Lessons
Each lesson is a self-contained skill drill with objectives, a quick-reference command table, common pitfalls, worked examples, and a drill gallery. Lessons are tagged to DCWF work roles and NCAE scored services so you can find what develops what. Lessons marked "published" are ready to study; "draft" has partial content; "stub" is a catalog entry awaiting content.
Samba Share Basics. Keep SMB Login Green
The #1 scoring check by weight is SMB Login (3× points). This lesson teaches you to verify Samba is running, add the scoring users, define the `files` share, and prove external access. all in under 10 minutes.
MikroTik NAT. The Port-Forwarding Rules That Unblock Everything
At the 2026-03-14 regional, the #1 most frequent error (5752 occurrences) was 'DNS EXT FWD can't contact DNS server'. and 90% of the time the root cause is a missing MikroTik DNAT rule, NOT a DNS problem. This lesson co.
BIND Zone Files. Forward, Reverse, and Serial Numbers
Internal DNS (DNS INT FWD/REV) requires BIND to serve two kinds of records: forward (nameIP) and reverse (IPname). Both are needed. the scoring engine checks them separately. This lesson walks through a minimal named.co.
SSH Hardening Without Locking Yourself Out
Classic mistake: team hardens sshd_config, restarts sshd, and promptly loses access. This lesson covers the safe sequence. test in a second terminal before closing your first session, preserve scoring-engine keys, and u.
PostgreSQL. listen_addresses and pg_hba.conf
Postgres Access was the #2 most frequent failure at regional (5144 occurrences). The two config knobs that drive 95% of failures are `listen_addresses` (can clients reach Postgres at all?) and `pg_hba.conf` (is this spe.
Backups + Cron = Self-Healing Configs
Even a basic 60-second cron that restores critical configs from a known-good tarball will undo most red-team tampering automatically. This lesson covers the 3 parts: capturing the golden snapshot, writing the restore sc.
Backdoor Hunt. The 10 Places to Look
The competition image arrives pre-compromised. Before the scoring engine even gets involved, you need to find and remove the planted backdoors. Ten locations cover 95% of persistence mechanisms used in past competitions.
The addict_with_a_pen.data Trick. A Free-Points Exercise
At the 2026-03-14 regional, ZERO teams scored any SMB Read uptime. The reason: the scoring engine looks for a file called `addict_with_a_pen.data` on the `files` share, and the competition image doesn't ship with it. Cr.
Linux Service Management. systemctl, journalctl, sysvinit
Every NCAE service is managed by systemd. You will type `systemctl restart <service>` at least once per minute during competition. This lesson is the foundation. without it, nothing in the other lessons makes sense. It .
TCP Ports & Services. ss, netstat, lsof, nmap
Half of all NCAE debugging is 'is this port open and if so who has it?'. `ss` has replaced `netstat` on modern Linux; this lesson covers both plus the view-from-outside (nmap) and who-owns-what (lsof). Students will dia.
DNS Fundamentals. Records, Resolvers, Zones
DNS lookups power four of the 13 scored NCAE services. This lesson teaches the vocabulary you need. what a record is, what a zone is, the difference between authoritative and recursive. so when you read `named.conf` lat.
Linux Users, Groups, Sudoers
Everything on Linux is either a file or a process, and everything has an owner. This lesson covers how users and groups work, how to add/modify/remove them, and how sudo rules are configured. because half of 'backdoor h.
Basic Shell Scripting. The 80% That Gets Things Done
You will write small bash scripts during the competition. backup-and-restore, health checks, config-diff alerts. This lesson covers the 80% of bash you need: shebangs, quoting, conditionals, loops, exit codes, and the p.
Apache VirtualHosts + SSL. Serving WWW Content and WWW SSL
Three NCAE services score against your web server: WWW Port 80 (is HTTP alive), WWW Content (does the admin login work), WWW SSL (is HTTPS + valid cert up). This lesson covers Apache2's module + sites-enabled model, how.
fail2ban. Automatic Banning of Brute-Force IPs
fail2ban is the single easiest way to shut down SSH brute-force attacks during NCAE. Install enable done. This lesson covers the three config files you care about, the one crucial whitelist entry (scoring engine), and.
Packet Capture Analysis with tshark
Reading PCAPs on the CLI: filters, flows, credentials in cleartext. Useful for CTF forensics.
CTF Crypto Toolkit
Classical ciphers, hash ID, RSA, CyberChef, hashcat. CTF category tools. Comprehensive version in the NCL April 2026 field guide.
CTF Forensics Toolkit
exiftool, binwalk, steghide, volatility, file carving. Comprehensive version in the NCL April 2026 field guide.