Welcome to your final capstone assessment. You have 4.5 hours.
Chalanee, a personal digital vault application running locally on your machine.
- You may test only your own local instance.
- You may use any tool: Burp, ZAP, curl, scripts, AI assistants (with disclosure).
- You must capture flags via the score board to receive points.
- You must submit a professional penetration test report.
- Sharing flags with other students = academic misconduct.
- Modifying Chalanee source code to extract flags = academic misconduct.
- 50% flag capture (87 raw points scaled to 50)
- 50% report quality (50 points)
| Score | Grade | Description |
|---|---|---|
| 90+ | A | Mastery — found Hard-tier + professional report |
| 80–89 | B | Distinguished — comprehensive medium-tier + strong report |
| 70–79 | C | Proficient |
| 60–69 | D | Passing |
| < 60 | F | Insufficient |
- Score board completion screenshot
- Professional penetration test report (template:
REPORT_TEMPLATE.docx) - AI use disclosure (mandatory if AI tools were used)
Submit each captured scoring token at http://localhost:3001. The score board:
- Validates the flag against the canonical map
- Awards tier-points (Trivial 1pt, Easy 2pt, Medium 3pt, Medium-Hard 4pt, Hard 5pt)
- Updates your rank on the leaderboard
- Rate-limits at 60 submissions/minute (don't brute-force)
Begin when ready. Good hunting.