diff --git a/docker-compose.dev.yaml b/docker-compose.dev.yaml
new file mode 100644
index 00000000..1cb756aa
--- /dev/null
+++ b/docker-compose.dev.yaml
@@ -0,0 +1,14 @@
+# Minimal dev setup - landing page only (for UI testing)
+services:
+  landing:
+    build:
+      context: .
+      dockerfile: software/landing/Dockerfile
+    restart: "no"
+    mem_limit: 128m
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    network_mode: host
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
diff --git a/software/OpenPLC/Dockerfile b/software/OpenPLC/Dockerfile
index 8ec97985..569c3f80 100644
--- a/software/OpenPLC/Dockerfile
+++ b/software/OpenPLC/Dockerfile
@@ -4,7 +4,9 @@ COPY ./OpenPLC_v3/ /CybICS/OpenPLC_v3/
 WORKDIR /CybICS/OpenPLC_v3/
 RUN export GNUMAKEFLAGS=-j$(nproc --all) \
     && alias make='make -j$(nproc --all)' \
-    && ./install.sh docker
+    && ./install.sh docker \
+    && apt-get update && apt-get install -y --no-install-recommends iptables \
+    && rm -rf /var/lib/apt/lists/*
 
 # copy files after compile the main part to reduce re-compile time on changes on cybICS.st
 WORKDIR /CybICS/OpenPLC_v3/webserver
diff --git a/software/ids/detector.py b/software/ids/detector.py
index ad458dd2..a46f4574 100644
--- a/software/ids/detector.py
+++ b/software/ids/detector.py
@@ -311,7 +311,7 @@ def start_evasion(self):
             }
         self.evasion_active = True
         self.evasion_start_time = time.time()
-        self.evasion_start_alert_count = self.stats["alerts_total"]
+        self.evasion_start_alert_id = self._alert_id
         self.evasion_modbus_writes = 0
         logger.info("Evasion challenge started")
         return {
@@ -329,7 +329,9 @@ def check_evasion(self):
             }
 
         elapsed = time.time() - self.evasion_start_time
-        new_alerts = self.stats["alerts_total"] - self.evasion_start_alert_count
+        # Count only attacker-relevant alerts (exclude background arp_spoof noise)
+        evasion_alerts = self.get_alerts(since_id=self.evasion_start_alert_id)
+        new_alerts = sum(1 for a in evasion_alerts if a.get("rule") != "arp_spoof")
 
         if elapsed > self.evasion_timeout:
             self.evasion_active = False
diff --git a/software/ids/ids_server.py b/software/ids/ids_server.py
index e3568286..10c6cc7b 100644
--- a/software/ids/ids_server.py
+++ b/software/ids/ids_server.py
@@ -33,6 +33,12 @@
 FORENSICS_MIN_ALERTS = 5  # minimum alerts for forensics challenge
 FORENSICS_MIN_RULES = 3  # minimum distinct rule types for forensics
 
+# Per-rule CTF flags — revealed when the specific rule has been triggered
+CTF_RULE_FLAGS = {
+    "port_scan": "CybICS(sc4n_d3tect3d)",
+    "modbus_flood": "CybICS(m0dbus_fl00d_d3tect3d)",
+}
+
 
 # ========== API ROUTES ==========
 
@@ -152,11 +158,15 @@ def rules_stats():
     result = {}
     for rule, s in stats.items():
         top = sorted(s["sources"].items(), key=lambda x: x[1], reverse=True)[:5]
-        result[rule] = {
+        entry = {
             "count": s["count"],
             "last_seen": s["last_seen"],
             "top_sources": [{"ip": ip, "count": c} for ip, c in top],
         }
+        # Reveal CTF flag if the rule has been triggered
+        if s["count"] > 0 and rule in CTF_RULE_FLAGS:
+            entry["flag"] = CTF_RULE_FLAGS[rule]
+        result[rule] = entry
 
     return jsonify(result)
 
diff --git a/software/ids/rules.py b/software/ids/rules.py
index adc3b710..0ff82e65 100644
--- a/software/ids/rules.py
+++ b/software/ids/rules.py
@@ -172,11 +172,10 @@ def _check_syn(self, pkt, src_ip, dport, now, alerts):
             tracker[port_key] = {}
         ports = tracker[port_key]
         ports[dport] = now
-        # Prune expired (only when dict grows, amortized)
-        if len(ports) > self.PORT_SCAN_THRESHOLD + 5:
-            cutoff = now - self.PORT_SCAN_WINDOW
-            tracker[port_key] = {p: t for p, t in ports.items() if t >= cutoff}
-            ports = tracker[port_key]
+        # Prune expired entries before checking threshold
+        cutoff = now - self.PORT_SCAN_WINDOW
+        tracker[port_key] = {p: t for p, t in ports.items() if t >= cutoff}
+        ports = tracker[port_key]
         unique_ports = len(ports)
         if unique_ports >= self.PORT_SCAN_THRESHOLD:
             if self._should_alert("port_scan", src_ip, now):
diff --git a/software/landing/app.py b/software/landing/app.py
index ac8a81ca..e190e2e0 100644
--- a/software/landing/app.py
+++ b/software/landing/app.py
@@ -206,7 +206,7 @@ def challenge_detail(challenge_id):
         logger.warning(f'Challenge not found: {challenge_id}')
         return "Challenge not found", 404
 
-    # Load training content if available
+    # Load training content
     training_content = ""
     if 'training_content' in challenge:
         training_content = ctf_manager.load_markdown_content(challenge['training_content'])
@@ -215,7 +215,38 @@ def challenge_detail(challenge_id):
                          challenge=challenge,
                          category=category,
                          training_content=training_content,
-                         solved=challenge_id in session['solved_challenges'])
+                         solved=challenge_id in session['solved_challenges'],
+                         challenge_type=challenge.get('type', 'offensive'))
+
+@app.route('/ctf/verify/<challenge_id>', methods=['POST'])
+def verify_defense(challenge_id):
+    """Verify a defense challenge and auto-submit flag on success"""
+    initialize_session()
+
+    current_progress = get_current_progress()
+
+    # Check if already solved
+    if challenge_id in current_progress.get('solved_challenges', []):
+        return jsonify({'success': True, 'message': 'Challenge already solved!', 'checks': []})
+
+    # Run verification
+    result = ctf_manager.verify_defense(challenge_id)
+
+    # If verification passed, auto-submit the flag
+    if result.get('success') and result.get('flag'):
+        submit_result = ctf_manager.submit_flag(challenge_id, result['flag'], current_progress)
+        if submit_result['success']:
+            session['solved_challenges'].append(challenge_id)
+            session['total_points'] += submit_result['points']
+            session.modified = True
+            ctf_manager.save_progress({
+                'solved_challenges': session['solved_challenges'],
+                'total_points': session['total_points']
+            })
+            result['points'] = submit_result['points']
+            result['message'] = f"{result['message']} You earned {submit_result['points']} points!"
+
+    return jsonify(result)
 
 @app.route('/ctf/submit', methods=['POST'])
 def submit_flag():
diff --git a/software/landing/ctf_config.json b/software/landing/ctf_config.json
index 0f22fbef..c5fb48d8 100644
--- a/software/landing/ctf_config.json
+++ b/software/landing/ctf_config.json
@@ -11,6 +11,7 @@
           "title": "Understanding the Physical Process",
           "description": "Learn about industrial processes and control systems",
           "points": 100,
+          "tag": "analysis",
           "flag": "CybICS(Bl0w0ut)",
           "hint": "Examine the physical process simulation and look for anomalies",
           "training_content": "training/physical_process/README.md"
@@ -20,6 +21,7 @@
           "title": "PLC Programming",
           "description": "Introduction to PLC programming and control logic",
           "points": 150,
+          "tag": "analysis",
           "flag": "CybICS(ladder_logic_modified)",
           "hint": "Look for backdoors or unauthorized modifications in the ladder logic",
           "training_content": "training/plc_programming/README.md"
@@ -35,6 +37,7 @@
           "title": "Service Scanning",
           "description": "Discover network services and open ports",
           "points": 100,
+          "tag": "recon",
           "flag": "CybICS(scanning_d0ne)",
           "hint": "Use network scanning tools to discover open ports and services",
           "training_content": "training/scanning/README.md"
@@ -44,15 +47,17 @@
           "title": "S7comm Scanning",
           "description": "Analyze Siemens S7 communication",
           "points": 150,
+          "tag": "recon",
           "flag": "CybICS(s7comm_analysis_complete)",
           "hint": "Focus on Siemens S7 protocol communication patterns",
           "training_content": "training/scanning2/README.md"
         },
         {
-          "id": "wireshark_capture", 
+          "id": "wireshark_capture",
           "title": "Wireshark Capture",
           "description": "Learn network traffic analysis",
           "points": 200,
+          "tag": "analysis",
           "flag": "CybICS(m0dbu$)",
           "hint": "Look for unusual protocols or data patterns in network traffic",
           "training_content": "training/wireshark_capture/README.md"
@@ -60,7 +65,7 @@
       ]
     },
     "security_testing": {
-      "name": "🛡️ Security Testing",
+      "name": "⚔️ Security Testing",
       "description": "Test system resilience and security mechanisms",
       "challenges": [
         {
@@ -68,6 +73,7 @@
           "title": "Flood & Overwrite",
           "description": "Test system resilience against flooding attacks",
           "points": 200,
+          "tag": "exploit",
           "flag": "CybICS(flood_attack_successful)",
           "hint": "Overwhelm the system with excessive requests or data",
           "training_content": "training/flood_overwrite/README.md"
@@ -77,6 +83,7 @@
           "title": "Password Attack",
           "description": "Practice password security testing",
           "points": 150,
+          "tag": "exploit",
           "flag": "CybICS(FU##A)",
           "hint": "Look for common passwords in authentication attempts",
           "training_content": "training/password_attack/README.md"
@@ -86,6 +93,7 @@
           "title": "OPC-UA",
           "description": "Explore OPC-UA protocol security",
           "points": 250,
+          "tag": "exploit",
           "flag": "CybICS(OPC-UA-$ADMIN)",
           "hint": "Check for default credentials or weak authentication",
           "training_content": "training/opcua/README.md"
@@ -95,6 +103,7 @@
           "title": "Fuzzing Modbus",
           "description": "Test Modbus protocol robustness",
           "points": 300,
+          "tag": "exploit",
           "flag": "CybICS(modbus_fuzzing_complete)",
           "hint": "Send malformed or unexpected data to test protocol handling",
           "training_content": "training/fuzzingMB/README.md"
@@ -103,49 +112,60 @@
     },
     "advanced_security": {
       "name": "🔐 Advanced Security",
-      "description": "Advanced security techniques and detection methods",
+      "description": "Advanced attack and detection techniques",
       "challenges": [
         {
           "id": "mitm",
           "title": "Man-in-the-Middle (MitM)",
           "description": "Learn about network interception",
           "points": 350,
+          "tag": "exploit",
           "flag": "CybICS(mitm_attack_successful)",
           "hint": "Position yourself between communicating devices",
           "training_content": "training/mitm/README.md"
         },
         {
           "id": "uart_basic",
-          "title": "UART Training Guide (Hardware Required)",
-          "description": "Hardware-level communication",
+          "title": "UART Training Guide",
+          "description": "Hardware-level communication (requires hardware)",
           "points": 300,
+          "tag": "hardware",
           "flag": "CybICS(U#RT)",
           "hint": "Monitor serial communications for credentials or commands",
           "training_content": "training/uart_basic/README.md"
         },
         {
           "id": "detect_basic",
-          "title": "Detect Basic",
-          "description": "Basic intrusion detection",
+          "title": "Detect Port Scan",
+          "description": "Perform a port scan and verify the IDS detected it — find the flag in the IDS rule stats",
           "points": 250,
-          "flag": "CybICS(basic_detection_complete)",
-          "hint": "Identify basic attack patterns and signatures",
+          "tag": "analysis",
+          "flag": "CybICS(sc4n_d3tect3d)",
+          "hint": "Run a port scan, then query the IDS at /api/rules/stats — the flag appears when the port_scan rule has fired",
           "training_content": "training/detect_basic/README.md"
         },
         {
           "id": "detect_overwrite",
-          "title": "Detect Overwrite",
-          "description": "Advanced detection techniques",
+          "title": "Detect Modbus Flooding",
+          "description": "Launch a Modbus flooding attack, analyze it with the IDS, and find the flag in the rule stats",
           "points": 400,
-          "flag": "CybICS(detection_evasion_complete)",
-          "hint": "Understand how security systems detect attacks and find ways to bypass them",
+          "tag": "analysis",
+          "flag": "CybICS(m0dbus_fl00d_d3tect3d)",
+          "hint": "Run the override script, then query /api/rules/stats — the flag appears when the modbus_flood rule fires",
           "training_content": "training/detect_overwrite/README.md"
-        },
+        }
+      ]
+    },
+    "ids_challenges": {
+      "name": "🔍 IDS Challenges",
+      "description": "Interact with the Intrusion Detection System — trigger alerts, analyze incidents, and evade detection",
+      "challenges": [
         {
           "id": "ids_challenge",
           "title": "IDS Challenge",
           "description": "Trigger the intrusion detection system by performing attacks and retrieve the flag",
           "points": 300,
+          "tag": "exploit",
           "flag": "CybICS(1ntrusi0n_d3tect3d)",
           "hint": "Perform multiple different attacks and check the IDS flag endpoint",
           "training_content": "training/ids_challenge/README.md"
@@ -153,8 +173,9 @@
         {
           "id": "ids_forensics",
           "title": "IDS Forensics",
-          "description": "Analyze IDS alert data to investigate a security incident and answer forensic questions",
+          "description": "Analyze IDS alert data to investigate a security incident",
           "points": 250,
+          "tag": "analysis",
           "flag": "CybICS(f0r3ns1c_4n4lyst)",
           "hint": "Use the /api/summary and /api/alerts endpoints to gather data about the incident",
           "training_content": "training/ids_forensics/README.md"
@@ -162,13 +183,80 @@
         {
           "id": "ids_evasion",
           "title": "IDS Evasion",
-          "description": "Perform a stealth Modbus write operation without triggering any IDS alerts",
+          "description": "Perform a stealth Modbus write without triggering any IDS alerts",
           "points": 400,
+          "tag": "evasion",
           "flag": "CybICS(st34lth_0p3r4t0r)",
           "hint": "Study the IDS detection thresholds on the Rules tab and send writes slowly",
           "training_content": "training/ids_evasion/README.md"
         }
       ]
+    },
+    "defense": {
+      "name": "🛡️ Defense & Hardening",
+      "description": "Harden the ICS environment by applying defensive security measures",
+      "challenges": [
+        {
+          "id": "defense_openplc_password",
+          "title": "Harden OpenPLC Credentials",
+          "description": "Change the default OpenPLC password to prevent unauthorized access",
+          "points": 150,
+          "tag": "defense",
+          "type": "defense",
+          "verify_module": "check_openplc_password",
+          "flag": "CybICS(0penPLC_h4rd3n3d)",
+          "hint": "Log into the OpenPLC web UI at port 8080 and change the default password from 'openplc'",
+          "training_content": "training/defense_password/README.md"
+        },
+        {
+          "id": "defense_fuxa_password",
+          "title": "Harden FUXA Credentials",
+          "description": "Change the default FUXA admin password to prevent unauthorized HMI access",
+          "points": 150,
+          "tag": "defense",
+          "type": "defense",
+          "verify_module": "check_fuxa_password",
+          "flag": "CybICS(FUXA_s3cur3d)",
+          "hint": "Access FUXA at port 1881 and change the admin password from its default value",
+          "training_content": "training/defense_password/README.md"
+        },
+        {
+          "id": "defense_firewall",
+          "title": "Modbus Firewall Rules",
+          "description": "Restrict Modbus (port 502) access so only authorized systems can communicate with the PLC",
+          "points": 250,
+          "tag": "defense",
+          "type": "defense",
+          "verify_module": "check_firewall",
+          "flag": "CybICS(f1r3w4ll_h4rd3n3d)",
+          "hint": "Use iptables on the OpenPLC container to only allow 172.18.0.4 (FUXA) to access port 502",
+          "training_content": "training/defense_firewall/README.md"
+        },
+        {
+          "id": "defense_network_segmentation",
+          "title": "Network Segmentation",
+          "description": "Block the attack machine from reaching critical ICS services",
+          "points": 300,
+          "tag": "defense",
+          "type": "defense",
+          "verify_module": "check_network_segmentation",
+          "flag": "CybICS(n3tw0rk_s3gm3nt3d)",
+          "hint": "Block the attack machine (172.18.0.100) from accessing the PLC and OPC-UA server",
+          "training_content": "training/defense_network/README.md"
+        },
+        {
+          "id": "defense_ids_tuning",
+          "title": "IDS Monitoring & Tuning",
+          "description": "Ensure the IDS is running and actively detecting multiple types of attacks",
+          "points": 200,
+          "tag": "defense",
+          "type": "defense",
+          "verify_module": "check_ids_tuning",
+          "flag": "CybICS(1ds_tun3d)",
+          "hint": "Start the IDS, ensure it is capturing packets, and trigger at least 3 different detection rules",
+          "training_content": "training/defense_ids/README.md"
+        }
+      ]
     }
   }
-}
\ No newline at end of file
+}
diff --git a/software/landing/modules/ctf_manager.py b/software/landing/modules/ctf_manager.py
index 6ad97f29..b254d816 100644
--- a/software/landing/modules/ctf_manager.py
+++ b/software/landing/modules/ctf_manager.py
@@ -3,6 +3,7 @@
 """
 import json
 import os
+import importlib
 import markdown
 import re
 
