Broken Access Control
Get where you shouldn't, then learn to lock the door behind you.
Start Hacking
Start Hacking
> SKILLSUSA ARIZONA // CYBER SECURITY
George is the competition platform where Arizona high school students break things, fix things, and out-hack each other. Legally.
01 / WHAT IS GEORGE
George is a Capture the Flag platform structured to follow the SkillsUSA Championships Cyber Security competition. Find the weakness, exploit it, grab the flag, score points. Every challenge maps to a vulnerability class the championship actually tests.
Challenges mirror the SkillsUSA competition category for category, so you train the way you'll be scored.
We run the competition environment itself, all virtually. Legal, safe, and built to be attacked.
These aren't simulations. You connect to live target environments, capture flags, and report them back to CTFd for scoring.
02 / HOW IT WORKS
Create your account on the George platform and join your school's team. Two minutes, no install.
Fifteen categories, from cross-site scripting to cryptography. Start easy, work up to the nasty ones.
Connect to the live environment, break in, find the flag, and report it back to CTFd. Points land instantly on the leaderboard.
Sharpen up year-round, then bring it to the SkillsUSA Arizona Cyber Security competition.
03 / YOUR FIRST FLAG
A local API is exposing something it should not. Use your browser's developer tools to request the endpoint, recover the flag, and submit it below.
The browser can make requests that are not represented by buttons on a page. Use the DevTools Console to query George's local challenge API.
fetch() to request the endpoint in the terminal.george{...} flag.GEORGE LOCAL API // RECON BRIEF
Run this from the DevTools Console on this page. There is no reveal button and the response is not loaded by the page.
fetch('/challenge-api/console-recon.json')
.then(response => response.json())
.then(data => console.log(data))TIP If the browser warns you about pasting code, type the command manually. Never paste console code you do not understand.
04 / THE CHALLENGE MAP
Every category below is scored in the SkillsUSA Arizona contest, and every one has practice challenges on George.
Get where you shouldn't, then learn to lock the door behind you.
Find leaked secrets and learn how confidential data escapes.
Inject scripts into pages other people trust, then learn to shut it down.
Default passwords, open panels, sloppy settings. Exploit, then fix.
Send users somewhere they never meant to go.
Feed apps input they never expected and watch the rules break.
SQL, command, and beyond. Make the server run your code.
Weak logins, bad sessions, guessable tokens. Become anyone.
Crack weak crypto and learn what strong encryption really takes.
Bypass rate limits and bot defenses, then reinforce them.
Hidden isn't secure. Prove it.
Turn an innocent XML parser into a file-reading machine.
Outdated libraries are open doors. Find them before attackers do.
Smuggle code inside serialized data and detonate it server-side.
Everything else: puzzles that demand a broad understanding of cybersecurity principles. The tiebreakers.
05 / SKILLSUSA PREP HUB
Use these field notes as your competition checklist. Every topic maps directly to a George challenge category.
Recognize: changing a URL, ID, role, or request reveals another user's data.
Practice: intercept a request and test whether the server checks ownership, not just whether you are logged in.
Defend: deny by default and enforce authorization server-side on every request.
Recognize: secrets in source, logs, backups, URLs, responses, or unencrypted traffic.
Practice: inspect page source, network responses, headers, and common backup filenames.
Defend: collect less, encrypt appropriately, redact logs, and never ship secrets to clients.
Recognize: user-controlled input returns to HTML without safe encoding.
Practice: trace input into HTML, attributes, URLs, and JavaScript contexts.
Defend: use contextual output encoding, safe DOM APIs, sanitization, and CSP as backup.
Recognize: default credentials, debug pages, directory listings, verbose errors, or unnecessary services.
Practice: enumerate before exploiting; record versions, headers, routes, and exposed panels.
Defend: maintain secure baselines, minimize features, patch, and continuously verify configuration.
Recognize: a query parameter controls where the browser goes next.
Practice: test absolute URLs, encoded URLs, protocol-relative paths, and parser edge cases.
