COMING SOONBeginner
Transfer Denied: The MOVEit Web Shell
An internet-facing MOVEit Transfer server is breached through an unauthenticated SQL injection. A stealthy web shell, gated by a secret header, enumerates and steals stored files and plants a rogue account. Work the web request logs to reconstruct the data theft.
30m
6 tasks
25 points
FreeLaunches in 3 days
Sep 1, 2026
Create your free accountTuesday, September 1, 2026 at 9:00 AM
Be ready the moment it drops, free.
Training Tools
SIEMFirewall
What you'll investigate
6 objectives unlock when this operation goes live.
1Find the foothold
2Name the implant
3Recover the implant's secret
4Catch the backdoor account
5Trace the theft
6Classify the access
Be first when it launches
Create your free account now. The moment this operation goes live on Sep 1, 2026, you can jump straight in — and you'll have the rest of the catalog to train on meanwhile.
Get Started Free