@@ -94,7 +95,41 @@ def submit_flag(self, challenge_id, submitted_flag, current_progress):
             }
         else:
             logger.info(f"Incorrect flag submitted for {challenge_id}")
-            return {'success': False, 'message': 'Incorrect flag. Try again!'}
+            if not re.match(r'^CybICS\(.*\)$', submitted_flag.strip()):
+                return {'success': False, 'message': 'Incorrect format. Flags look like CybICS(...)'}
+            return {'success': False, 'message': 'Incorrect flag. The format is right, but the value is wrong.'}
+
+    def verify_defense(self, challenge_id):
+        """Run defense verification for a challenge.
+
+        Returns:
+            dict with keys: success, message, flag (if success), checks (list of check results)
+        """
+        challenge, _ = self.get_challenge(challenge_id)
+        if not challenge:
+            return {'success': False, 'message': 'Challenge not found', 'checks': []}
+
+        if challenge.get('type') != 'defense':
+            return {'success': False, 'message': 'Not a defense challenge', 'checks': []}
+
+        verify_module = challenge.get('verify_module')
+        if not verify_module:
+            return {'success': False, 'message': 'No verification module configured', 'checks': []}
+
+        try:
+            module = importlib.import_module(f'modules.defense_checks.{verify_module}')
+            result = module.verify()
+
+            if result.get('success'):
+                result['flag'] = challenge['flag']
+
+            return result
+        except ImportError as e:
+            logger.error(f"Could not load defense check module: {verify_module}: {e}")
+            return {'success': False, 'message': f'Verification module not found: {verify_module}', 'checks': []}
+        except Exception as e:
+            logger.error(f"Error running defense check {verify_module}: {e}", exc_info=True)
+            return {'success': False, 'message': f'Verification error: {str(e)}', 'checks': []}
 
     def reset_progress(self):
         """Reset all progress"""
@@ -117,6 +152,17 @@ def get_progress_stats(self, current_progress):
             'progress_percentage': (solved_count / total_challenges * 100) if total_challenges > 0 else 0
         }
 
+    @staticmethod
+    def extract_hint_from_html(html):
+        """Extract the 💡 Hint <details> block from rendered HTML and return (hint_html, cleaned_html)."""
+        pattern = r'<details[^>]*>\s*<summary[^>]*>[^<]*💡\s*Hint[^<]*</summary>(.*?)</details>'
+        match = re.search(pattern, html, re.DOTALL | re.IGNORECASE)
+        if match:
+            hint_html = match.group(1).strip()
+            cleaned = html[:match.start()] + html[match.end():]
+            return hint_html, cleaned
+        return None, html
+
     def load_markdown_content(self, relative_path):
         """Load and convert markdown content to HTML"""
         if not relative_path:
@@ -133,6 +179,21 @@ def load_markdown_content(self, relative_path):
                 markdown_content = re.sub(r'<summary>', '<summary markdown="1">', markdown_content)
                 markdown_content = re.sub(r'<div([^>]*)>', r'<div\1 markdown="1">', markdown_content)
 
+                # Dedent fenced code blocks so they render inside list items
+                def _dedent_fenced(m):
+                    indent = m.group(1)
+                    return '\n'.join(
+                        line[len(indent):] if line.startswith(indent) else line
+                        for line in m.group(0).split('\n')
+                    )
+
+                markdown_content = re.sub(
+                    r'^([ \t]+)(```\w*\n.*?\n[ \t]*```)',
+                    _dedent_fenced,
+                    markdown_content,
+                    flags=re.MULTILINE | re.DOTALL
+                )
+
                 # Convert markdown to HTML with extensions
                 html = markdown.markdown(markdown_content, extensions=[
                     'fenced_code',
diff --git a/software/landing/modules/defense_checks/__init__.py b/software/landing/modules/defense_checks/__init__.py
new file mode 100644
index 00000000..8256ed80
--- /dev/null
+++ b/software/landing/modules/defense_checks/__init__.py
@@ -0,0 +1 @@
+# Defense CTF verification checks
diff --git a/software/landing/modules/defense_checks/check_firewall.py b/software/landing/modules/defense_checks/check_firewall.py
new file mode 100644
index 00000000..b604a9e9
--- /dev/null
+++ b/software/landing/modules/defense_checks/check_firewall.py
@@ -0,0 +1,90 @@
+"""
+Defense check: Verify firewall rules restrict Modbus (port 502) access on OpenPLC.
+"""
+import subprocess
+import socket
+from utils.logger import logger
+
+OPENPLC_IP = "172.18.0.3"
+MODBUS_PORT = 502
+
+
+def _get_openplc_container():
+    """Find the OpenPLC container name dynamically."""
+    try:
+        result = subprocess.run(
+            ["docker", "ps", "--format", "{{.Names}}"],
+            capture_output=True, text=True, timeout=5
+        )
+        for name in result.stdout.strip().split('\n'):
+            if 'openplc' in name.lower():
+                return name
+    except Exception as e:
+        logger.error(f"Error finding OpenPLC container: {e}")
+    return None
+
+
+def verify():
+    """Check that iptables rules restrict Modbus access on the OpenPLC container."""
+    checks = []
+
+    # Check 1: Verify iptables rules exist on the OpenPLC container
+    container = _get_openplc_container()
+    if not container:
+        checks.append({
+            "name": "OpenPLC container found",
+            "passed": False,
+            "detail": "Cannot find a running OpenPLC container"
+        })
+        return {"success": False, "message": "OpenPLC container not found", "checks": checks}
+
+    try:
+        result = subprocess.run(
+            ["docker", "exec", container, "iptables", "-L", "INPUT", "-n"],
+            capture_output=True, text=True, timeout=10
+        )
+        has_rules = ("DROP" in result.stdout or "REJECT" in result.stdout)
+        checks.append({
+            "name": "Firewall rules configured",
+            "passed": has_rules,
+            "detail": "iptables rules with DROP/REJECT found on OpenPLC"
+            if has_rules
+            else "No restrictive iptables rules found on OpenPLC container"
+        })
+    except Exception as e:
+        checks.append({
+            "name": "Firewall rules configured",
+            "passed": False,
+            "detail": f"Could not check iptables: {e}"
+        })
+
+    # Check 2: Verify Modbus port is NOT accessible from this host (unauthorized source)
+    try:
+        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        sock.settimeout(3)
+        result_code = sock.connect_ex((OPENPLC_IP, MODBUS_PORT))
+        sock.close()
+
+        blocked = result_code != 0
+        checks.append({
+            "name": "Modbus blocked from unauthorized hosts",
+            "passed": blocked,
+            "detail": "Port 502 is blocked from this host"
+            if blocked
+            else "Port 502 is still accessible from unauthorized hosts"
+        })
+    except Exception as e:
+        # Connection failed = good, it's blocked
+        checks.append({
+            "name": "Modbus blocked from unauthorized hosts",
+            "passed": True,
+            "detail": f"Connection attempt failed (blocked): {e}"
+        })
+
+    success = all(c["passed"] for c in checks)
+    message = ("Modbus firewall rules correctly applied!"
+               if success
+               else "Firewall configuration incomplete. "
+                    "Add iptables rules on the OpenPLC container to restrict port 502 access.")
+
+    return {"success": success, "message": message, "checks": checks}
diff --git a/software/landing/modules/defense_checks/check_fuxa_password.py b/software/landing/modules/defense_checks/check_fuxa_password.py
new file mode 100644
index 00000000..e2bc576d
--- /dev/null
+++ b/software/landing/modules/defense_checks/check_fuxa_password.py
@@ -0,0 +1,54 @@
+"""
+Defense check: Verify FUXA default admin password has been changed.
+"""
+import requests
+from utils.logger import logger
+
+FUXA_URL = "http://172.18.0.4:1881"
+DEFAULT_USER = "admin"
+DEFAULT_PASS = "123456"
+
+
+def verify():
+    """Check that the default FUXA admin credentials no longer work."""
+    checks = []
+
+    try:
+        resp = requests.post(
+            f"{FUXA_URL}/api/signin",
+            json={"username": DEFAULT_USER, "password": DEFAULT_PASS},
+            timeout=10
+        )
+
+        # FUXA returns 200 with user data on success,
+        # or 200 with error message on failure
+        default_works = (resp.status_code == 200
+                         and "error" not in resp.text.lower()
+                         and resp.text.strip() != "")
+
+        checks.append({
+            "name": "Default password disabled",
+            "passed": not default_works,
+            "detail": "Default admin/123456 credentials rejected"
+            if not default_works
+            else "Default credentials still work - change the password!"
+        })
+
+        success = not default_works
+        message = ("FUXA admin password has been changed!"
+                   if success
+                   else "FUXA still uses the default admin password (123456). "
+                        "Change it in the FUXA settings.")
+
+        return {"success": success, "message": message, "checks": checks}
+
+    except requests.exceptions.ConnectionError:
+        checks.append({
+            "name": "FUXA reachable",
+            "passed": False,
+            "detail": "Cannot connect to FUXA at port 1881"
+        })
+        return {"success": False, "message": "Cannot reach FUXA service", "checks": checks}
+    except Exception as e:
+        logger.error(f"FUXA password check error: {e}")
+        return {"success": False, "message": f"Verification error: {e}", "checks": checks}
diff --git a/software/landing/modules/defense_checks/check_ids_tuning.py b/software/landing/modules/defense_checks/check_ids_tuning.py
new file mode 100644
index 00000000..3a1d93a8
--- /dev/null
+++ b/software/landing/modules/defense_checks/check_ids_tuning.py
@@ -0,0 +1,78 @@
+"""
+Defense check: Verify IDS is running and actively detecting threats.
+"""
+import requests
+from utils.logger import logger
+
+IDS_URL = "http://localhost:8443"
+
+
+def verify():
+    """Check that the IDS is running, capturing, and has detected multiple attack types."""
+    checks = []
+
+    try:
+        # Check 1: IDS is running
+        try:
+            resp = requests.get(f"{IDS_URL}/health", timeout=5)
+            ids_running = resp.status_code == 200
+        except requests.exceptions.ConnectionError:
+            ids_running = False
+
+        checks.append({
+            "name": "IDS is running",
+            "passed": ids_running,
+            "detail": "IDS service is operational"
+            if ids_running
+            else "IDS service is not responding at port 8443"
+        })
+
+        if not ids_running:
+            return {
+                "success": False,
+                "message": "IDS is not running. Start it from the IDS dashboard.",
+                "checks": checks
+            }
+
+        # Check 2: IDS is actively capturing packets
+        resp = requests.get(f"{IDS_URL}/api/status", timeout=5)
+        status = resp.json()
+        is_capturing = status.get("active", False)
+        checks.append({
+            "name": "IDS detection active",
+            "passed": is_capturing,
+            "detail": "IDS is actively monitoring network traffic"
+            if is_capturing
+            else "IDS packet capture is not started"
+        })
+
+        # Check 3: Multiple detection rules have been triggered
+        resp = requests.get(f"{IDS_URL}/api/rules/stats", timeout=5)
+        rules_data = resp.json()
+
+        # Count rules that have triggered at least once
+        if isinstance(rules_data, dict):
+            active_rules = sum(
+                1 for r in rules_data.values()
+                if isinstance(r, dict) and r.get("count", 0) > 0
+            )
+        else:
+            active_rules = 0
+
+        checks.append({
+            "name": "Multiple detection rules triggered",
+            "passed": active_rules >= 3,
+            "detail": f"{active_rules} rule(s) have triggered alerts (need at least 3)"
+        })
+
+        success = all(c["passed"] for c in checks)
+        message = ("IDS is properly configured and detecting threats!"
+                   if success
+                   else "IDS needs further tuning. Ensure it is running, "
+                        "capturing packets, and has detected at least 3 different attack types.")
+
+        return {"success": success, "message": message, "checks": checks}
+
+    except Exception as e:
+        logger.error(f"IDS tuning check error: {e}")
+        return {"success": False, "message": f"Verification error: {e}", "checks": checks}
diff --git a/software/landing/modules/defense_checks/check_network_segmentation.py b/software/landing/modules/defense_checks/check_network_segmentation.py
new file mode 100644
index 00000000..9ddf6fae
--- /dev/null
+++ b/software/landing/modules/defense_checks/check_network_segmentation.py
@@ -0,0 +1,83 @@
+"""
+Defense check: Verify that target containers have iptables rules blocking the attack machine.
+"""
+import subprocess
+from utils.logger import logger
+
+ATTACK_IP = "172.18.0.100"
+
+# (container keyword, ip, port, service name)
+TARGETS = [
+    ("openplc", "172.18.0.3", 8080, "OpenPLC Web UI"),
+    ("openplc", "172.18.0.3", 502, "Modbus TCP"),
+    ("opcua", "172.18.0.5", 4840, "OPC-UA Server"),
+]
+
+
+def _find_container(keyword):
+    """Find a container name containing the keyword."""
+    try:
+        result = subprocess.run(
+            ["docker", "ps", "--format", "{{.Names}}"],
+            capture_output=True, text=True, timeout=5
+        )
+        for name in result.stdout.strip().split('\n'):
+            if keyword in name.lower():
+                return name
+    except Exception as e:
+        logger.error(f"Error finding container '{keyword}': {e}")
+    return None
+
+
+def _check_iptables_rule(container, source_ip):
+    """Check if the container has an iptables DROP/REJECT rule for the given source IP."""
+    try:
+        result = subprocess.run(
+            ["docker", "exec", container, "iptables", "-L", "INPUT", "-n"],
+            capture_output=True, text=True, timeout=10
+        )
+        for line in result.stdout.split('\n'):
+            if source_ip in line and ('DROP' in line or 'REJECT' in line):
+                return True
+    except Exception as e:
+        logger.error(f"Error checking iptables on {container}: {e}")
+    return False
+
+
+def verify():
+    """Check that target containers have firewall rules blocking the attack machine."""
+    checks = []
+
+    # Group targets by container keyword to avoid repeated lookups
+    containers = {}
+    for keyword, ip, port, service_name in TARGETS:
+        if keyword not in containers:
+            containers[keyword] = _find_container(keyword)
+
+    for keyword, ip, port, service_name in TARGETS:
+        container = containers.get(keyword)
+        if not container:
+            checks.append({
+                "name": f"Block {service_name} ({ip}:{port})",
+                "passed": False,
+                "detail": f"Container '{keyword}' not found or not running"
+            })
+            continue
+
+        has_rule = _check_iptables_rule(container, ATTACK_IP)
+        checks.append({
+            "name": f"Block {service_name} ({ip}:{port})",
+            "passed": has_rule,
+            "detail": f"iptables DROP rule for {ATTACK_IP} found on {container}"
+            if has_rule
+            else f"No iptables rule blocking {ATTACK_IP} on {container}"
+        })
+
+    success = all(c["passed"] for c in checks)
+    message = ("Network segmentation correctly applied! "
+               "The target containers block traffic from the attack machine."
+               if success
+               else "Network segmentation incomplete. "
+                    "Add iptables rules on the target containers to block the attack machine.")
+
+    return {"success": success, "message": message, "checks": checks}
diff --git a/software/landing/modules/defense_checks/check_openplc_password.py b/software/landing/modules/defense_checks/check_openplc_password.py
new file mode 100644
index 00000000..d46cfeea
--- /dev/null
+++ b/software/landing/modules/defense_checks/check_openplc_password.py
@@ -0,0 +1,55 @@
+"""
+Defense check: Verify OpenPLC default password has been changed.
+"""
+import requests
+from utils.logger import logger
+
+OPENPLC_URL = "http://172.18.0.3:8080"
+DEFAULT_USER = "openplc"
+DEFAULT_PASS = "openplc"
+
+
+def verify():
+    """Check that the default OpenPLC credentials no longer work."""
+    checks = []
+
+    try:
+        # Try login with default credentials
+        session = requests.Session()
+        resp = session.post(
+            f"{OPENPLC_URL}/login",
+            data={"username": DEFAULT_USER, "password": DEFAULT_PASS},
+            allow_redirects=False,
+            timeout=10
+        )
+
+        # OpenPLC redirects to dashboard (302) on success,
+        # returns login page HTML (200) on failure
+        default_works = resp.status_code == 302
+
+        checks.append({
+            "name": "Default password disabled",
+            "passed": not default_works,
+            "detail": "Default openplc/openplc credentials rejected"
+            if not default_works
+            else "Default credentials still work - change the password!"
+        })
+
+        success = not default_works
+        message = ("OpenPLC password has been changed!"
+                   if success
+                   else "OpenPLC still uses default credentials. "
+                        "Change the password via the OpenPLC web UI at port 8080 under Settings > Users.")
+
+        return {"success": success, "message": message, "checks": checks}
+
+    except requests.exceptions.ConnectionError:
+        checks.append({
+            "name": "OpenPLC reachable",
+            "passed": False,
+            "detail": "Cannot connect to OpenPLC at port 8080"
+        })
+        return {"success": False, "message": "Cannot reach OpenPLC service", "checks": checks}
+    except Exception as e:
+        logger.error(f"OpenPLC password check error: {e}")
+        return {"success": False, "message": f"Verification error: {e}", "checks": checks}
diff --git a/software/landing/templates/challenge.html b/software/landing/templates/challenge.html
index a961cc63..531c35f2 100644
--- a/software/landing/templates/challenge.html
+++ b/software/landing/templates/challenge.html
@@ -4,767 +4,882 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>CybICS - {{ challenge.title }}</title>
+    <!-- Syntax highlighting -->
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/styles/atom-one-dark.min.css">
     <style>
+        /* ===== Base ===== */
+        * { box-sizing: border-box; }
         body {
-            background-color: #1a1a1a;
-            color: #ffffff;
-            font-family: Arial, sans-serif;
-            margin: 0;
-            padding: 0;
-        }
-        
-        ::-webkit-scrollbar {
-            width: 8px;
-            height: 8px;
-        }
-        
-        ::-webkit-scrollbar-track {
             background: #1a1a1a;
+            color: #e0e0e0;
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+            margin: 0;
+            line-height: 1.6;
         }
-        
-        ::-webkit-scrollbar-thumb {
-            background: #404040;
-            border-radius: 4px;
-        }
-        
-        ::-webkit-scrollbar-thumb:hover {
-            background: #ff6b00;
-        }
-
-        .challenge-container {
-            background-color: #2d2d2d;
-            border: 1px solid #404040;
-            border-radius: 0.5rem;
-            padding: 2rem;
-            margin-bottom: 1.5rem;
-        }
-
-        .flag-input {
-            background-color: #404040;
-            border: 1px solid #606060;
-            border-radius: 0.375rem;
-            color: #ffffff;
-            padding: 0.75rem;
-            width: 100%;
-            font-family: monospace;
-        }
+        a { color: #ff6b00; }
+        a:hover { text-decoration: none; }
 
