface to gain initial access to the underlying system.
/Enumerate the local environment and escalate your privileges.
/Pivot deeper into the cloud infrastructure to locate restricted resources.
/Chain the attack vectors stage-by-stage to uncover all hidden flags.
/Reach the deepest layer possible in the shortest time, using the fewest hints.
Rules
/Individual Instances: Each participant operates within their own isolated target environment.
/Attacking other players, event platforms, or shared scoring infrastructure is strictly forbidden.
/Scope Definition: All offensive activities must remain strictly confined to the designated target assets. Out-of-scope services or external cloud infrastructure are strictly off-limits.
/No Denial of Service (DoS): High-concurrency brute-forcing, resource flooding, or any action designed to disrupt platform stability will result in immediate disqualification.
/Tooling: You are free to use any standard security tools, custom scripts, and attack frameworks.
/Scoring & Progression: Points are awarded per stage upon submitting the valid flag format. Stage hints are available on-demand but will deduct from that stage’s points.
/Tie-Breaker: Ties are settled by the furthest stage completed, fastest completion time, and lowest hint count.
/Fair Play: Flag sharing, sabotaging environments, or exploiting unintended bugs in the hosting platform is strictly prohibited.
PRIZES
TBD