diff --git a/scenarios/ctf/administration_woes.xml b/scenarios/ctf/administration_woes.xml
new file mode 100644
index 000000000..c52ac8a21
--- /dev/null
+++ b/scenarios/ctf/administration_woes.xml
@@ -0,0 +1,103 @@
+
+
+
+
+ Automation Woes
+ James Davis
+
+ There is a process hosted on a remote server that is vulnerable to exploit.
+ Find a way in then escalate to root.
+
+
+ ctf
+ attack-ctf
+ intermediate
+
+
+ EXPLOITATION
+ EXPLOITATION FRAMEWORKS
+
+
+ CVEs and CWEs
+
+
+ PENETRATION TESTING - SOFTWARE TOOLS
+ PENETRATION TESTING - ACTIVE PENETRATION
+
+
+ server-side misconfiguration and vulnerable components
+ Serialized objects
+
+
+
+ access control
+ Elevated privileges
+ Vulnerabilities and attacks on access control misconfigurations
+
+
+ Access controls and operating systems
+ Linux security model
+
+
+
+ server
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ IP_addresses
+
+
+
+
+
+ attack_vm
+
+
+
+
+ 172.16.0.2
+
+ 172.16.0.3
+
+
+
+
+
+ {"username":"root","password":"toor","super_user":"","strings_to_leak":[],"leaked_filenames":[]}
+
+
+ false
+
+
+
+
+
+
+
+
+
+
+ IP_addresses
+
+
+
+
+
\ No newline at end of file
diff --git a/scenarios/ctf/catching_sparks.xml b/scenarios/ctf/catching_sparks.xml
new file mode 100644
index 000000000..0bdfe6b1d
--- /dev/null
+++ b/scenarios/ctf/catching_sparks.xml
@@ -0,0 +1,99 @@
+
+
+
+
+ Catching Sparks
+ James Davis
+
+ A web vulnerability allows access to a server remotely. Find the website
+ and gain root privilege.
+
+
+ ctf
+ attack-ctf
+ intermediate
+
+
+ server-side misconfiguration and vulnerable components
+ Command injection
+
+
+ EXPLOITATION
+ EXPLOITATION FRAMEWORKS
+
+
+ CVEs and CWEs
+
+
+ PENETRATION TESTING - SOFTWARE TOOLS
+ PENETRATION TESTING - ACTIVE PENETRATION
+
+
+ kill chains
+
+
+ cyber kill chain
+
+
+
+ server
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ IP_addresses
+
+
+
+
+
+ attack_vm
+
+
+
+
+ 172.16.0.2
+
+ 172.16.0.3
+
+
+
+
+
+ {"username":"root","password":"toor","super_user":"","strings_to_leak":[],"leaked_filenames":[]}
+
+
+ false
+
+
+
+
+
+
+
+
+
+
+ IP_addresses
+
+
+
+
+
\ No newline at end of file
diff --git a/scenarios/ctf/erlang_explosion.xml b/scenarios/ctf/erlang_explosion.xml
new file mode 100644
index 000000000..0e4975248
--- /dev/null
+++ b/scenarios/ctf/erlang_explosion.xml
@@ -0,0 +1,105 @@
+
+
+
+
+ Erlang Explosion
+ James Davis
+
+ A vulnerable service utilises erlang that has a fatal flaw.
+ Exploit the server and get root access.
+
+
+ ctf
+ attack-ctf
+ intermediate
+
+
+ server-side misconfiguration and vulnerable components
+ Vulnerable defaults
+
+
+ EXPLOITATION
+ EXPLOITATION FRAMEWORKS
+
+
+ CVEs and CWEs
+
+
+ PENETRATION TESTING - SOFTWARE TOOLS
+ PENETRATION TESTING - ACTIVE PENETRATION
+
+
+
+ access control
+ Elevated privileges
+ Vulnerabilities and attacks on access control misconfigurations
+
+
+ Access controls and operating systems
+ Linux security model
+ Attacks against SUID
+
+
+
+
+ server
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ IP_addresses
+
+
+
+
+
+ attack_vm
+
+
+
+
+ 172.16.0.2
+
+ 172.16.0.3
+
+
+
+
+
+ {"username":"root","password":"toor","super_user":"","strings_to_leak":[],"leaked_filenames":[]}
+
+
+ false
+
+
+
+
+
+
+
+
+
+
+ IP_addresses
+
+
+
+
+
\ No newline at end of file
diff --git a/scenarios/ctf/eventful_data.xml b/scenarios/ctf/eventful_data.xml
new file mode 100644
index 000000000..d8c29077f
--- /dev/null
+++ b/scenarios/ctf/eventful_data.xml
@@ -0,0 +1,103 @@
+
+
+
+
+ Eventful Data
+ James Davis
+
+ There is a vulnerable webserver that can be exploited.
+ Find it and then get root.
+
+
+ ctf
+ attack-ctf
+ intermediate
+
+
+ server-side misconfiguration and vulnerable components
+
+
+ EXPLOITATION
+ EXPLOITATION FRAMEWORKS
+
+
+ CVEs and CWEs
+
+
+ PENETRATION TESTING - SOFTWARE TOOLS
+ PENETRATION TESTING - ACTIVE PENETRATION
+
+
+
+ access control
+ Elevated privileges
+ Vulnerabilities and attacks on access control misconfigurations
+
+
+ Access controls and operating systems
+ Linux security model
+ Attacks against SUDO
+
+
+
+ server
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ IP_addresses
+
+
+
+
+
+ attack_vm
+
+
+
+
+ 172.16.0.2
+
+ 172.16.0.3
+
+
+
+
+
+ {"username":"root","password":"toor","super_user":"","strings_to_leak":[],"leaked_filenames":[]}
+
+
+ false
+
+
+
+
+
+
+
+
+
+
+ IP_addresses
+
+
+
+
+
\ No newline at end of file
diff --git a/scenarios/ctf/manage_this.xml b/scenarios/ctf/manage_this.xml
new file mode 100644
index 000000000..0ad6d8ad4
--- /dev/null
+++ b/scenarios/ctf/manage_this.xml
@@ -0,0 +1,96 @@
+
+
+
+
+ Manage this!
+ James Davis
+
+ A vulnerable website is active on a server. Find a way in and obtain root.
+
+
+ ctf
+ attack-ctf
+ intermediate
+
+
+ server-side misconfiguration and vulnerable components
+ Command injection
+
+
+ EXPLOITATION
+ EXPLOITATION FRAMEWORKS
+ BACKDOOR TROJANS
+
+
+ CVEs and CWEs
+
+
+ PENETRATION TESTING - SOFTWARE TOOLS
+ PENETRATION TESTING - ACTIVE PENETRATION
+
+
+ FILE - TRANSFER PROTOCOL (FTP)
+
+
+
+ server
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ IP_addresses
+
+
+
+
+
+ attack_vm
+
+
+
+
+ 172.16.0.2
+
+ 172.16.0.3
+
+
+
+
+
+ {"username":"root","password":"toor","super_user":"","strings_to_leak":[],"leaked_filenames":[]}
+
+
+ false
+
+
+
+
+
+
+
+
+
+
+ IP_addresses
+
+
+
+
+
\ No newline at end of file