-        .flag-input:focus {
-            outline: none;
-            border-color: #ff6b00;
-        }
+        ::-webkit-scrollbar { width: 8px; height: 8px; }
+        ::-webkit-scrollbar-track { background: #1a1a1a; }
+        ::-webkit-scrollbar-thumb { background: #404040; border-radius: 4px; }
+        ::-webkit-scrollbar-thumb:hover { background: #ff6b00; }
 
-        .submit-button {
-            background-color: #ff6b00;
-            color: #1a1a1a;
-            border: none;
-            border-radius: 0.375rem;
+        /* ===== Header ===== */
+        header {
+            background: #2d2d2d;
+            border-bottom: 1px solid #404040;
             padding: 0.75rem 1.5rem;
-            font-weight: bold;
-            cursor: pointer;
-            transition: all 0.2s;
-        }
-
-        .submit-button:hover {
-            background-color: #e55d00;
-        }
-
-        .submit-button:disabled {
-            background-color: #606060;
-            cursor: not-allowed;
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+            position: sticky;
+            top: 0;
+            z-index: 100;
         }
+        header h1 { font-size: 1.25rem; margin: 0; color: #fff; }
+        .header-left { display: flex; align-items: center; gap: 1rem; }
+        .header-right { display: flex; align-items: center; gap: 0.5rem; flex-wrap: wrap; }
 
-        .back-button {
-            background-color: #404040;
+        .back-btn {
             color: #ff6b00;
+            text-decoration: none;
+            font-size: 0.85rem;
+            padding: 0.35rem 0.75rem;
             border: 1px solid #ff6b00;
             border-radius: 0.25rem;
-            padding: 0.5rem 1rem;
-            text-decoration: none;
-            display: inline-block;
-            transition: all 0.2s;
-        }
-
-        .back-button:hover {
-            background-color: #ff6b00;
-            color: #1a1a1a;
+            transition: all 0.15s;
+            white-space: nowrap;
         }
+        .back-btn:hover { background: #ff6b00; color: #1a1a1a; }
 
         .badge {
             display: inline-block;
-            padding: 0.25rem 0.5rem;
+            padding: 0.2rem 0.5rem;
             border-radius: 0.25rem;
-            font-size: 0.75rem;
-            font-weight: bold;
+            font-size: 0.7rem;
+            font-weight: 600;
+            text-transform: uppercase;
+            letter-spacing: 0.03em;
+        }
+        .badge-points { background: #ff6b00; color: #1a1a1a; }
+        .badge-solved { background: #22c55e; color: #fff; }
+        .badge-easy { background: rgba(34,197,94,0.15); color: #4ade80; }
+        .badge-medium { background: rgba(245,158,11,0.15); color: #fbbf24; }
+        .badge-hard { background: rgba(239,68,68,0.15); color: #f87171; }
+        .badge-tag-recon { background: rgba(139,92,246,0.15); color: #a78bfa; }
+        .badge-tag-exploit { background: rgba(239,68,68,0.15); color: #f87171; }
+        .badge-tag-analysis { background: rgba(59,130,246,0.15); color: #60a5fa; }
+        .badge-tag-evasion { background: rgba(245,158,11,0.15); color: #fbbf24; }
+        .badge-tag-defense { background: rgba(34,197,94,0.15); color: #4ade80; }
+        .badge-tag-hardware { background: rgba(236,72,153,0.15); color: #f472b6; }
+
+        /* ===== Layout: Sidebar + Content ===== */
+        .page-layout {
+            display: flex;
+            max-width: 1200px;
+            margin: 0 auto;
+            padding: 1.5rem;
+            gap: 2rem;
+        }
+
+        /* --- Sidebar --- */
+        .sidebar {
+            width: 220px;
+            flex-shrink: 0;
+            position: sticky;
+            top: 4rem;
+            max-height: calc(100vh - 5rem);
+            overflow-y: auto;
+            padding-right: 0.5rem;
+        }
+        .sidebar-title {
+            font-size: 0.7rem;
+            text-transform: uppercase;
+            letter-spacing: 0.08em;
+            color: #888;
+            margin-bottom: 0.75rem;
+            font-weight: 600;
         }
-
-        .badge-points {
-            background-color: #ff6b00;
-            color: #1a1a1a;
+        .toc-list {
+            list-style: none;
+            padding: 0;
+            margin: 0;
         }
-
-        .badge-solved {
-            background-color: #22c55e;
-            color: #ffffff;
+        .toc-list li { margin-bottom: 2px; }
+        .toc-link {
+            display: block;
+            padding: 0.35rem 0.75rem;
+            font-size: 0.8rem;
+            color: #999;
+            text-decoration: none;
+            border-left: 2px solid transparent;
+            border-radius: 0 0.25rem 0.25rem 0;
+            transition: all 0.15s;
+            line-height: 1.4;
         }
-
-        .hint-box {
-            background-color: #404040;
-            border-left: 4px solid #ff6b00;
-            padding: 1rem;
-            margin: 1rem 0;
-            border-radius: 0 0.375rem 0.375rem 0;
+        .toc-link:hover { color: #fff; background: rgba(255,255,255,0.05); }
+        .toc-link.active {
+            color: #ff6b00;
+            border-left-color: #ff6b00;
+            background: rgba(255,107,0,0.08);
         }
-
-        .message {
-            padding: 1rem;
-            border-radius: 0.375rem;
+        .sidebar-divider {
+            border: none;
+            border-top: 1px solid #333;
             margin: 1rem 0;
         }
-
-        .message.success {
-            background-color: #1a4d2e;
-            border: 1px solid #22c55e;
-            color: #22c55e;
-        }
-
-        .message.error {
-            background-color: #4d1a1a;
-            border: 1px solid #ef4444;
-            color: #ef4444;
-        }
-
-        /* Code block styling */
-        .training-content pre {
-            background-color: #1a1a1a;
-            border: 1px solid #404040;
+        .sidebar-action {
+            display: block;
+            text-align: center;
+            padding: 0.5rem;
+            font-size: 0.8rem;
+            font-weight: 600;
+            color: #ff6b00;
+            background: rgba(255,107,0,0.08);
+            border: 1px solid rgba(255,107,0,0.2);
             border-radius: 0.375rem;
-            padding: 1rem;
-            overflow-x: auto;
-            margin: 1rem 0;
+            text-decoration: none;
+            transition: all 0.15s;
         }
+        .sidebar-action:hover { background: rgba(255,107,0,0.15); }
 
-        .training-content code {
-            background-color: #404040;
-            color: #ff6b00;
-            padding: 0.25rem 0.5rem;
-            border-radius: 0.25rem;
-            font-family: 'Courier New', monospace;
-            font-size: 0.9em;
+        /* --- Main content area --- */
+        .main-content {
+            flex: 1;
+            min-width: 0;
         }
 
-        .training-content pre code {
-            background-color: transparent;
-            color: #ffffff;
-            padding: 0;
-            border-radius: 0;
-        }
+        /* ===== Training Content Sections ===== */
+        .training-content { color: #e0e0e0; }
 
-        /* Details/Summary styling */
-        .training-content details {
-            background-color: #404040;
-            border: 1px solid #606060;
-            border-radius: 0.375rem;
-            margin: 1rem 0;
+        /* Section wrappers generated by JS */
+        .tc-section {
+            background: #2d2d2d;
+            border: 1px solid #383838;
+            border-radius: 0.5rem;
+            margin-bottom: 1.25rem;
             overflow: hidden;
         }
-
-        .training-content summary {
-            background-color: #505050;
-            padding: 1rem;
+        .tc-section-header {
+            padding: 1rem 1.25rem;
             cursor: pointer;
-            border-bottom: 1px solid #606060;
-            font-weight: bold;
+            display: flex;
+            align-items: center;
+            gap: 0.5rem;
+            user-select: none;
+            transition: background 0.15s;
+        }
+        .tc-section-header:hover { background: rgba(255,255,255,0.03); }
+        .tc-section-arrow {
+            font-size: 0.65rem;
+            color: #888;
+            transition: transform 0.2s;
+            flex-shrink: 0;
+        }
+        .tc-section.open .tc-section-arrow { transform: rotate(90deg); }
+        .tc-section-title {
+            font-size: 1.1rem;
+            font-weight: 700;
+            color: #ff6b00;
+            margin: 0;
         }
-
-        .training-content details[open] summary {
-            border-bottom: 1px solid #606060;
+        .tc-section-body {
+            padding: 0 1.25rem 1.25rem;
+            display: none;
+        }
+        .tc-section.open .tc-section-body { display: block; }
+
+        /* Section type accents */
+        .tc-section[data-type="task"] { border-left: 3px solid #3b82f6; }
+        .tc-section[data-type="task"] .tc-section-title { color: #60a5fa; }
+        .tc-section[data-type="hint"] { border-left: 3px solid #f59e0b; }
+        .tc-section[data-type="hint"] .tc-section-title { color: #fbbf24; }
+        .tc-section[data-type="solution"] { border-left: 3px solid #ef4444; }
+        .tc-section[data-type="solution"] .tc-section-title { color: #f87171; }
+        .tc-section[data-type="security"] { border-left: 3px solid #8b5cf6; }
+        .tc-section[data-type="security"] .tc-section-title { color: #a78bfa; }
+        .tc-section[data-type="overview"] { border-left: 3px solid #22c55e; }
+        .tc-section[data-type="overview"] .tc-section-title { color: #4ade80; }
+
+        /* ===== Training content typography ===== */
+        .training-content h1 { font-size: 1.5rem; color: #ff6b00; margin: 1.5rem 0 0.75rem; }
+        .training-content h2 { font-size: 1.25rem; color: #ff6b00; margin: 1.25rem 0 0.75rem; display: none; }
+        .training-content h3 { font-size: 1.1rem; color: #ccc; margin: 1rem 0 0.5rem; font-weight: 600; }
+        .training-content h4 { font-size: 1rem; color: #bbb; margin: 1rem 0 0.5rem; }
+        .training-content p { margin-bottom: 0.75rem; line-height: 1.7; }
+        .training-content ul, .training-content ol { margin-bottom: 0.75rem; padding-left: 1.5rem; }
+        .training-content li { margin-bottom: 0.4rem; }
+        .training-content strong { color: #fff; }
+        .training-content hr { border: none; border-top: 1px solid #383838; margin: 1.5rem 0; }
+
+        /* Inline code */
+        .training-content code {
+            background: #2a2a2a;
+            color: #ff6b00;
+            padding: 0.15rem 0.4rem;
+            border-radius: 0.25rem;
+            font-family: 'JetBrains Mono', 'Fira Code', 'Consolas', monospace;
+            font-size: 0.85em;
+            border: 1px solid #383838;
         }
 
-        .training-content details > *:not(summary) {
-            padding: 1rem;
+        /* Code blocks */
+        .training-content .code-block-wrapper {
+            position: relative;
+            margin: 0.75rem 0;
         }
-
-        /* Training content styling */
-        .training-content h1, .training-content h2, .training-content h3, 
-        .training-content h4, .training-content h5, .training-content h6 {
-            color: #ff6b00;
-            margin-top: 1.5rem;
-            margin-bottom: 1rem;
-            font-weight: bold;
+        .training-content pre {
+            background: #1e1e1e;
+            border: 1px solid #333;
+            border-radius: 0 0 0.5rem 0.5rem;
+            padding: 1rem 1.25rem;
+            margin: 0;
+            overflow-x: auto;
+            line-height: 1.5;
         }
-
-        .training-content h1 { font-size: 1.875rem; }
-        .training-content h2 { font-size: 1.5rem; }
-        .training-content h3 { font-size: 1.25rem; }
-        .training-content h4 { font-size: 1.125rem; }
-
-        .training-content p {
-            margin-bottom: 1rem;
-            line-height: 1.6;
+        .training-content .code-block-wrapper pre {
+            border-radius: 0 0 0.5rem 0.5rem;
         }
-
-        .training-content ul, .training-content ol {
-            margin-bottom: 1rem;
-            padding-left: 1.5rem;
+        .training-content pre code {
+            background: transparent;
+            color: inherit;
+            padding: 0;
+            border: none;
+            font-size: 0.85rem;
         }
-
-        .training-content li {
-            margin-bottom: 0.5rem;
+        /* Language label bar */
+        .code-lang-bar {
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+            background: #2a2a2a;
+            border: 1px solid #333;
+            border-bottom: none;
+            border-radius: 0.5rem 0.5rem 0 0;
+            padding: 0.3rem 0.75rem;
+        }
+        .code-lang-label {
+            font-size: 0.7rem;
+            color: #888;
+            text-transform: uppercase;
+            font-weight: 600;
+            letter-spacing: 0.04em;
+            font-family: -apple-system, sans-serif;
         }
-
-        .training-content code {
-            background-color: #1a1a1a;
-            color: #22c55e;
-            padding: 0.125rem 0.25rem;
+        .copy-btn {
+            background: transparent;
+            border: 1px solid #555;
+            color: #888;
             border-radius: 0.25rem;
-            font-family: 'Courier New', monospace;
-            font-size: 0.875rem;
+            padding: 0.2rem 0.5rem;
+            font-size: 0.65rem;
+            cursor: pointer;
+            transition: all 0.15s;
+            font-family: -apple-system, sans-serif;
         }
+        .copy-btn:hover { border-color: #ff6b00; color: #ff6b00; }
+        .copy-btn.copied { border-color: #22c55e; color: #22c55e; }
 
-        .training-content pre {
-            background-color: #1a1a1a;
-            border: 1px solid #404040;
-            border-radius: 0.375rem;
-            padding: 1rem;
-            margin: 1rem 0;
-            overflow-x: auto;
+        /* Standalone pre (no wrapper yet) */
+        .training-content > pre,
+        .training-content .tc-section-body > pre {
+            border-radius: 0.5rem;
         }
 
-        .training-content pre code {
-            background-color: transparent;
-            padding: 0;
-            color: #22c55e;
+        /* Details/Summary inside sections */
+        .training-content details {
+            background: #353535;
+            border: 1px solid #444;
+            border-radius: 0.375rem;
+            margin: 0.75rem 0;
+            overflow: hidden;
         }
-
-        .training-content blockquote {
-            border-left: 4px solid #ff6b00;
-            padding-left: 1rem;
-            margin: 1rem 0;
-            font-style: italic;
+        .training-content summary {
+            background: #3a3a3a;
+            padding: 0.75rem 1rem;
+            cursor: pointer;
+            font-weight: 600;
+            color: #ccc;
+            font-size: 0.95rem;
+            transition: background 0.15s;
         }
+        .training-content summary:hover { background: #404040; }
+        .training-content details[open] summary { border-bottom: 1px solid #444; }
+        .training-content details > *:not(summary) { padding: 0.75rem 1rem; }
 
+        /* Tables */
         .training-content table {
             width: 100%;
             border-collapse: collapse;
-            margin: 1rem 0;
+            margin: 0.75rem 0;
+            font-size: 0.9rem;
         }
-
-        .training-content th, .training-content td {
-            border: 1px solid #404040;
-            padding: 0.5rem;
-            text-align: left;
-        }
-
         .training-content th {
-            background-color: #404040;
-            font-weight: bold;
+            background: #353535;
+            font-weight: 600;
+            text-align: left;
+            padding: 0.6rem 0.75rem;
+            border: 1px solid #444;
+            color: #ccc;
         }
-
-        .training-content a {
-            color: #ff6b00;
-            text-decoration: underline;
+        .training-content td {
+            padding: 0.5rem 0.75rem;
+            border: 1px solid #383838;
         }
+        .training-content tr:nth-child(even) { background: rgba(255,255,255,0.02); }
 
-        .training-content a:hover {
-            text-decoration: none;
+        /* Blockquotes */
+        .training-content blockquote {
+            border-left: 3px solid #ff6b00;
+            margin: 0.75rem 0;
+            padding: 0.5rem 1rem;
+            background: rgba(255,107,0,0.05);
+            border-radius: 0 0.25rem 0.25rem 0;
+            font-style: italic;
+            color: #bbb;
         }
 
+        /* Images */
         .training-content img {
             max-width: 100%;
             height: auto;
             display: block;
-            margin: 1rem auto;
+            margin: 0.75rem auto;
             border-radius: 0.375rem;
-            border: 1px solid #404040;
+            border: 1px solid #383838;
         }
+        .training-content figure { max-width: 100%; margin: 0.75rem 0; }
+        .training-content figcaption { text-align: center; font-size: 0.8rem; color: #888; font-style: italic; }
 
-        .training-content figure {
-            max-width: 100%;
-            margin: 1rem 0;
-        }
+        /* Links */
+        .training-content a { color: #ff6b00; text-decoration: underline; }
+        .training-content a:hover { text-decoration: none; }
 