Defend: use fixed destinations or strict allowlists and show users external destinations.
Recognize: the application trusts type, length, range, or format supplied by a client.
Practice: try empty, oversized, negative, duplicate, encoded, and unexpected values.
Defend: validate on the server with allowlists, schemas, bounds, and consistent normalization.
Recognize: input changes the meaning of a database, shell, template, or directory query.
Practice: identify the interpreter, then test syntax carefully and observe errors or behavior changes.
Defend: use parameterized APIs, avoid shell composition, validate input, and limit service privileges.
Recognize: weak reset flows, predictable tokens, reusable sessions, or missing rate limits.
Practice: map login, logout, recovery, registration, and session lifecycle as one system.
Defend: use proven identity libraries, MFA, secure cookies, token rotation, and throttling.
Recognize: obsolete algorithms, reused nonces, weak randomness, hardcoded keys, or encoding mistaken for encryption.
Practice: identify the primitive and assumptions before reaching for a cracking tool.
Defend: use modern libraries and protocols, protect keys, and never design custom crypto.
Recognize: sensitive actions can be repeated rapidly without meaningful controls.
Practice: replay requests responsibly and observe limits by account, session, IP, and action.
Defend: combine rate limits, detection, step-up verification, and safe failure behavior.
Recognize: protection depends on attackers not discovering a route, filename, algorithm, or client-side check.
Practice: enumerate routes, scripts, metadata, archives, and predictable names.
Defend: assume implementation details become public and require real authentication and authorization.
Recognize: an XML parser accepts document type declarations or resolves external entities.
Practice: identify XML inputs and parser behavior before testing controlled entity references.
Defend: disable DTDs and external entities, use safer formats, and restrict parser network and file access.
Recognize: exposed version information maps to a known vulnerability or unsafe dependency.
Practice: inventory components, verify versions, and read advisories before attempting an exploit.
Defend: remove unused dependencies, monitor advisories, pin safely, test, and patch promptly.
Recognize: untrusted serialized objects are accepted and reconstructed by the server.
Practice: identify format signatures and whether client-controlled data selects types or behavior.
Defend: avoid native object deserialization, use simple schemas, authenticate data, and isolate processing.
Recognize: clues may require Linux, networking, scripting, file analysis, encoding, or creative pivots.
Practice: document observations, identify file types, automate repetition, and collaborate clearly.
Defend: build broad fundamentals and use evidence, not guesses, to narrow the problem.
No matching topic. Try a broader security term.
Every flag you capture on George is a vulnerability you'll recognize for the rest of your career.
06 / THE COMPETITION
The Arizona competition is run as a Capture the Flag event across the fifteen vulnerability classes above. George is where you train for it, with the same categories and the same style of challenge, all season long.
07 / FOR SCHOOLS & COACHES
No cyber range to build and no offensive-security background required. George gives chapters a safe place to practice the skills used in competition.
No. George includes beginner entry points and room to progress. Comfort using a browser and curiosity are enough to start.
A modern browser and reliable internet connection cover the basic experience. Some advanced exercises may benefit from a school-approved Linux environment and standard security tools.
George challenges are isolated environments created to be tested. Students must only attack assigned challenge targets and follow their school, competition, and platform rules.
A weekly 45-90 minute session works well. Chapters can also use short category drills or focused practice blocks before competition.
Coach accounts are intended to provide team-level visibility into participation, solves, and category progress so you can identify where students need support.
George is a practice platform structured around the same fifteen vulnerability categories used by the Arizona Cyber Security contest. Always use official SkillsUSA materials for current eligibility and event rules.
08 / PARTNERS
George runs alongside SkillsUSA Arizona with university and industry partners who mentor students, author challenges, and open doors into cybersecurity careers.
George
SkillsUSA Arizona
Grand Canyon University
West-MEC
Want your organization in this lineup? Sponsor a prize pool, judge a track, or co-author a challenge set.
Partner with GeorgeStudents, coaches, and chapters across Arizona: George is open. Bring your curiosity; we'll supply the vulnerabilities.