Ops Lab — William Lam

#Ops Lab

21 live modules · Interactive

stage 01 · observe — watch the perimeter, map the range

netmon --live · perimeter firewall MONITORING

Packets cleared

Threats blocked

100%

Perimeter integrity

recon --sim · training range IDLE

ipcalc --cidr · subnet math —

CIDR block — an IPv4 address with a prefix, e.g. 10.13.37.0/24 or 192.168.1.1/255.255.255.0

// network, broadcast, usable host range, wildcard mask & host count — pure bitmath in your browser, no lookups

stage 02 · extract — drop an artifact; strings, metadata, coordinates & hidden payloads come out, ready to pipe downstream

xxd + strings · drop a file NO FILE

Drop any file · or click to browse Hex-dumped and scanned for printable strings in your browser — the first move on any mystery CTF file. Nothing is uploaded.

exiftool --scan · drop an image NO FILE

Drop an image · or click to browse JPEG & PNG — decoded byte-by-byte in your browser. Nothing is uploaded. Try a photo straight off a phone.

geo --locate · lat/lon lookup READY

Latitude — paste "lat, lon" here to fill both fields at once

Longitude

// nearest-city lookup against ~120 major world cities via the haversine formula — not a full reverse-geocoder, but enough to place a coordinate dropped in a CTF challenge or a photo's EXIF data

stego --lsb · drop a PNG NO FILE

Drop a PNG · or click to browse Extracts the least-significant bit of each pixel channel in your browser — the classic hiding spot for stego CTF payloads. Use a lossless PNG; JPEG compression destroys LSB data.

// try each channel — a real payload usually only lives in one, and only the first N bits before it runs into image noise

qr --decode · drop an image NO FILE

Drop a QR code · or click to browse Located and decoded in your browser via jsQR. Nothing is uploaded.

// finder-pattern detection, perspective correction and Reed-Solomon error correction — all client-side

stage 03 · decode — feed extracted blobs through every codec, then escalate: single shift → single byte → repeating key → full substitution

magic --decode · run every codec READY

Paste an encoded blob — it's decoded every way at once, readable results float to the top

// base64 · base64url · base32 · base58 · base45 · base36 · ascii85 · hex · binary · decimal · a1z26 · bacon · nato · braille · html · unicode · quoted-printable · url · rot13/18/47 · atbash · morse · reverse — decodes & encodes, all client-side

xor --brute · single byte 256 KEYS

Ciphertext in hex — every key 0x00–0xFF is tried, ranked by how English the plaintext scores

// classic single-byte XOR break — frequency-scored, top matches first · best result can feed magic for double-encoded data

caesar --interactive ROT-N

Plaintext / ciphertext

Shift key

Output

vigenere --crack · IC + chi-squared READY

Ciphertext — polyalphabetic substitution, key repeats over the letters

Decoded plaintext

—

// index of coincidence ranks candidate key lengths; each is then broken column-by-column with chi-squared English scoring — approximate on short or skewed text

freq --analyze · substitution solver READY

stdin — analyse your own text, or pipe in another tool's output

Ciphertext — classic monoalphabetic substitution

Substitution key — cipher letter above, your plaintext guess below

Decoded preview

—

// quick-guess maps observed letters onto English frequency order (ETAOIN…) as a starting point — refine it by hand

stage 04 · crypto & identity — hash it, name it, audit it · break a toy key, read a token, pin its timestamps

sha256 --avalanche WEB CRYPTO

Message

SHA-256 digest · 256 bits

// edit one character — watch ~half the bits flip

hashid --identify —

Paste an unknown hash

// identified by length & charset — candidates, not certainty

passwd --audit · offline 100 GH/s

Test passphrase — invent one, not your real creds

// awaiting input

Entropy: 0 bits
Charset pool: 0 symbols
Offline crack time: —

// runs 100% in-browser — nothing leaves this page

rsa --toy · small-n textbook RSA READY

// Pollard's rho + Miller-Rabin, entirely client-side — only tractable because this n is deliberately small; that's the whole point of RSA key sizes

jwt --decode · no verify —

Paste a JSON Web Token

Header

—

Payload

—

// signature is never verified — decode only

date --epoch · timestamp converter —

Epoch (seconds or ms)

Date & time

// edit either field — the other updates live; useful for correlating JWT iat/exp and log timestamps

uuid --inspect · decode identifiers —

UUID or ULID — versioned UUIDs (v1/v6/v7) and ULIDs carry an embedded timestamp you can pull back out

// version & variant read from the bitfields; v1/v6 unwind the 100-ns Gregorian clock, v7 & ULID the millisecond Unix clock — all local

stage 05 · synthesize — every stdout above pipes in here: hunt flags, grep the streams, diff what changed

flaghunter --scan · find any flag READY

stdin — scan your own text, or pipe in another tool's output

Text to scan — every word{...} pattern is pulled out automatically

// scans for word{...} shapes — known CTF platform prefixes (flag, CTF, HTB, THM, picoCTF…) get a High-confidence badge

grep --pattern · search any text IDLE

stdin — search your own text, or pipe in another tool's output

Text to search — paste a log, a dump, a wordlist, anything

Pattern — grep only runs once you type something here

// nothing runs until you enter a pattern — matches highlighted, -n line numbers, all client-side

diff --compare · spot what changed SAME

Side A

Side B

// line-based diff — paste two versions of anything (a patched binary's strings, two config dumps, before/after a decode) and see exactly what moved

entropy --shannon · measure randomness —

stdin — measure your own text, or pipe in another tool's output

Bytes to measure — a key, a blob, a suspected ciphertext

// awaiting input

// Shannon entropy over UTF-8 bytes (0–8 bits/byte) — high, flat entropy is the fingerprint of encryption, compression, or a random key; English prose sits near 4

#Ops Lab

Hex dump

Strings ≥ 4

LSB hex dump

Strings ≥ 4