-        .training-content figure img {
-            max-width: 100%;
-            height: auto;
-            margin: 0 auto 0.5rem;
+        /* ===== Flag Submission Box ===== */
+        .submit-box {
+            background: #2d2d2d;
+            border: 1px solid #383838;
+            border-radius: 0.5rem;
+            padding: 1.5rem;
+            margin-top: 1.25rem;
         }
-
-        .training-content figcaption {
-            text-align: center;
-            font-size: 0.875rem;
-            color: #999;
-            font-style: italic;
+        .submit-box h2 {
+            font-size: 1.1rem;
+            margin: 0 0 1rem;
+            color: #fff;
         }
-
-        /* Success Animation Styles */
-        .success-animation {
-            position: fixed;
-            top: 0;
-            left: 0;
+        .flag-input {
+            background: #1e1e1e;
+            border: 1px solid #444;
+            border-radius: 0.375rem;
+            color: #fff;
+            padding: 0.65rem 0.75rem;
             width: 100%;
-            height: 100%;
-            background: rgba(26, 26, 26, 0.9);
-            display: flex;
-            justify-content: center;
-            align-items: center;
-            z-index: 1000;
-            opacity: 0;
-            visibility: hidden;
-            transition: all 0.3s ease;
+            font-family: 'JetBrains Mono', 'Consolas', monospace;
+            font-size: 0.9rem;
+            transition: border-color 0.15s;
         }
-
-        .success-animation.show {
-            opacity: 1;
-            visibility: visible;
+        .flag-input:focus { outline: none; border-color: #ff6b00; }
+        .flag-hint {
+            font-size: 0.7rem;
+            color: #666;
+            margin-top: 0.3rem;
         }
-
-        .success-content {
-            text-align: center;
-            transform: scale(0.5);
-            transition: transform 0.5s cubic-bezier(0.68, -0.55, 0.265, 1.55);
+        .flag-hint code {
+            color: #ff6b00;
+            background: #2a2a2a;
+            padding: 0.1rem 0.3rem;
+            border-radius: 3px;
+            font-size: 0.7rem;
         }
-
-        .success-animation.show .success-content {
-            transform: scale(1);
+        .submit-btn {
+            background: #ff6b00;
+            color: #1a1a1a;
+            border: none;
+            border-radius: 0.375rem;
+            padding: 0.65rem 1.5rem;
+            font-weight: 700;
+            font-size: 0.9rem;
+            cursor: pointer;
+            transition: background 0.15s;
+            margin-top: 0.75rem;
+        }
+        .submit-btn:hover { background: #e55d00; }
+        .submit-btn:disabled { background: #555; cursor: not-allowed; color: #999; }
+        .verify-btn {
+            background: #3b82f6;
+            color: #fff;
+            border: none;
+            border-radius: 0.375rem;
+            padding: 0.65rem 1.5rem;
+            font-weight: 700;
+            font-size: 0.9rem;
+            cursor: pointer;
+            transition: background 0.15s;
         }
-
-        .success-icon {
-            font-size: 6rem;
-            color: #22c55e;
-            margin-bottom: 1rem;
-            animation: bounce 1s infinite;
+        .verify-btn:hover { background: #2563eb; }
+        .verify-btn:disabled { background: #555; cursor: not-allowed; color: #999; }
+        .verify-spinner {
+            display: inline-block;
+            width: 0.9rem; height: 0.9rem;
+            border: 2px solid #555;
+            border-top-color: #3b82f6;
+            border-radius: 50%;
+            animation: spin 0.8s linear infinite;
+            margin-right: 0.4rem;
+            vertical-align: middle;
         }
 
-        .success-text {
-            font-size: 2rem;
-            font-weight: bold;
-            color: #ff6b00;
-            margin-bottom: 0.5rem;
+        .msg {
+            padding: 0.65rem 0.75rem;
+            border-radius: 0.375rem;
+            margin-top: 0.75rem;
+            font-size: 0.9rem;
         }
+        .msg-ok { background: rgba(34,197,94,0.1); border: 1px solid #22c55e; color: #4ade80; }
+        .msg-err { background: rgba(239,68,68,0.1); border: 1px solid #ef4444; color: #f87171; }
 
-        .success-points {
-            font-size: 1.5rem;
-            color: #22c55e;
-            margin-bottom: 2rem;
+        .verify-check {
+            padding: 0.4rem 0.65rem;
+            margin: 0.2rem 0;
+            border-radius: 0.25rem;
+            font-family: monospace;
+            font-size: 0.85em;
         }
+        .verify-check.passed { background: rgba(34,197,94,0.1); border-left: 3px solid #22c55e; }
+        .verify-check.failed { background: rgba(239,68,68,0.1); border-left: 3px solid #ef4444; }
 
-        .fireworks {
-            position: absolute;
-            width: 100%;
-            height: 100%;
-            pointer-events: none;
+        /* ===== Success Animation ===== */
+        .success-overlay {
+            position: fixed; top: 0; left: 0; width: 100%; height: 100%;
+            background: rgba(26,26,26,0.92);
+            display: flex; justify-content: center; align-items: center;
+            z-index: 1000; opacity: 0; visibility: hidden; transition: all 0.3s;
         }
-
+        .success-overlay.show { opacity: 1; visibility: visible; }
+        .success-inner {
+            text-align: center;
+            transform: scale(0.5);
+            transition: transform 0.5s cubic-bezier(0.68,-0.55,0.265,1.55);
+        }
+        .success-overlay.show .success-inner { transform: scale(1); }
+        .success-icon { font-size: 5rem; animation: bounce 1s infinite; }
+        .success-text { font-size: 1.75rem; font-weight: 700; color: #ff6b00; margin: 0.5rem 0; }
+        .success-pts { font-size: 1.25rem; color: #4ade80; margin-bottom: 1rem; }
+        .fireworks { position: absolute; width: 100%; height: 100%; pointer-events: none; }
         .firework {
-            position: absolute;
-            width: 4px;
-            height: 4px;
-            background: #ff6b00;
-            border-radius: 50%;
+            position: absolute; width: 4px; height: 4px; border-radius: 50%;
             animation: firework 1s ease-out forwards;
         }
-
         .firework:nth-child(2n) { background: #22c55e; }
         .firework:nth-child(3n) { background: #3b82f6; }
         .firework:nth-child(4n) { background: #f59e0b; }
         .firework:nth-child(5n) { background: #ef4444; }
-
-        @keyframes bounce {
-            0%, 20%, 60%, 100% { transform: translateY(0); }
-            40% { transform: translateY(-30px); }
-            80% { transform: translateY(-15px); }
-        }
-
-        @keyframes firework {
-            0% {
-                opacity: 1;
-                transform: translateY(0) scale(1);
-            }
-            100% {
-                opacity: 0;
-                transform: translateY(var(--dy)) translateX(var(--dx)) scale(0);
-            }
-        }
-
         .confetti {
-            position: absolute;
-            width: 10px;
-            height: 10px;
-            background: #ff6b00;
+            position: absolute; width: 8px; height: 8px;
             animation: confetti 3s ease-out forwards;
         }
-
         .confetti:nth-child(2n) { background: #22c55e; }
         .confetti:nth-child(3n) { background: #3b82f6; }
         .confetti:nth-child(4n) { background: #f59e0b; }
 
-        @keyframes confetti {
-            0% {
-                opacity: 1;
-                transform: translateY(-100vh) rotate(0deg);
-            }
-            100% {
-                opacity: 0;
-                transform: translateY(100vh) rotate(720deg);
-            }
-        }
-
-        /* Utility classes */
-        header {
-            background-color: #2d2d2d;
-            color: #ff6b00;
-            padding: 1rem;
-            display: flex;
-            justify-content: space-between;
-            align-items: center;
-        }
-
-        h1 {
-            font-size: 1.5rem;
-            font-weight: bold;
-        }
-
-        h2 {
-            font-size: 1.25rem;
-            font-weight: bold;
-            margin-bottom: 1rem;
-        }
-
-        h3 {
-            font-size: 1.125rem;
-            font-weight: 600;
-            margin-bottom: 0.5rem;
-        }
-
-        .container {
-            width: 100%;
-            max-width: 1280px;
-        }
-
-        .mx-auto {
-            margin-left: auto;
-            margin-right: auto;
-        }
-
-        .max-w-4xl {
-            max-width: 896px;
-        }
-
-        .px-4 {
-            padding-left: 1rem;
-            padding-right: 1rem;
-        }
-
-        .py-8 {
-            padding-top: 2rem;
-            padding-bottom: 2rem;
-        }
-
-        .p-4 {
-            padding: 1rem;
-        }
-
-        .mb-2 {
-            margin-bottom: 0.5rem;
-        }
-
-        .mb-4 {
-            margin-bottom: 1rem;
-        }
-
-        .mb-6 {
-            margin-bottom: 1.5rem;
-        }
-
-        .flex {
-            display: flex;
-        }
-
-        .items-center {
-            align-items: center;
-        }
-
-        .justify-between {
-            justify-content: space-between;
-        }
-
-        .gap-2 {
-            gap: 0.5rem;
-        }
-
-        .gap-4 {
-            gap: 1rem;
-        }
-
-        .text-2xl {
-            font-size: 1.5rem;
-        }
-
-        .text-xl {
-            font-size: 1.25rem;
-        }
-
-        .font-bold {
-            font-weight: bold;
-        }
-
-        .font-semibold {
-            font-weight: 600;
-        }
-
-        .text-gray-300 {
-            color: #d1d5db;
-        }
-
-        .leading-relaxed {
-            line-height: 1.625;
-        }
-
-        .w-full {
-            width: 100%;
+        @keyframes bounce {
+            0%,20%,60%,100% { transform: translateY(0); }
+            40% { transform: translateY(-20px); }
+            80% { transform: translateY(-10px); }
         }
-
-        .mt-4 {
-            margin-top: 1rem;
+        @keyframes firework {
+            0% { opacity:1; transform: translateY(0) scale(1); }
+            100% { opacity:0; transform: translateY(var(--dy)) translateX(var(--dx)) scale(0); }
         }
-
-        .text-center {
-            text-align: center;
+        @keyframes confetti {
+            0% { opacity:1; transform: translateY(-100vh) rotate(0); }
+            100% { opacity:0; transform: translateY(100vh) rotate(720deg); }
+        }
+        @keyframes spin { to { transform: rotate(360deg); } }
+
+        /* ===== Responsive ===== */
+        @media (max-width: 900px) {
+            .page-layout { flex-direction: column; padding: 1rem; gap: 0; }
+            .sidebar {
+                position: relative;
+                top: 0;
+                width: 100%;
+                max-height: none;
+                border-bottom: 1px solid #333;
+                padding-bottom: 1rem;
+                margin-bottom: 1rem;
+            }
+            .toc-list { display: flex; flex-wrap: wrap; gap: 0.25rem; }
+            .toc-link { border-left: none; border-bottom: 2px solid transparent; padding: 0.3rem 0.6rem; font-size: 0.75rem; }
+            .toc-link.active { border-left: none; border-bottom-color: #ff6b00; }
+            header { flex-direction: column; gap: 0.5rem; align-items: flex-start; }
         }
     </style>
 </head>
 <body>
     <!-- Header -->
     <header>
-        <div class="flex items-center gap-4">
-            <a href="/ctf" class="back-button" target="_top">← Back to CTF</a>
-            <h1 class="text-2xl font-bold">{{ challenge.title }}</h1>
+        <div class="header-left">
+            <a href="/ctf" class="back-btn" onclick="event.preventDefault(); window.parent.postMessage({type:'navigate',url:'/ctf'},'*');">&#8592; Back</a>
+            <h1>{{ challenge.title }}</h1>
         </div>
-        
-        <div class="flex items-center gap-2">
+        <div class="header-right">
+            {% if challenge.get('tag') %}
+            <span class="badge badge-tag-{{ challenge.tag }}">{{ challenge.tag }}</span>
+            {% endif %}
+            {% if challenge.points <= 150 %}
+            <span class="badge badge-easy">Easy</span>
+            {% elif challenge.points <= 250 %}
+            <span class="badge badge-medium">Medium</span>
+            {% else %}
+            <span class="badge badge-hard">Hard</span>
+            {% endif %}
             <span class="badge badge-points">{{ challenge.points }} pts</span>
             {% if solved %}
-            <span class="badge badge-solved">✓ Solved</span>
+            <span class="badge badge-solved">&#10003; Solved</span>
             {% endif %}
         </div>
     </header>
 
-    <!-- Main container -->
-    <main class="container mx-auto px-4 py-8 max-w-4xl">
-        <!-- Challenge Info -->
-        <div class="challenge-container">
-            <div class="mb-4">
-                <span class="text-[#ff6b00] font-semibold">Category:</span> {{ category.name }}
-            </div>
-            
-            <h2 class="text-xl font-bold mb-4">Challenge Description</h2>
-            <p class="text-gray-300 mb-6 leading-relaxed">{{ challenge.description }}</p>
-            
-            {% if challenge.hint %}
-            <div class="hint-box">
-                <h3 class="font-semibold text-[#ff6b00] mb-2">💡 Hint</h3>
-                <p class="text-gray-300">{{ challenge.hint }}</p>
-            </div>
-            {% endif %}
-        </div>
-
-        <!-- Training Content -->
-        {% if training_content %}
-        <div class="challenge-container">
-            <h2 class="text-xl font-bold mb-4">📚 Training Material</h2>
-            <div class="training-content text-gray-300 leading-relaxed">
+    <!-- Page layout -->
+    <div class="page-layout">
+        <!-- Sidebar TOC -->
+        <nav class="sidebar" id="sidebar">
+            <div class="sidebar-title">Contents</div>
+            <ul class="toc-list" id="toc-list">
+                <!-- Populated by JS -->
+            </ul>
+            <hr class="sidebar-divider">
+            <a href="#submit-section" class="sidebar-action" onclick="event.preventDefault(); document.getElementById('submit-section').scrollIntoView({behavior:'smooth'});">
+                {% if challenge_type == 'defense' %}Verify Defense{% else %}Submit Flag{% endif %} &#8595;
+            </a>
+        </nav>
+
+        <!-- Main content -->
+        <div class="main-content">
+            {% if training_content %}
+            <div class="training-content" id="training-content">
                 {{ training_content | safe }}
             </div>
-        </div>
-        {% endif %}
-
-        <!-- Flag Submission -->
-        <div class="challenge-container">
-            <h2 class="text-xl font-bold mb-4">Submit Flag</h2>
-            
-            {% if solved %}
-            <div class="message success">
-                <strong>🎉 Challenge Completed!</strong><br>
-                You have already solved this challenge and earned {{ challenge.points }} points.
-            </div>
             {% else %}
-            <div class="mb-4">
-                <label for="flag-input" class="block text-sm font-medium mb-2">Enter the flag (format: CybICS(...))</label>
-                <input type="text" 
-                       id="flag-input" 
-                       class="flag-input" 
-                       placeholder="CybICS(flag_here)"
-                       autocomplete="off">
+            <div class="tc-section open" data-type="overview">
+                <div class="tc-section-body" style="display:block; padding-top:1.25rem;">
+                    <p>{{ challenge.description }}</p>
+                </div>
             </div>
-            
-            <button id="submit-button" class="submit-button">
-                Submit Flag
-            </button>
-            
-            <div id="message-container"></div>
             {% endif %}
-        </div>
 
-        <!-- Additional Resources or Files (if needed) -->
-        <div class="challenge-container">
-            <h2 class="text-xl font-bold mb-4">Resources</h2>
-            <p class="text-gray-300">
-                Use the CybICS system tools and your knowledge to solve this challenge. 
-                You may need to analyze logs, network traffic, or system configurations depending on the challenge type.
-            </p>
-            <div class="mt-4">
-                <a href="/" class="back-button" target="_top">Access System Tools →</a>
+            <!-- Flag Submission -->
+            <div class="submit-box" id="submit-section">
+                {% if solved %}
+                <h2>{% if challenge_type == 'defense' %}Defense Verified{% else %}Challenge Completed{% endif %}</h2>
+                <div class="msg msg-ok">
+                    <strong>&#127881; Challenge Completed!</strong> You earned {{ challenge.points }} points.
+                </div>
+                {% elif challenge_type == 'defense' %}
+                <h2>&#128737; Verify Defense</h2>
+                <p style="color:#999; font-size:0.9rem; margin-bottom:0.75rem;">Complete the defensive actions above, then verify your work.</p>
+                <button id="verify-button" class="verify-btn">&#128737; Verify Defense</button>
+                <div id="verify-results"></div>
+                <div id="message-container"></div>
+                {% else %}
+                <h2>Submit Flag</h2>
+                <input type="text" id="flag-input" class="flag-input" placeholder="CybICS(flag_here)" autocomplete="off">
+                <div class="flag-hint">Format: <code>CybICS(...)</code></div>
+                <button id="submit-button" class="submit-btn">Submit Flag</button>
+                <div id="message-container"></div>
+                {% endif %}
             </div>
         </div>
-    </main>
+    </div>
 
-    <!-- Success Animation Modal -->
-    <div id="success-animation" class="success-animation">
+    <!-- Success Animation -->
+    <div id="success-animation" class="success-overlay">
         <div class="fireworks" id="fireworks"></div>
-        <div class="success-content">
-            <div class="success-icon">🎉</div>
+        <div class="success-inner">
+            <div class="success-icon">&#127881;</div>
             <div class="success-text">Challenge Completed!</div>
-            <div class="success-points" id="success-points">+{{ challenge.points }} points</div>
-            <div style="color: #ffffff;">Redirecting to CTF page...</div>
+            <div class="success-pts">+{{ challenge.points }} points</div>
+            <div style="color:#999; font-size:0.9rem;">Redirecting...</div>
         </div>
     </div>
 
+    <!-- highlight.js -->
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.9.0/highlight.min.js"></script>
     <script>
-        const challengeId = '{{ challenge.id }}';
-        const flagInput = document.getElementById('flag-input');
-        const submitButton = document.getElementById('submit-button');
-        const messageContainer = document.getElementById('message-container');
-
-        function showMessage(message, isSuccess) {
-            messageContainer.innerHTML = `
-                <div class="message ${isSuccess ? 'success' : 'error'}">
-                    ${message}
-                </div>
-            `;
-        }
-
-        function showSuccessAnimation() {
-            const animation = document.getElementById('success-animation');
-            const fireworksContainer = document.getElementById('fireworks');
-            
-            // Show the animation
-            animation.classList.add('show');
-            
-            // Create fireworks
-            createFireworks(fireworksContainer);
-            
-            // Create confetti
-            createConfetti();
-        }
-
-        function createFireworks(container) {
-            for (let i = 0; i < 15; i++) {
-                setTimeout(() => {
-                    const firework = document.createElement('div');
-                    firework.className = 'firework';
-                    
-                    // Random position
-                    const x = Math.random() * window.innerWidth;
-                    const y = Math.random() * window.innerHeight;
-                    
-                    // Random direction and distance
-                    const dx = (Math.random() - 0.5) * 400;
-                    const dy = (Math.random() - 0.5) * 400;
-                    
-                    firework.style.left = x + 'px';
-                    firework.style.top = y + 'px';
-                    firework.style.setProperty('--dx', dx + 'px');
-                    firework.style.setProperty('--dy', dy + 'px');
-                    
-                    container.appendChild(firework);
-                    
-                    // Remove after animation
-                    setTimeout(() => {
-                        firework.remove();
-                    }, 1000);
-                }, i * 100);
+    document.addEventListener('DOMContentLoaded', function() {
+        const content = document.getElementById('training-content');
+        if (!content) return;
+
+        // ===== 1. Split content into sections by H2 headings =====
+        const children = Array.from(content.childNodes);
+        const sections = [];
+        let currentSection = null;
+
+        children.forEach(node => {
+            if (node.nodeType === 1 && node.tagName === 'H2') {
+                if (currentSection) sections.push(currentSection);
+                currentSection = { heading: node.textContent.trim(), nodes: [node] };
+            } else if (node.nodeType === 1 && node.tagName === 'H1') {
+                // Skip H1 (title), add to current or create preamble
+                if (!currentSection) currentSection = { heading: '', nodes: [] };
+                // Don't add H1 to sections — it's redundant with the header
+            } else {
+                if (!currentSection) currentSection = { heading: '', nodes: [] };
+                currentSection.nodes.push(node);
             }
-        }
-
-        function createConfetti() {
-            for (let i = 0; i < 50; i++) {
-                setTimeout(() => {
-                    const confetti = document.createElement('div');
-                    confetti.className = 'confetti';
-                    
-                    // Random horizontal position
-                    confetti.style.left = Math.random() * window.innerWidth + 'px';
-                    confetti.style.animationDelay = Math.random() * 2 + 's';
-                    confetti.style.animationDuration = (Math.random() * 2 + 2) + 's';
-                    
-                    document.body.appendChild(confetti);
-                    
-                    // Remove after animation
-                    setTimeout(() => {
-                        confetti.remove();
-                    }, 5000);
-                }, i * 50);
+        });
+        if (currentSection) sections.push(currentSection);
+
+        // Detect section type from heading text
+        function detectType(heading) {
+            const h = heading.toLowerCase();
+            if (h.includes('task')) return 'task';
+            if (h.includes('hint')) return 'hint';
+            if (h.includes('solution') || h.includes('flag:')) return 'solution';
+            if (h.includes('security framework') || h.includes('mitre') || h.includes('nist')) return 'security';
+            if (h.includes('overview') || h.includes('introduction')) return 'overview';
+            return '';
+        }
+
+        // Determine which sections open by default
+        function shouldBeOpen(type, heading) {
+            if (type === 'task' || type === 'overview') return true;
+            if (type === 'hint' || type === 'solution' || type === 'security') return false;
+            // Default: open for content sections
+            return true;
+        }
+
+        // Build section cards
+        content.innerHTML = '';
+        const tocList = document.getElementById('toc-list');
+        const sectionEls = [];
+
+        sections.forEach((sec, i) => {
+            if (!sec.heading && sec.nodes.length === 0) return;
+
+            // If no heading, it's preamble — just append directly
+            if (!sec.heading) {
+                sec.nodes.forEach(n => content.appendChild(n));
+                return;
             }
-        }
 
-        function submitFlag() {
-            const flag = flagInput.value.trim();
-            
-            if (!flag) {
-                showMessage('Please enter a flag', false);
-                return;
+            const type = detectType(sec.heading);
+            const id = 'section-' + i;
+            const isOpen = shouldBeOpen(type, sec.heading);
+
+            // Create section card
+            const card = document.createElement('div');
+            card.className = 'tc-section' + (isOpen ? ' open' : '');
+            card.id = id;
+            if (type) card.dataset.type = type;
+
+            const header = document.createElement('div');
+            header.className = 'tc-section-header';
+            header.innerHTML = '<span class="tc-section-arrow">&#9654;</span><h2 class="tc-section-title" style="display:block !important;">' + sec.heading + '</h2>';
+            header.addEventListener('click', () => {
+                card.classList.toggle('open');
+            });
+
+            const body = document.createElement('div');
+            body.className = 'tc-section-body';
+            sec.nodes.forEach(n => { if (n.tagName !== 'H2') body.appendChild(n); });
+
+            // Unwrap inner <details> for sections that already collapse via the card
+            // This prevents the double-expand problem
+            if (type === 'hint' || type === 'security' || type === 'solution') {
+                body.querySelectorAll(':scope > details, :scope > p > details').forEach(det => {
+                    // Move the inner content out, remove the details/summary wrapper
+                    const frag = document.createDocumentFragment();
+                    Array.from(det.children).forEach(child => {
+                        if (child.tagName !== 'SUMMARY') frag.appendChild(child);
+                    });
+                    det.replaceWith(frag);
+                });
             }
 
-            submitButton.disabled = true;
-            submitButton.textContent = 'Submitting...';
-
-            fetch('/ctf/submit', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                },
-                body: JSON.stringify({
-                    challenge_id: challengeId,
-                    flag: flag
-                })
-            })
-            .then(response => response.json())
-            .then(data => {
-                showMessage(data.message, data.success);
-                
-                if (data.success) {
-                    flagInput.disabled = true;
-                    submitButton.textContent = 'Solved! ✓';
-                    showSuccessAnimation();
-                    setTimeout(() => {
-                        window.top.location.href = '/ctf';
-                    }, 4000);
-                } else {
-                    submitButton.disabled = false;
-                    submitButton.textContent = 'Submit Flag';
-                    flagInput.focus();
+            card.appendChild(header);
+            card.appendChild(body);
+            content.appendChild(card);
+            sectionEls.push(card);
+
+            // Add to TOC
+            const li = document.createElement('li');
+            const a = document.createElement('a');
+            a.className = 'toc-link';
+            a.href = '#' + id;
+            // Clean emoji prefixes for shorter TOC labels
+            a.textContent = sec.heading.replace(/^[\u{1F300}-\u{1FFFE}\s]+/u, '').trim() || sec.heading;
+            a.addEventListener('click', e => {
+                e.preventDefault();
+                card.classList.add('open');
+                card.scrollIntoView({ behavior: 'smooth', block: 'start' });
+            });
+            li.appendChild(a);
+            tocList.appendChild(li);
+        });
+
+        // ===== 2. Scrollspy =====
+        const tocLinks = document.querySelectorAll('.toc-link');
+        const observer = new IntersectionObserver(entries => {
+            entries.forEach(entry => {
+                if (entry.isIntersecting) {
+                    tocLinks.forEach(l => l.classList.remove('active'));
+                    const link = document.querySelector('.toc-link[href="#' + entry.target.id + '"]');
+                    if (link) link.classList.add('active');
                 }
-            })
-            .catch(error => {
-                console.error('Error:', error);
-                showMessage('An error occurred. Please try again.', false);
-                submitButton.disabled = false;
-                submitButton.textContent = 'Submit Flag';
             });
-        }
+        }, { rootMargin: '-80px 0px -60% 0px', threshold: 0 });
 
-        if (submitButton) {
-            submitButton.addEventListener('click', submitFlag);
-        }
+        sectionEls.forEach(el => observer.observe(el));
 
-        if (flagInput) {
-            flagInput.addEventListener('keypress', function(e) {
-                if (e.key === 'Enter') {
-                    submitFlag();
-                }
+        // ===== 3. Syntax highlighting + copy buttons + language labels =====
+        content.querySelectorAll('pre code').forEach(block => {
+            // Detect language
+            let lang = '';
+            block.classList.forEach(cls => {
+                if (cls.startsWith('language-')) lang = cls.replace('language-', '');
             });
-        }
+
+            // Apply highlight.js
+            if (lang) {
+                block.classList.add('hljs');
+                try { hljs.highlightElement(block); } catch(e) {}
+            }
+
+            // Wrap pre in wrapper div
+            const pre = block.parentElement;
+            const wrapper = document.createElement('div');
+            wrapper.className = 'code-block-wrapper';
+            pre.parentNode.insertBefore(wrapper, pre);
+
+            // Language bar with copy button
+            const bar = document.createElement('div');
+            bar.className = 'code-lang-bar';
+            bar.innerHTML = '<span class="code-lang-label">' + (lang || 'code') + '</span>';
+
+            const copyBtn = document.createElement('button');
+            copyBtn.className = 'copy-btn';
+            copyBtn.textContent = 'Copy';
+            copyBtn.addEventListener('click', () => {
+                navigator.clipboard.writeText(block.textContent).then(() => {
+                    copyBtn.textContent = 'Copied!';
+                    copyBtn.classList.add('copied');
+                    setTimeout(() => { copyBtn.textContent = 'Copy'; copyBtn.classList.remove('copied'); }, 2000);
+                });
+            });
+            bar.appendChild(copyBtn);
+            wrapper.appendChild(bar);
+            wrapper.appendChild(pre);
+        });
+
+        // Also handle bare pre blocks (no language)
+        content.querySelectorAll('pre').forEach(pre => {
+            if (pre.parentElement.classList.contains('code-block-wrapper')) return;
+            const code = pre.querySelector('code');
+            if (!code) return;
+
+            const wrapper = document.createElement('div');
+            wrapper.className = 'code-block-wrapper';
+            pre.parentNode.insertBefore(wrapper, pre);
+
+            const bar = document.createElement('div');
+            bar.className = 'code-lang-bar';
+            bar.innerHTML = '<span class="code-lang-label">code</span>';
+
+            const copyBtn = document.createElement('button');
+            copyBtn.className = 'copy-btn';
+            copyBtn.textContent = 'Copy';
+            copyBtn.addEventListener('click', () => {
+                navigator.clipboard.writeText(code.textContent).then(() => {
+                    copyBtn.textContent = 'Copied!';
+                    copyBtn.classList.add('copied');
+                    setTimeout(() => { copyBtn.textContent = 'Copy'; copyBtn.classList.remove('copied'); }, 2000);
+                });
+            });
+            bar.appendChild(copyBtn);
+            wrapper.appendChild(bar);
+            wrapper.appendChild(pre);
+        });
+    });
+
+    // ===== Flag submission / Defense verification =====
+    const challengeId = '{{ challenge.id }}';
+    const challengeType = '{{ challenge_type }}';
+    const flagInput = document.getElementById('flag-input');
+    const submitButton = document.getElementById('submit-button');
+    const verifyButton = document.getElementById('verify-button');
+    const messageContainer = document.getElementById('message-container');
+
+    function showMsg(text, ok) {
+        if (!messageContainer) return;
+        messageContainer.innerHTML = '<div class="msg ' + (ok ? 'msg-ok' : 'msg-err') + '">' + text + '</div>';
+    }
+
+    function showSuccess() {
+        const el = document.getElementById('success-animation');
+        const fw = document.getElementById('fireworks');
+        el.classList.add('show');
+        for (let i = 0; i < 15; i++) {
+            setTimeout(() => {
+                const f = document.createElement('div');
+                f.className = 'firework';
+                f.style.left = Math.random()*innerWidth+'px';
+                f.style.top = Math.random()*innerHeight+'px';
+                f.style.background = '#ff6b00';
+                f.style.setProperty('--dx', (Math.random()-0.5)*400+'px');
+                f.style.setProperty('--dy', (Math.random()-0.5)*400+'px');
+                fw.appendChild(f);
+                setTimeout(() => f.remove(), 1000);
+            }, i*100);
+        }
+        for (let i = 0; i < 40; i++) {
+            setTimeout(() => {
+                const c = document.createElement('div');
+                c.className = 'confetti';
+                c.style.left = Math.random()*innerWidth+'px';
+                c.style.background = '#ff6b00';
+                document.body.appendChild(c);
+                setTimeout(() => c.remove(), 4000);
+            }, i*50);
+        }
+    }
+
+    function submitFlag() {
+        const flag = flagInput.value.trim();
+        if (!flag) { showMsg('Please enter a flag', false); return; }
+        if (!/^CybICS\(.*\)$/.test(flag)) { showMsg('Format: <code>CybICS(...)</code>', false); return; }
+        submitButton.disabled = true;
+        submitButton.textContent = 'Submitting...';
+        fetch('/ctf/submit', { method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify({challenge_id:challengeId, flag:flag}) })
+        .then(r => r.json()).then(d => {
+            showMsg(d.message, d.success);
+            if (d.success) { flagInput.disabled = true; submitButton.textContent = 'Solved!'; showSuccess(); setTimeout(() => { window.parent.postMessage({type:'navigate',url:'/ctf'},'*'); }, 4000); }
+            else { submitButton.disabled = false; submitButton.textContent = 'Submit Flag'; flagInput.focus(); }
+        }).catch(() => { showMsg('Error. Try again.', false); submitButton.disabled = false; submitButton.textContent = 'Submit Flag'; });
+    }
+
+    function verifyDefense() {
+        const results = document.getElementById('verify-results');
+        verifyButton.disabled = true;
+        verifyButton.innerHTML = '<span class="verify-spinner"></span> Verifying...';
+        results.innerHTML = '';
+        fetch('/ctf/verify/' + challengeId, { method:'POST', headers:{'Content-Type':'application/json'} })
+        .then(r => r.json()).then(d => {
+            if (d.checks && d.checks.length) {
+                let h = '';
+                d.checks.forEach(c => { h += '<div class="verify-check ' + (c.passed?'passed':'failed') + '">' + (c.passed?'&#9989;':'&#10060;') + ' <strong>' + c.name + '</strong>: ' + c.detail + '</div>'; });
+                results.innerHTML = h;
+            }
+            if (d.success) { showMsg(d.message, true); verifyButton.innerHTML = '&#9989; Verified!'; showSuccess(); setTimeout(() => { window.parent.postMessage({type:'navigate',url:'/ctf'},'*'); }, 4000); }
+            else { showMsg(d.message, false); verifyButton.disabled = false; verifyButton.innerHTML = '&#128737; Verify Defense'; }
+        }).catch(() => { showMsg('Error. Try again.', false); verifyButton.disabled = false; verifyButton.innerHTML = '&#128737; Verify Defense'; });
+    }
+
+    if (submitButton) { submitButton.addEventListener('click', submitFlag); }
+    if (verifyButton) { verifyButton.addEventListener('click', verifyDefense); }
+    if (flagInput) { flagInput.addEventListener('keypress', e => { if (e.key === 'Enter') submitFlag(); }); }
     </script>
 </body>
-</html>
\ No newline at end of file
+</html>
diff --git a/software/landing/templates/ctf.html b/software/landing/templates/ctf.html
index 6b1167a4..55841da2 100644
--- a/software/landing/templates/ctf.html
+++ b/software/landing/templates/ctf.html
@@ -5,373 +5,241 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>{{ config.title or 'CybICS - CTF Training' }}</title>
     <style>
+        * { box-sizing: border-box; margin: 0; padding: 0; }
+
         body {
             background-color: #1a1a1a;
             color: #ffffff;
             font-family: Arial, sans-serif;
-            margin: 0;
-            padding: 0;
-        }
-
-        ::-webkit-scrollbar {
-            width: 8px;
-            height: 8px;
-        }
-
-        ::-webkit-scrollbar-track {
-            background: #1a1a1a;
-        }
-
-        ::-webkit-scrollbar-thumb {
-            background: #404040;
-            border-radius: 4px;
-        }
-
-        ::-webkit-scrollbar-thumb:hover {
-            background: #ff6b00;
-        }
-
-        .category-card {
-            background-color: #2d2d2d;
-            border: 1px solid #404040;
-            border-radius: 0.5rem;
-            padding: 1.5rem;
-            margin-bottom: 1.5rem;
         }
 
-        .challenge-card {
-            background-color: #404040;
-            border: 1px solid #606060;
-            border-radius: 0.375rem;
-            padding: 1rem;
-            margin-bottom: 1rem;
-            transition: all 0.2s;
-            cursor: pointer;
-        }
-
-        .challenge-card:hover {
-            border-color: #ff6b00;
-            background-color: #505050;
-        }
-
-        .challenge-card.solved {
-            border-color: #22c55e;
-            background-color: #1a4d2e;
-        }
-
-        .badge {
-            display: inline-block;
-            padding: 0.25rem 0.5rem;
-            border-radius: 0.25rem;
-            font-size: 0.75rem;
-            font-weight: bold;
-        }
-
-        .badge-points {
-            background-color: #ff6b00;
-            color: #1a1a1a;
-        }
-
-        .badge-solved {
-            background-color: #22c55e;
-            color: #ffffff;
-        }
-
-        .progress-bar {
-            background-color: #404040;
-            border-radius: 0.5rem;
-            height: 1rem;
-            overflow: hidden;
-        }
-
-        .progress-fill {
-            background-color: #ff6b00;
-            height: 100%;
-            transition: width 0.3s ease;
-        }
-
-        .back-button {
-            background-color: #404040;
-            color: #ff6b00;
-            border: 1px solid #ff6b00;
-            border-radius: 0.25rem;
-            padding: 0.5rem 1rem;
-            text-decoration: none;
-            display: inline-block;
-            transition: all 0.2s;
-        }
-
-        .back-button:hover {
-            background-color: #ff6b00;
-            color: #1a1a1a;
-        }
-
-        .bg-red-600 {
-            background-color: #dc2626;
-        }
-
-        .border-red-600 {
-            border-color: #dc2626;
-        }
-
-        .hover\:bg-red-700:hover {
-            background-color: #b91c1c;
-        }
+        ::-webkit-scrollbar { width: 8px; }
+        ::-webkit-scrollbar-track { background: #1a1a1a; }
+        ::-webkit-scrollbar-thumb { background: #404040; border-radius: 4px; }
+        ::-webkit-scrollbar-thumb:hover { background: #ff6b00; }
 
+        /* ── Header ── */
         header {
             background-color: #2d2d2d;
-            color: #ff6b00;
-            padding: 1rem;
+            padding: 0.75rem 1.5rem;
             display: flex;
             justify-content: space-between;
             align-items: center;
+            border-bottom: 2px solid #ff6b00;
         }
 
-        h1 {
-            font-size: 1.5rem;
-            font-weight: bold;
-        }
-
-        h2 {
-            font-size: 1.25rem;
-            font-weight: bold;
-            color: #ff6b00;
-            margin-bottom: 1rem;
-        }
-
-        h3 {
-            font-size: 1.125rem;
-            font-weight: 600;
-        }
-
-        .container {
-            width: 100%;
-            max-width: 1280px;
-        }
-
-        .mx-auto {
-            margin-left: auto;
-            margin-right: auto;
-        }
-
-        .px-4 {
-            padding-left: 1rem;
-            padding-right: 1rem;
-        }
-
-        .py-8 {
-            padding-top: 2rem;
-            padding-bottom: 2rem;
-        }
-
-        .mb-2 {
-            margin-bottom: 0.5rem;
-        }
-
-        .mb-4 {
-            margin-bottom: 1rem;
-        }
+        header h1 { font-size: 1.25rem; font-weight: bold; color: #ff6b00; }
 
-        .mb-8 {
-            margin-bottom: 2rem;
-        }
+        .header-stats { display: flex; align-items: center; gap: 1.5rem; }
+        .stat-item { text-align: center; }
+        .stat-value { font-size: 1.25rem; font-weight: bold; color: #ff6b00; }
+        .stat-label { font-size: 0.7rem; text-transform: uppercase; letter-spacing: 0.05em; opacity: 0.6; }
 
-        .p-4 {
-            padding: 1rem;
-        }
+        .progress-bar-mini { width: 120px; height: 6px; background: #404040; border-radius: 3px; overflow: hidden; }
+        .progress-bar-mini .fill { height: 100%; background: #ff6b00; border-radius: 3px; transition: width 0.3s; }
 
-        .flex {
-            display: flex;
+        .reset-btn {
+            background: none; border: 1px solid #606060; color: #999;
+            padding: 0.35rem 0.75rem; border-radius: 0.25rem; font-size: 0.75rem;
+            cursor: pointer; transition: all 0.2s;
         }
+        .reset-btn:hover { border-color: #ef4444; color: #ef4444; }
 
-        .items-center {
-            align-items: center;
-        }
+        /* ── Main Layout ── */
+        main { max-width: 1400px; margin: 0 auto; padding: 1.5rem; }
 
-        .items-start {
-            align-items: flex-start;
+        /* ── Category Tiles Grid ── */
+        .categories-grid {
+            display: grid;
+            grid-template-columns: repeat(auto-fill, minmax(420px, 1fr));
+            gap: 1.25rem;
         }
 
-        .justify-between {
-            justify-content: space-between;
+        @media (max-width: 900px) {
+            .categories-grid { grid-template-columns: 1fr; }
         }
 
-        .gap-2 {
-            gap: 0.5rem;
+        /* ── Category Tile ── */
+        .category-tile {
+            background: #232323; border: 1px solid #333;
+            border-radius: 0.75rem; overflow: hidden; transition: border-color 0.2s;
         }
+        .category-tile:hover { border-color: #555; }
 
-        .gap-4 {
-            gap: 1rem;
+        .category-header {
+            padding: 0.85rem 1.25rem 0.65rem;
+            display: flex; justify-content: space-between; align-items: center;
+            border-bottom: 1px solid #333; background: #282828;
         }
 
-        .text-right {
-            text-align: right;
-        }
+        .category-title-group { display: flex; align-items: center; gap: 0.6rem; }
 
-        .text-center {
-            text-align: center;
+        .step-badge {
+            width: 22px; height: 22px; border-radius: 50%;
+            background: rgba(255, 107, 0, 0.15); color: #ff6b00;
+            font-size: 0.7rem; font-weight: 700;
+            display: flex; align-items: center; justify-content: center;
+            flex-shrink: 0;
         }
 
-        .text-sm {
-            font-size: 0.875rem;
-        }
+        .category-title { font-size: 1rem; font-weight: 700; color: #ff6b00; }
 
-        .text-lg {
-            font-size: 1.125rem;
+        .category-progress {
+            font-size: 0.75rem; color: #888;
+            display: flex; align-items: center; gap: 0.5rem;
         }
 
-        .text-2xl {
-            font-size: 1.5rem;
-        }
+        .category-progress-bar { width: 60px; height: 4px; background: #404040; border-radius: 2px; overflow: hidden; }
+        .category-progress-bar .fill { height: 100%; background: #22c55e; border-radius: 2px; }
 
-        .font-bold {
-            font-weight: bold;
-        }
+        .category-body { padding: 0.5rem; }
 
-        .font-semibold {
-            font-weight: 600;
+        /* ── Challenge Row ── */
+        .challenge-row {
+            display: flex; align-items: center; gap: 0.75rem;
+            padding: 0.6rem 0.75rem; border-radius: 0.5rem;
+            cursor: pointer; transition: background 0.15s;
         }
+        .challenge-row:hover { background: #333; }
+        .challenge-row.solved { background: rgba(34, 197, 94, 0.08); }
+        .challenge-row.solved:hover { background: rgba(34, 197, 94, 0.15); }
 
-        .opacity-75 {
-            opacity: 0.75;
+        .challenge-status {
+            width: 28px; height: 28px; border-radius: 50%;
+            display: flex; align-items: center; justify-content: center;
+            flex-shrink: 0; font-size: 0.75rem; font-weight: bold;
         }
+        .challenge-status.unsolved { border: 2px solid #555; color: #555; }
+        .challenge-status.done { background: #22c55e; color: #fff; border: none; }
 
-        .text-gray-300 {
-            color: #d1d5db;
+        .challenge-info { flex: 1; min-width: 0; }
+        .challenge-name {
+            font-size: 0.875rem; font-weight: 600;
+            white-space: nowrap; overflow: hidden; text-overflow: ellipsis; color: #e5e5e5;
         }
-
-        .text-gray-500 {
-            color: #6b7280;
+        .challenge-row.solved .challenge-name { color: #aaa; }
+        .challenge-desc {
+            font-size: 0.7rem; color: #777;
+            white-space: nowrap; overflow: hidden; text-overflow: ellipsis; margin-top: 1px;
         }
 
-        .grid {
-            display: grid;
-        }
+        .challenge-meta { display: flex; align-items: center; gap: 0.4rem; flex-shrink: 0; }
 
-        .grid-cols-1 {
-            grid-template-columns: repeat(1, minmax(0, 1fr));
-        }
-
-        @media (min-width: 768px) {
-            .md\:grid-cols-3 {
-                grid-template-columns: repeat(3, minmax(0, 1fr));
-            }
-        }
-
-        button {
-            cursor: pointer;
+        .badge {
+            display: inline-block; padding: 0.15rem 0.5rem;
+            border-radius: 0.2rem; font-size: 0.65rem; font-weight: 700;
+            text-transform: uppercase; letter-spacing: 0.03em;
         }
 
-        button:disabled {
-            opacity: 0.5;
-            cursor: not-allowed;
-        }
+        .badge-points { background: rgba(255,107,0,0.15); color: #ff6b00; border: 1px solid rgba(255,107,0,0.3); }
+        .badge-easy { background: rgba(34,197,94,0.15); color: #22c55e; }
+        .badge-medium { background: rgba(245,158,11,0.15); color: #f59e0b; }
+        .badge-hard { background: rgba(239,68,68,0.15); color: #ef4444; }
 
-        input[type="text"] {
-            background-color: #404040;
-            color: #ffffff;
-            border: 1px solid #606060;
-            border-radius: 0.25rem;
-            padding: 0.5rem;
-            width: 100%;
-            margin-bottom: 0.5rem;
+        .badge-tag {
+            font-size: 0.6rem; padding: 0.1rem 0.4rem; border-radius: 0.15rem;
+            text-transform: uppercase; letter-spacing: 0.04em; font-weight: 600;
         }
+        .tag-recon { background: rgba(139,92,246,0.15); color: #a78bfa; }
+        .tag-exploit { background: rgba(239,68,68,0.15); color: #f87171; }
+        .tag-analysis { background: rgba(59,130,246,0.15); color: #60a5fa; }
+        .tag-evasion { background: rgba(245,158,11,0.15); color: #fbbf24; }
+        .tag-defense { background: rgba(34,197,94,0.15); color: #4ade80; }
+        .tag-hardware { background: rgba(236,72,153,0.15); color: #f472b6; }
 
-        input[type="text"]:focus {
-            outline: none;
-            border-color: #ff6b00;
-        }
     </style>
 </head>
 <body>
-    <!-- Header -->
     <header>
-        <div class="flex items-center gap-4">
-            <button id="reset-btn" class="back-button bg-red-600 border-red-600 hover:bg-red-700" onclick="resetProgress()">Reset Progress</button>
-            <h1 class="text-2xl font-bold">{{ config.title or 'CybICS CTF Training' }}</h1>
+        <div style="display: flex; align-items: center; gap: 1rem;">
+            <h1>{{ config.title or 'CybICS CTF Training' }}</h1>
         </div>
-
-        <div class="text-right flex items-center gap-4">
-            <div>
-                <div class="text-lg font-bold">{{ total_points }} Points</div>
-                <div class="text-sm opacity-75">{{ solved|length }}/{{ challenges.values()|map(attribute='challenges')|map('length')|sum }} Challenges</div>
+        <div class="header-stats">
+            <div class="stat-item">
+                <div class="stat-value">{{ solved|length }}<span style="font-size: 0.7rem; color: #888; font-weight: normal;">/{{ challenges.values()|map(attribute='challenges')|map('length')|sum }}</span></div>
+                <div class="stat-label">Solved</div>
             </div>
-        </div>
-    </header>
-
-    <!-- Main container -->
-    <main class="container mx-auto px-4 py-8">
-        <!-- Progress Overview -->
-        <div class="category-card mb-8">
-            <h2 class="text-xl font-bold text-[#ff6b00] mb-4">Your Progress</h2>
-            <div class="progress-bar mb-4">
-                <div class="progress-fill" style="width: {{ (solved|length / (challenges.values()|map(attribute='challenges')|map('length')|sum) * 100)|round(1) if challenges else 0 }}%"></div>
+            <div class="stat-item">
+                <div class="stat-value">{{ total_points }}</div>
+                <div class="stat-label">Points</div>
             </div>
-            <div class="grid grid-cols-1 md:grid-cols-3 gap-4 text-center">
-                <div>
-                    <div class="text-2xl font-bold text-[#ff6b00]">{{ solved|length }}</div>
-                    <div class="text-sm opacity-75">Solved</div>
-                </div>
-                <div>
-                    <div class="text-2xl font-bold text-[#ff6b00]">{{ total_points }}</div>
-                    <div class="text-sm opacity-75">Total Points</div>
-                </div>
-                <div>
-                    <div class="text-2xl font-bold text-[#ff6b00]">{{ (solved|length / (challenges.values()|map(attribute='challenges')|map('length')|sum) * 100)|round(1) if challenges else 0 }}%</div>
-                    <div class="text-sm opacity-75">Complete</div>
+            <div class="stat-item">
+                <div class="progress-bar-mini">
+                    <div class="fill" style="width: {{ (solved|length / (challenges.values()|map(attribute='challenges')|map('length')|sum) * 100)|round(1) if challenges else 0 }}%"></div>
                 </div>
+                <div class="stat-label">{{ (solved|length / (challenges.values()|map(attribute='challenges')|map('length')|sum) * 100)|round(0)|int if challenges else 0 }}% complete</div>
             </div>
+            <button class="reset-btn" onclick="resetProgress()">Reset</button>
         </div>
+    </header>
 
-        <!-- Challenge Categories -->
-        {% for category_id, category in challenges.items() %}
-        <div class="category-card">
-            <h2 class="text-xl font-bold text-[#ff6b00] mb-2">{{ category.name }}</h2>
-            <p class="text-gray-300 mb-4">{{ category.description }}</p>
+    <main>
+        <div class="categories-grid" id="categories-grid">
+            {% set ns = namespace(step=1) %}
+            {% for category_id, category in challenges.items() %}
+            {% set cat_solved = category.challenges|selectattr('id', 'in', solved)|list|length %}
+            {% set cat_total = category.challenges|length %}
+            <div class="category-tile" data-category="{{ category_id }}" id="cat-{{ category_id }}">
+                <div class="category-header">
+                    <div class="category-title-group">
+                        <div class="step-badge">{{ ns.step }}</div>
+                        <div class="category-title">{{ category.name }}</div>
+                    </div>
+                    <div class="category-progress">
+                        <span>{{ cat_solved }}/{{ cat_total }}</span>
+                        <div class="category-progress-bar">
+                            <div class="fill" style="width: {{ (cat_solved / cat_total * 100)|round(0) if cat_total else 0 }}%"></div>
+                        </div>
+                    </div>
+                </div>
+                <div class="category-body">
+                    {% for challenge in category.challenges %}
+                    {% set is_solved = challenge.id in solved %}
+                    {% set difficulty = 'easy' if challenge.points <= 150 else ('medium' if challenge.points <= 250 else 'hard') %}
+                    <div class="challenge-row {% if is_solved %}solved{% endif %}"
+                         data-tag="{{ challenge.get('tag', '') }}"
+                         data-difficulty="{{ difficulty }}"
+                         data-solved="{{ 'true' if is_solved else 'false' }}"
+                         onclick="window.parent.postMessage({ type: 'navigate', url: '/ctf/challenge/{{ challenge.id }}' }, '*')">
+
+                        <div class="challenge-status {% if is_solved %}done{% else %}unsolved{% endif %}">
+                            {% if is_solved %}✓{% endif %}
+                        </div>
 
-            <div class="grid gap-4">
-                {% for challenge in category.challenges %}
-                <div class="challenge-card {% if challenge.id in solved %}solved{% endif %}"
-                     onclick="window.parent.postMessage({ type: 'navigate', url: '/ctf/challenge/{{ challenge.id }}' }, '*')">
-                    <div class="flex justify-between items-start mb-2">
-                        <h3 class="text-lg font-semibold">{{ challenge.title }}</h3>
-                        <div class="flex gap-2">
-                            <span class="badge badge-points">{{ challenge.points }} pts</span>
-                            {% if challenge.id in solved %}
-                            <span class="badge badge-solved">✓ Solved</span>
+                        <div class="challenge-info">
+                            <div class="challenge-name">{{ challenge.title }}</div>
+                            <div class="challenge-desc">{{ challenge.description }}</div>
+                        </div>
+
+                        <div class="challenge-meta">
+                            {% if challenge.get('tag') %}
+                            <span class="badge badge-tag tag-{{ challenge.tag }}">{{ challenge.tag }}</span>
+                            {% endif %}
+                            {% if difficulty == 'easy' %}
+                            <span class="badge badge-easy">Easy</span>
+                            {% elif difficulty == 'medium' %}
+                            <span class="badge badge-medium">Medium</span>
+                            {% else %}
+                            <span class="badge badge-hard">Hard</span>
                             {% endif %}
+                            <span class="badge badge-points">{{ challenge.points }}</span>
                         </div>
                     </div>
-                    <p class="text-gray-300">{{ challenge.description }}</p>
+                    {% endfor %}
                 </div>
-                {% endfor %}
             </div>
+            {% set ns.step = ns.step + 1 %}
+            {% endfor %}
         </div>
-        {% endfor %}
     </main>
 
     <script>
         function resetProgress() {
             if (confirm('Are you sure you want to reset all CTF progress? This action cannot be undone.')) {
-                fetch('/ctf/reset', {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json',
-                    }
-                })
-                .then(response => response.json())
-                .then(data => {
-                    if (data.success) {
-                        alert(data.message);
-                        location.reload();
-                    } else {
-                        alert('Error: ' + data.message);
-                    }
-                })
-                .catch(error => {
-                    console.error('Error:', error);
-                    alert('An error occurred while resetting progress.');
-                });
+                fetch('/ctf/reset', { method: 'POST', headers: { 'Content-Type': 'application/json' } })
+                .then(r => r.json())
+                .then(data => { if (data.success) location.reload(); else alert('Error: ' + data.message); })
+                .catch(() => alert('An error occurred while resetting progress.'));
             }
         }
     </script>
diff --git a/software/landing/templates/index.html b/software/landing/templates/index.html
index 35b36bca..226403b5 100644
--- a/software/landing/templates/index.html
+++ b/software/landing/templates/index.html
@@ -2095,9 +2095,53 @@ <h2>Welcome to CybICS</h2>
                 const ctfIframe = document.getElementById("ctf-iframe");
                 if (ctfIframe) {
                     ctfIframe.src = event.data.url;
+                    // Push to browser history so back/forward works
+                    const hash = '#ctf' + (event.data.url !== '/ctf' ? ':' + event.data.url : '');
+                    history.pushState({ view: 'ctf', ctfUrl: event.data.url }, '', hash);
                 }
             }
         });
+
+        // Push state when switching top-level views (called from button onclick)
+        const _origUpdateView = updateView;
+        updateView = function(view, skipHistory) {
+            _origUpdateView(view);
+            if (!skipHistory) {
+                history.pushState({ view: view }, '', '#' + view);
+            }
+        };
+
+        // Restore state on back/forward
+        window.addEventListener('popstate', (event) => {
+            if (event.state) {
+                const view = event.state.view || 'all';
+                _origUpdateView(view);
+                if (view === 'ctf' && event.state.ctfUrl) {
+                    const ctfIframe = document.getElementById("ctf-iframe");
+                    if (ctfIframe) ctfIframe.src = event.state.ctfUrl;
+                }
+            } else {
+                // No state — go to home
+                _origUpdateView('all');
+            }
+        });
+
+        // On initial load, restore from hash
+        (function() {
+            const hash = location.hash.slice(1);
+            if (hash) {
+                if (hash.startsWith('ctf:')) {
+                    _origUpdateView('ctf');
+                    const ctfUrl = hash.slice(4);
+                    const ctfIframe = document.getElementById("ctf-iframe");
+                    if (ctfIframe && ctfUrl) ctfIframe.src = ctfUrl;
+                    history.replaceState({ view: 'ctf', ctfUrl: ctfUrl }, '', location.hash);
+                } else {
+                    _origUpdateView(hash);
+                    history.replaceState({ view: hash }, '', location.hash);
+                }
+            }
+        })();
     </script>
 
     <!-- Settings Modal -->
diff --git a/training/README.md b/training/README.md
index 3e527bb6..aaf81af4 100644
--- a/training/README.md
+++ b/training/README.md
@@ -35,6 +35,10 @@ All training modules are mapped to industry-standard security frameworks to help
 | [UART Training](uart_basic/README.md) | Initial Access | Default Credentials, External Remote Services | T0812, T0822 |
 | [Detect Basic](detect_basic/README.md) | *Defensive* | D3FEND: Network Traffic Analysis, Protocol Metadata Anomaly Detection | D3-NTA |
 | [Detect Overwrite](detect_overwrite/README.md) | *Defensive* | D3FEND: Network Traffic Analysis, Operational Process Monitoring | D3-NTA, D3-OPM |
+| [Credential Hardening](defense_password/README.md) | *Defensive* | D3FEND: Strong Password Policy, Credential Rotation | D3-SPP |
+| [Modbus Firewall](defense_firewall/README.md) | *Defensive* | D3FEND: Inbound Traffic Filtering, Network Traffic Filtering | D3-ITF, D3-NTF |
+| [Network Segmentation](defense_network/README.md) | *Defensive* | D3FEND: Network Isolation | D3-NI |
+| [IDS Monitoring](defense_ids/README.md) | *Defensive* | D3FEND: Network Traffic Analysis, Protocol Metadata Anomaly Detection | D3-NTA, D3-PMAD |
 | [IDS Challenge](ids_challenge/README.md) | Discovery, Impair Process Control | Remote System Discovery, Denial of Service, Unauthorized Command Message | T0846, T0814, T0855 |
 | [IDS Evasion](ids_evasion/README.md) | Impair Process Control, Evasion | Unauthorized Command Message, Exploitation of Remote Services, Manipulation of Control | T0855, T0866, T0831 |
 | [IDS Forensics](ids_forensics/README.md) | *Defensive* | D3FEND: Network Traffic Analysis, Alert Triage | D3-NTA, D3-AT |
@@ -72,10 +76,16 @@ Alternatively, each training module has its own `requirements.txt` if you only w
 12. [Detect Basic](detect_basic/README.md) - Basic intrusion detection
 13. [Detect Overwrite](detect_overwrite/README.md) - Advanced detection techniques
 
-### 🔎 IDS Challenges
-14. [IDS Challenge](ids_challenge/README.md) - Trigger IDS detection rules and observe alerts
-15. [IDS Evasion](ids_evasion/README.md) - Perform stealth attacks below detection thresholds
-16. [IDS Forensics](ids_forensics/README.md) - Analyze IDS alert data for incident response
+### 🔍 IDS Challenges
+14. [IDS Challenge](ids_challenge/README.md) - Trigger IDS detection rules and retrieve the flag
+15. [IDS Forensics](ids_forensics/README.md) - Analyze IDS alert data for incident investigation
+16. [IDS Evasion](ids_evasion/README.md) - Perform stealth Modbus writes without triggering alerts
+
+### 🛡️ Defense & Hardening
+17. [Credential Hardening](defense_password/README.md) - Change default passwords on OpenPLC and FUXA
+18. [Modbus Firewall Rules](defense_firewall/README.md) - Restrict Modbus access with iptables
+19. [Network Segmentation](defense_network/README.md) - Block attack machine from critical services
+20. [IDS Monitoring & Tuning](defense_ids/README.md) - Ensure IDS is running and detecting threats
 
 ---
 
diff --git a/training/defense_firewall/README.md b/training/defense_firewall/README.md
new file mode 100644
index 00000000..3015bc63
--- /dev/null
+++ b/training/defense_firewall/README.md
@@ -0,0 +1,122 @@
+# 🔥 Modbus Firewall Rules
+
+> **MITRE D3FEND:** `Harden` | [D3-ITF - Inbound Traffic Filtering](https://d3fend.mitre.org/technique/d3f:InboundTrafficFiltering/) | [D3-NTF - Network Traffic Filtering](https://d3fend.mitre.org/technique/d3f:NetworkTrafficFiltering/)
+
+## 📋 Overview
+Modbus TCP (port 502) is an unauthenticated protocol — any device on the network can read and write PLC registers without credentials. In the previous attack challenges, you exploited this to flood registers and overwrite process values.
+
+This challenge requires you to apply **firewall rules** on the OpenPLC container to restrict Modbus access, ensuring only the authorized HMI (FUXA at 172.18.0.4) can communicate with the PLC.
+
+## 🏗️ Network Architecture
+
+```
+172.18.0.2  (hwio)       ──── Authorized (sensor data)
+172.18.0.3  (OpenPLC)    ──── TARGET: Apply firewall here
+172.18.0.4  (FUXA HMI)   ──── Authorized (HMI control)
+172.18.0.5  (OPC-UA)     ──── May need access
+172.18.0.100 (Attacker)  ──── BLOCK this
+```
+
+## 🎯 Task
+
+Add iptables rules on the **OpenPLC container** to restrict access to Modbus TCP (port 502). Only authorized hosts should be able to reach the PLC.
+
+The flag has the format `CybICS(flag)`.
+
+### ⚙️ Understanding iptables Rule Order
+
+**iptables evaluates rules top to bottom, and the first matching rule wins.** This means the order in which you add rules is critical:
+
+- **ACCEPT rules must come before DROP rules** — if a DROP rule matches first, traffic will be blocked even if a later ACCEPT rule would have allowed it.
+- A common pattern is to explicitly ACCEPT traffic from authorized sources first, then add a final DROP rule that blocks everything else.
+- If you add the DROP rule first, all traffic to that port will be blocked regardless of any ACCEPT rules added afterward.
+
+### 📝 Steps
+
+1. Access the OpenPLC container shell:
+   ```bash
+   docker exec -it <openplc_container_name> bash
+   ```
+
+2. Allow Modbus access from the hardware I/O service (172.18.0.2) and FUXA HMI (172.18.0.4):
+   ```bash
+   iptables -A INPUT -p tcp --dport 502 -s 172.18.0.2 -j ACCEPT
+   iptables -A INPUT -p tcp --dport 502 -s 172.18.0.4 -j ACCEPT
+   ```
+
+3. Block Modbus access from all other sources:
+   ```bash
+   iptables -A INPUT -p tcp --dport 502 -j DROP
+   ```
+
+4. Verify the rules are applied:
+   ```bash
+   iptables -L INPUT -n
+   ```
+
+5. Click **Verify Defense** on this challenge page to confirm.
+
+### ⚠️ Important Notes
+- The `hwio` service (172.18.0.2) must be able to write sensor values to OpenPLC via Modbus. Do not block it.
+- The `FUXA` HMI (172.18.0.4) needs Modbus access for process monitoring and control. Do not block it.
+- These rules are **not persistent** — they will be lost when the container restarts. In production, you would save them with `iptables-save`.
+
+## 🛡️ Security Framework References
+
+<details>
+  <summary>Click to expand</summary>
+
+### MITRE ATT&CK for ICS - Techniques Defended Against
+
+| Tactic | Technique | ID | Description |
+|--------|-----------|-----|-------------|
+| Impair Process Control | Unauthorized Command Message | [T0855](https://attack.mitre.org/techniques/T0855/) | Blocking unauthorized Modbus write commands |
+| Impair Process Control | Brute Force I/O | [T0806](https://attack.mitre.org/techniques/T0806/) | Preventing register flooding from unauthorized hosts |
+| Discovery | Remote System Discovery | [T0846](https://attack.mitre.org/techniques/T0846/) | Blocking port scanning of Modbus services |
+
+### MITRE D3FEND - Defensive Techniques Applied
+
+| Technique | ID | Description |
+|-----------|-----|-------------|
+| Inbound Traffic Filtering | [D3-ITF](https://d3fend.mitre.org/technique/d3f:InboundTrafficFiltering/) | Filtering inbound traffic based on source IP |
+| Network Traffic Filtering | [D3-NTF](https://d3fend.mitre.org/technique/d3f:NetworkTrafficFiltering/) | Restricting network traffic to authorized flows |
+
+### NIST SP 800-82r3 Reference
+
+| Control Family | Controls | Relevance |
+|----------------|----------|-----------|
+| **System and Communications Protection (SC)** | SC-7 | Boundary protection — restricting access to industrial protocols |
+| **Access Control (AC)** | AC-3, AC-4 | Access enforcement and information flow enforcement |
+
+**Why NIST 800-82r3 matters here:** NIST 800-82r3 Section 6.2.10 addresses the challenges of securing legacy protocols that lack built-in authentication. SC-7 (Boundary Protection) recommends implementing application-layer firewalls and access control lists to restrict which systems can communicate using industrial protocols. Since Modbus TCP has no authentication, network-level controls are the primary defense mechanism.
+
+</details>
+
+## 🔍 Defensive Thinking
+
+After completing this challenge, consider:
+- What happens if the FUXA HMI is compromised? The attacker now has authorized Modbus access.
+- How would you implement deep packet inspection for Modbus to allow reads but block writes?
+- What are the trade-offs between host-based firewalls (iptables) and network firewalls?
+- How would you make these rules persistent across container restarts?
+
+
+## 💡 Hints
+
+Use `docker exec -it <container> bash` to get a shell in the OpenPLC container. Then use `iptables -A INPUT` rules to ACCEPT traffic from authorized IPs (FUXA and hwio) on port 502 first, and DROP everything else to that port last. Remember: iptables processes rules top to bottom, first match wins.
+
+## 🔍 Solution
+
+1. Access the OpenPLC container shell:
+   ```bash
+   docker exec -it <openplc_container> bash
+   ```
+2. Allow Modbus (port 502) from authorized hosts only:
+   ```bash
+   iptables -A INPUT -p tcp --dport 502 -s 172.18.0.2 -j ACCEPT
+   iptables -A INPUT -p tcp --dport 502 -s 172.18.0.4 -j ACCEPT
+   iptables -A INPUT -p tcp --dport 502 -j DROP
+   ```
+3. Click **Verify Defense** in the CTF interface to receive the flag.
+
+**Flag:** `CybICS(f1r3w4ll_h4rd3n3d)`
diff --git a/training/defense_ids/README.md b/training/defense_ids/README.md
new file mode 100644
index 00000000..a964b323
--- /dev/null
+++ b/training/defense_ids/README.md
@@ -0,0 +1,130 @@
+# 🔍 IDS Monitoring & Tuning
+
+> **MITRE D3FEND:** `Detect` | [D3-NTA - Network Traffic Analysis](https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/) | [D3-PMAD - Protocol Metadata Anomaly Detection](https://d3fend.mitre.org/technique/d3f:ProtocolMetadataAnomalyDetection/)
+
+## 📋 Overview
+An Intrusion Detection System (IDS) is only effective when it is properly configured, actively monitoring, and tuned to detect relevant threats. A misconfigured or disabled IDS provides a false sense of security.
+
+This challenge requires you to ensure the CybICS IDS is fully operational and capable of detecting multiple types of attacks against the industrial network.
+
+## 🎯 Task
+
+Ensure the IDS meets all three criteria:
+
+The flag has the format `CybICS(flag)`.
+1. **Running** — The IDS service is operational
+2. **Capturing** — The IDS is actively monitoring network traffic
+3. **Detecting** — At least 3 different detection rules have been triggered
+
+### 📝 Steps
+
+#### Step 1: Access the IDS Dashboard
+Open a web browser and navigate to `http://<DEVICE_IP>:8443`
+
+#### Step 2: Start the IDS
+If the IDS is not running, start it from the dashboard or via the API:
+```bash
+curl -X POST http://localhost:8443/api/start
+```
+
+> **Important:** You must start the IDS **before** triggering any attacks. The IDS can only detect attacks that occur while it is actively capturing traffic. If you run attacks first and start the IDS afterward, those attacks will not be detected.
+
+#### Step 3: Trigger Detection Rules
+The IDS has 9 detection rules. You need to trigger at least 3 different ones. Execute the following attacks from the **webshell or attack machine** (172.18.0.100). Some examples:
+
+**Port Scan** (Rule: `port_scan`):
+```bash
+nmap -sS 172.18.0.3
+```
+
+**S7comm Enumeration** (Rule: `s7_enumeration`):
+```bash
+nmap --script s7-info -p 102 172.18.0.3
+```
+
+**Modbus Unauthorized Write** (Rule: `modbus_unauth_write`):
+```python
+from pymodbus.client import ModbusTcpClient
+client = ModbusTcpClient('172.18.0.3', port=502)
+client.connect()
+for i in range(15):
+    client.write_register(1124, 999)
+client.close()
+```
+
+#### Step 4: Verify Detection
+Check the IDS dashboard to confirm alerts have been generated from at least 3 different rules. Then click **Verify Defense** on this challenge page.
+
+## 🛡️ Security Framework References
+
+<details>
+  <summary>Click to expand</summary>
+
+### MITRE ATT&CK for ICS - Techniques Detected
+
+| Tactic | Technique | ID | Description |
+|--------|-----------|-----|-------------|
+| Discovery | Remote System Discovery | [T0846](https://attack.mitre.org/techniques/T0846/) | Port scanning and service enumeration |
+| Impair Process Control | Unauthorized Command Message | [T0855](https://attack.mitre.org/techniques/T0855/) | Unauthorized Modbus write commands |
+| Impact | Denial of Service | [T0814](https://attack.mitre.org/techniques/T0814/) | Flooding attacks against ICS protocols |
+
+### MITRE D3FEND - Defensive Techniques Applied
+
+| Technique | ID | Description |
+|-----------|-----|-------------|
+| Network Traffic Analysis | [D3-NTA](https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/) | Analyzing network traffic for attack patterns |
+| Protocol Metadata Anomaly Detection | [D3-PMAD](https://d3fend.mitre.org/technique/d3f:ProtocolMetadataAnomalyDetection/) | Detecting anomalies in industrial protocol traffic |
+
+### NIST SP 800-82r3 Reference
+
+| Control Family | Controls | Relevance |
+|----------------|----------|-----------|
+| **System and Information Integrity (SI)** | SI-4 | System monitoring — continuous IDS operation |
+| **Incident Response (IR)** | IR-4, IR-5 | Incident handling and monitoring |
+| **Audit and Accountability (AU)** | AU-6 | Audit review and analysis |
+
+**Why NIST 800-82r3 matters here:** NIST 800-82r3 Section 6.2.7 emphasizes continuous monitoring (SI-4) as essential for OT security. An IDS that is not actively monitoring traffic cannot detect attacks. Furthermore, AU-6 (Audit Review) requires that security alerts are reviewed and analyzed — simply having an IDS is not enough if no one monitors its output.
+
+</details>
+
+## 🔍 Defensive Thinking
+
+After completing this challenge, consider:
+- What is the difference between signature-based and anomaly-based detection in ICS?
+- How do you balance detection sensitivity with false positive rates?
+- What additional detection rules would you add for this environment?
+- How would you integrate IDS alerts with a SIEM for centralized monitoring?
+
+
+## 💡 Hints
+
+Start the IDS capture via `curl -X POST http://localhost:8443/api/start`, then trigger attacks from the webshell or attack machine. A quick port scan (`nmap -sS 172.18.0.3`), some Modbus writes, and an S7 access attempt will each trigger a different rule. Check the IDS dashboard to confirm 3+ rules have fired.
+
+## 🔍 Solution
+
+1. Start the IDS capture:
+   ```bash
+   curl -X POST http://localhost:8443/api/start
+   ```
+2. From the attack machine (172.18.0.100), trigger at least 3 different detection rules. For example:
+   ```bash
+   # Port scan (triggers port_scan rule)
+   nmap -sS 172.18.0.3
+
+   # S7comm enumeration (triggers s7_enumeration rule)
+   nmap --script s7-info -p 102 172.18.0.3
+
+   # Modbus unauthorized writes (triggers modbus_unauth_write rule)
+   python3 -c "
+   from pymodbus.client import ModbusTcpClient
+   client = ModbusTcpClient('172.18.0.3', port=502)
+   client.connect()
+   for i in range(15):
+       client.write_register(1124, 999)
+   client.close()
+   "
+   ```
+3. Verify that 3+ rules have fired on the IDS dashboard at `http://<DEVICE_IP>:8443`.
+4. Click **Verify Defense** in the CTF interface to receive the flag.
+
+**Flag:** `CybICS(1ds_tun3d)`
diff --git a/training/defense_network/README.md b/training/defense_network/README.md
new file mode 100644
index 00000000..6c2e632e
--- /dev/null
+++ b/training/defense_network/README.md
@@ -0,0 +1,127 @@
+# 🌐 Network Segmentation
+
+> **MITRE D3FEND:** `Isolate` | [D3-NI - Network Isolation](https://d3fend.mitre.org/technique/d3f:NetworkIsolation/)
+
+## 📋 Overview
+Network segmentation is a fundamental security principle that limits lateral movement by dividing a network into isolated zones. In ICS environments, proper segmentation prevents an attacker who compromises one system from easily accessing critical control systems.
+
+In the CybICS testbed, the attack machine (172.18.0.100) currently has unrestricted access to all services on the network. This challenge requires you to implement network-level controls that block the attack machine from reaching critical ICS services.
+
+## 🏗️ Network Architecture
+
+```
+┌──────────────────────────────────────────────────────┐
+│                 CybICS Network (172.18.0.0/24)       │
+│                                                      │
+│  ┌────────────┐  ┌────────────┐  ┌────────────┐    │
+│  │  OpenPLC   │  │   FUXA     │  │  OPC-UA    │    │
+│  │ 172.18.0.3 │  │ 172.18.0.4 │  │ 172.18.0.5 │    │
+│  │ :8080,:502 │  │   :1881    │  │   :4840    │    │
+│  └────────────┘  └────────────┘  └────────────┘    │
+│        ▲                                             │
+│        │ BLOCK                                       │
+│  ┌─────┴──────┐                                     │
+│  │  Attacker  │                                      │
+│  │172.18.0.100│                                      │
+│  └────────────┘                                      │
+└──────────────────────────────────────────────────────┘
+```
+
+## 🎯 Task
+
+Block the attack machine (172.18.0.100) from accessing the following critical services:
+
+The flag has the format `CybICS(flag)`.
+1. **OpenPLC Web UI** (172.18.0.3:8080)
+2. **Modbus TCP** (172.18.0.3:502)
+3. **OPC-UA Server** (172.18.0.5:4840)
+
+### 📝 Steps
+
+Apply iptables rules on each **target container** to drop inbound traffic from the attack machine. In a real ICS environment, these rules would be applied on network firewalls or switches — here we apply them directly on the containers to simulate the same effect.
+
+1. Access the OpenPLC container and block the attacker:
+   ```bash
+   docker exec -it <openplc_container> bash
+   iptables -A INPUT -s 172.18.0.100 -j DROP
+   ```
+
+2. Access the OPC-UA container and block the attacker:
+   ```bash
+   docker exec -it <opcua_container> bash
+   iptables -A INPUT -s 172.18.0.100 -j DROP
+   ```
+
+3. Verify the rules are applied on each container:
+   ```bash
+   iptables -L INPUT -n
+   ```
+
+4. Click **Verify Defense** on this challenge page to confirm.
+
+## ⚠️ Important Notes
+- Do not block legitimate traffic between authorized services (hwio, FUXA, etc.)
+- These rules are not persistent — they will be lost when containers restart
+- In production, you would use a dedicated firewall or SDN (Software-Defined Networking) for segmentation
+
+## 🛡️ Security Framework References
+
+<details>
+  <summary>Click to expand</summary>
+
+### MITRE ATT&CK for ICS - Techniques Defended Against
+
+| Tactic | Technique | ID | Description |
+|--------|-----------|-----|-------------|
+| Lateral Movement | Exploitation of Remote Services | [T0866](https://attack.mitre.org/techniques/T0866/) | Preventing lateral movement to ICS devices |
+| Discovery | Remote System Discovery | [T0846](https://attack.mitre.org/techniques/T0846/) | Blocking reconnaissance of ICS services |
+| Initial Access | External Remote Services | [T0822](https://attack.mitre.org/techniques/T0822/) | Restricting access from external/untrusted hosts |
+
+### MITRE D3FEND - Defensive Techniques Applied
+
+| Technique | ID | Description |
+|-----------|-----|-------------|
+| Network Isolation | [D3-NI](https://d3fend.mitre.org/technique/d3f:NetworkIsolation/) | Isolating critical systems from untrusted networks |
+| Broadcast Domain Isolation | [D3-BDI](https://d3fend.mitre.org/technique/d3f:BroadcastDomainIsolation/) | Segmenting network broadcast domains |
+| Inbound Traffic Filtering | [D3-ITF](https://d3fend.mitre.org/technique/d3f:InboundTrafficFiltering/) | Filtering inbound traffic from untrusted sources |
+
+### NIST SP 800-82r3 Reference
+
+| Control Family | Controls | Relevance |
+|----------------|----------|-----------|
+| **System and Communications Protection (SC)** | SC-7 | Boundary protection and network segmentation |
+| **Access Control (AC)** | AC-4 | Information flow enforcement between zones |
+
+**Why NIST 800-82r3 matters here:** NIST 800-82r3 Section 5.1.2 emphasizes defense-in-depth through network segmentation as a primary security control for OT environments. The Purdue Model recommends separating IT and OT networks into distinct security zones with controlled conduits between them. SC-7 (Boundary Protection) is one of the most critical controls for ICS — preventing an attacker from moving between the corporate network and the control system network.
+
+</details>
+
+## 🔍 Defensive Thinking
+
+After completing this challenge, consider:
+- What if the attacker compromises an authorized host (e.g., FUXA) first? How does segmentation help then?
+- How would you implement the Purdue Model zones in this environment?
+- What are the challenges of implementing network segmentation in brownfield (existing) ICS environments?
+- How does micro-segmentation differ from traditional VLAN-based segmentation?
+
+
+## 💡 Hints
+
+Add `iptables -A INPUT -s 172.18.0.100 -j DROP` on both the OpenPLC and OPC-UA containers. This blocks all traffic from the attack machine to those services.
+
+## 🔍 Solution
+
+1. Block the attacker on the OpenPLC container:
+   ```bash
+   docker exec -it <openplc_container> bash
+   iptables -A INPUT -s 172.18.0.100 -p tcp --dport 8080 -j DROP
+   iptables -A INPUT -s 172.18.0.100 -p tcp --dport 502 -j DROP
+   ```
+2. Block the attacker on the OPC-UA container:
+   ```bash
+   docker exec -it <opcua_container> bash
+   iptables -A INPUT -s 172.18.0.100 -p tcp --dport 4840 -j DROP
+   ```
+3. Click **Verify Defense** in the CTF interface to receive the flag.
+
+**Flag:** `CybICS(n3tw0rk_s3gm3nt3d)`
diff --git a/training/defense_password/README.md b/training/defense_password/README.md
new file mode 100644
index 00000000..6920b031
--- /dev/null
+++ b/training/defense_password/README.md
@@ -0,0 +1,95 @@
+# 🔐 Credential Hardening
+
+> **MITRE D3FEND:** `Harden` | [D3-SPP - Strong Password Policy](https://d3fend.mitre.org/technique/d3f:StrongPasswordPolicy/)
+
+## 📋 Overview
+Default credentials are one of the most common vulnerabilities in Industrial Control Systems. Many ICS devices ship with well-known default usernames and passwords that are documented in manuals and online databases. Attackers routinely scan for and exploit default credentials to gain unauthorized access to PLCs, HMIs, and engineering workstations.
+
+This challenge requires you to change the default passwords on two critical systems in the CybICS testbed: the **OpenPLC runtime** and the **FUXA HMI**.
+
+The flag has the format `CybICS(flag)`.
+
+## 🎯 Task 1: Harden OpenPLC Credentials
+
+The OpenPLC web interface runs on port **8080** and uses the default credentials:
+- **Username:** `openplc`
+- **Password:** `openplc`
+
+### 📝 Steps
+1. Open a web browser and navigate to `http://<DEVICE_IP>:8080`
+2. Log in with the default credentials
+3. Navigate to **Settings** > **Users**
+4. Change the password for the `openplc` user
+5. Click **Verify Defense** on this challenge page to confirm
+
+## 🎯 Task 2: Harden FUXA Credentials
+
+The FUXA HMI runs on port **1881** and uses the default admin credentials:
+- **Username:** `admin`
+- **Password:** `123456`
+
+### 📝 Steps
+1. Open a web browser and navigate to `http://<DEVICE_IP>:1881`
+2. Log in with the default admin credentials
+3. Open the **top-right menu** and navigate to the user settings to change the admin password
+4. Click **Verify Defense** on this challenge page to confirm
+
+## ⚠️ Important Notes
+- Remember your new passwords! If you forget them, you may need to restart the containers.
+- Choose passwords that are strong enough to resist dictionary attacks (the same attack you performed in the Password Attack challenge).
+- Do not change the usernames — only the passwords need to be changed.
+
+## 🛡️ Security Framework References
+
+<details>
+  <summary>Click to expand</summary>
+
+### MITRE ATT&CK for ICS - Techniques Defended Against
+
+| Tactic | Technique | ID | Description |
+|--------|-----------|-----|-------------|
+| Initial Access | Default Credentials | [T0812](https://attack.mitre.org/techniques/T0812/) | Adversaries use default credentials to gain initial access |
+| Persistence | Valid Accounts | [T0859](https://attack.mitre.org/techniques/T0859/) | Compromised credentials enable persistent access |
+
+### MITRE D3FEND - Defensive Techniques Applied
+
+| Technique | ID | Description |
+|-----------|-----|-------------|
+| Strong Password Policy | [D3-SPP](https://d3fend.mitre.org/technique/d3f:StrongPasswordPolicy/) | Enforcing strong, non-default passwords |
+| Credential Rotation | [D3-CR](https://d3fend.mitre.org/technique/d3f:CredentialRotation/) | Changing default credentials to prevent unauthorized access |
+| Authentication Event Monitoring | [D3-AEM](https://d3fend.mitre.org/technique/d3f:AuthenticationEventMonitoring/) | Monitoring for brute force and unauthorized login attempts |
+
+### NIST SP 800-82r3 Reference
+
+| Control Family | Controls | Relevance |
+|----------------|----------|-----------|
+| **Identification and Authentication (IA)** | IA-5 | Authenticator management — changing default passwords |
+| **Access Control (AC)** | AC-2 | Account management — proper credential configuration |
+| **Configuration Management (CM)** | CM-6 | Configuration settings — removing default configurations |
+
+**Why NIST 800-82r3 matters here:** NIST 800-82r3 Section 6.2.3 specifically addresses the challenge of default credentials in OT environments. IA-5 (Authenticator Management) requires organizations to change default authenticators upon installation. CM-6 (Configuration Settings) recommends establishing secure baseline configurations that do not include factory-default credentials. Many ICS security incidents begin with exploitation of default credentials — this is one of the simplest yet most impactful hardening steps.
+
+</details>
+
+## 🔍 Defensive Thinking
+
+After completing this challenge, consider:
+- How would you enforce a password policy on ICS devices that don't support it natively?
+- What are the risks of account lockout mechanisms in OT environments?
+- How would you manage credentials across dozens or hundreds of ICS devices?
+- What role does multi-factor authentication play in ICS environments?
+
+
+## 💡 Hints
+
+For OpenPLC, navigate to the web UI at port 8080, log in with `openplc`/`openplc`, then go to **Users** in the sidebar to find the password change option. For FUXA, access port 1881 and look for user settings in the top-right menu.
+
+## 🔍 Solution
+
+1. **OpenPLC** — Navigate to `http://<DEVICE_IP>:8080`, log in with the default credentials (`openplc`/`openplc`), go to **Settings** > **Users**, and change the password for the `openplc` user to something non-default.
+2. **FUXA** — Navigate to `http://<DEVICE_IP>:1881`, log in with the default credentials (`admin`/`123456`), open the top-right menu, navigate to user settings, and change the admin password.
+3. Click **Verify Defense** in the CTF interface for each task to receive the flag.
+
+**Flag (OpenPLC):** `CybICS(0penPLC_h4rd3n3d)`
+
+**Flag (FUXA):** `CybICS(FUXA_s3cur3d)`
diff --git a/training/detect_basic/README.md b/training/detect_basic/README.md
index a57abe5f..e0813af4 100644
--- a/training/detect_basic/README.md
+++ b/training/detect_basic/README.md
@@ -1,93 +1,132 @@
-# 🔍 Detection Training - Basic
+# 🔍 Detect Port Scan
 
-> **MITRE D3FEND:** `Detect` | [D3-NTA - Network Traffic Analysis](https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/) | [D3-PMAD - Protocol Metadata Anomaly Detection](https://d3fend.mitre.org/technique/d3f:ProtocolMetadataAnomalyDetection/)
+> **MITRE D3FEND:** `Detect` | [D3-NTA - Network Traffic Analysis](https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/) | [D3-CAA - Connection Attempt Analysis](https://d3fend.mitre.org/technique/d3f:ConnectionAttemptAnalysis/)
 
 ## 📋 Overview
-In this training, we focus on how to detect network scanning activities using PCAP (Packet Capture) data.
-PCAP files capture the raw network traffic data and are valuable for the security operation center (SOC) or forensic analysis of network communications.
-
-## 🎯 Network Scanning Techniques
-Attackers use different types of network scanning techniques to map out the network and gather intelligence.
-Common techniques include:
-
-### 1. 🎯 Ping Sweep
-- Attackers send ICMP Echo Requests to multiple IP addresses
-- Used to determine which hosts are online
-
-### 2. 🔍 Port Scanning
-Tools like Nmap are used to scan for open ports on target systems. Common scan types include:
-- **SYN scan (Half-Open Scan)**: Sends SYN packets to check if a port is open
-- **TCP Connect Scan**: Establishes a full TCP connection with the target port
-- **UDP Scan**: Tests for open UDP ports, commonly used on industrial protocols like Modbus (port 502)
-- **Service Detection**: Queries services running on open ports to determine their versions (e.g., OPC UA on port 4840)
-
-### 3. 🛠️ Application Layer Scanning
-- Attackers scan for specific application protocols
-- Targets industrial control protocols like Modbus, DNP3, or OPC UA
-- Helps identify system roles and functions
-
-## ⚠️ Importance of Detection
-Detecting and mitigating network scanning on industrial systems is a critical first step in preventing cyberattacks.
-By capturing and analyzing network traffic through PCAP files, security teams can:
-- Identify early signs of an attack
-- Take appropriate action before an adversary gains deeper access
-- Protect critical infrastructure
-
-## 🎯 Training Questions
-1. Which ports do the attacker scan?
-2. Which ports are open, and which are closed?
+
+Network scanning is typically the **earliest indicator** of an attack — adversaries must discover targets before they can exploit them. In this challenge you will perform a port scan against the ICS network, then verify that the CybICS IDS detected your scan and find the flag hidden in the IDS rule statistics.
+
+This teaches the full detection loop: **attacker action → network packets → IDS rule → observable alert → flag**.
+
+### Detection Rule: `port_scan`
+
+The IDS triggers the `port_scan` rule when it observes **5 or more unique destination ports** probed by a single source IP within a **10-second sliding window**.
+
+## 🎯 Task
+
+Perform a port scan, observe the IDS detection, and retrieve the flag from the IDS API.
+
+The flag has the format `CybICS(flag)`.
+
+---
+
+### Phase 1: Launch the Scan
+
+Run the provided reconnaissance script against the OpenPLC target:
+
+```bash
+python3 recon.py 172.18.0.3
+```
+
+This scans 6 industrial ports: **80** (HTTP), **102** (S7comm), **502** (Modbus), **4840** (OPC UA), **20000** (DNP3), **44818** (EtherNet/IP).
+
+Alternatively, use nmap directly:
+
+```bash
+nmap -sV 172.18.0.3
+```
+
+Note the output — which ports are **open** and which are **closed**?
+
+### Phase 2: Verify IDS Detection
+
+Your scan triggered the IDS. Open the IDS dashboard at [http://localhost:8443](http://localhost:8443) and check the **Alerts** tab. You should see a `port_scan` alert with your source IP.
+
+Query the IDS API to confirm:
+
+```bash
+curl -s http://localhost:8443/api/rules/stats | python3 -m json.tool
+```
+
+Look for the `port_scan` entry — if `count` is greater than 0, the rule has fired and the **flag is revealed** in the response.
+
+You can also query just the port_scan rule:
+
+```bash
+curl -s http://localhost:8443/api/rules/stats | python3 -c "
+import sys, json
+data = json.load(sys.stdin)
+ps = data.get('port_scan', {})
+print(f'Count: {ps.get(\"count\", 0)}')
+print(f'Flag:  {ps.get(\"flag\", \"Not yet — trigger the rule first\")}')
+"
+```
+
+### Phase 3: Understand the Detection
+
+Answer these questions to solidify your understanding:
+
+1. **How many ports did you scan?** (Check the recon.py output)
+2. **What is the IDS threshold for port_scan?** (5 ports in 10 seconds)
+3. **Did your scan exceed the threshold?** (6 ports > 5 threshold → YES)
+4. **What source IP appears in the alert?** (Your machine's IP on the 172.18.0.0/24 network)
+
+This demonstrates the detection pipeline:
+```
+Your scan (6 ports) → IDS sees SYN packets → 6 > 5 threshold → port_scan rule fires → Alert + Flag
+```
 
 ## 🛡️ Security Framework References
 
 <details>
-  <summary>Click to expand</summary>
+<summary>Click to expand</summary>
 
-### MITRE ATT&CK for ICS - Detected Techniques
-
-This training focuses on **detecting** the following adversary techniques:
+### MITRE ATT&CK for ICS — Detected Techniques
 
 | Tactic | Technique | ID | Description |
 |--------|-----------|-----|-------------|
 | Discovery | Remote System Discovery | [T0846](https://attack.mitre.org/techniques/T0846/) | Scanning to identify ICS devices |
 | Discovery | Network Connection Enumeration | [T0840](https://attack.mitre.org/techniques/T0840/) | Enumerating network connections and topology |
 
-**Why this matters:** Detection is the first step in incident response. Network scanning is typically the earliest indicator of an attack—adversaries must discover targets before they can exploit them. By learning to identify scanning patterns in PCAP data, you develop the foundational skills for security monitoring in ICS environments.
-
-### MITRE D3FEND - Defensive Techniques (Primary Focus)
+### MITRE D3FEND — Defensive Techniques
 
 | Technique | ID | Description |
 |-----------|-----|-------------|
 | Network Traffic Analysis | [D3-NTA](https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/) | Analyzing network traffic to detect malicious patterns |
-| Protocol Metadata Anomaly Detection | [D3-PMAD](https://d3fend.mitre.org/technique/d3f:ProtocolMetadataAnomalyDetection/) | Detecting anomalies in protocol behavior |
 | Connection Attempt Analysis | [D3-CAA](https://d3fend.mitre.org/technique/d3f:ConnectionAttemptAnalysis/) | Identifying scanning through connection patterns |
-| Packet Analysis | [D3-PA](https://d3fend.mitre.org/technique/d3f:PacketAnalysis/) | Deep inspection of packets for malicious indicators |
-
-**Detection indicators to look for:**
-- High volume of SYN packets from single source
-- Sequential port scanning patterns
-- Connection attempts to multiple ICS ports (102, 502, 4840, 20000, 44818)
-- Unusual source IPs contacting control system networks
 
 ### NIST SP 800-82r3 Reference
 
 | Control Family | Controls | Relevance |
 |----------------|----------|-----------|
-| **System and Information Integrity (SI)** | SI-4 | System monitoring—the core control for detection capabilities |
-| **Audit and Accountability (AU)** | AU-3, AU-6, AU-12 | Audit record content, review, and generation |
-| **Incident Response (IR)** | IR-4, IR-5, IR-6 | Incident handling, monitoring, and reporting |
+| **System and Information Integrity (SI)** | SI-4 | System monitoring — the core control for detection |
+| **Audit and Accountability (AU)** | AU-3, AU-6 | Audit record content and review |
 
-**Why NIST 800-82r3 matters here:** NIST 800-82r3 Section 6.2.7 emphasizes the importance of continuous monitoring (SI-4) in OT environments. Unlike IT systems where signature-based detection dominates, OT environments benefit from anomaly detection because "normal" traffic patterns are more predictable. AU-6 (Audit Review, Analysis, and Reporting) recommends regular review of captured traffic—this training teaches you what to look for during that review. IR-4 (Incident Handling) capabilities depend on first having the detection skills practiced here.
+**Why NIST 800-82r3 matters here:** NIST 800-82r3 Section 6.2.7 emphasizes continuous monitoring (SI-4) in OT environments. Unlike IT systems where signature-based detection dominates, OT environments benefit from anomaly detection because "normal" traffic patterns are more predictable — a port scan stands out clearly.
 
 </details>
 
+## 🔍 Defensive Thinking
+
+After completing this challenge, consider:
+- What if the attacker scanned only 4 ports (below the threshold)? Would the IDS detect it?
+- How would you detect slow scans (1 port every 30 seconds)?
+- What other protocols besides TCP could be used for reconnaissance?
+- How does the IDS distinguish a legitimate service check from a malicious scan?
+
+
+## 💡 Hints
+
+Run the scan, then query `http://localhost:8443/api/rules/stats`. Look at the `port_scan` entry — when `count > 0`, a `flag` field appears in the JSON response with the CTF flag.
+
 ## 🔍 Solution
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
+Run a port scan against the target, then query the IDS rule statistics API:
 
-  After completion, use the following flag:
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(basic_detection_complete)
-  </div>
+```bash
+curl -s http://localhost:8443/api/rules/stats
+```
 
-</details>
+Look for the `flag` field in the `port_scan` entry when `count > 0`.
+
+**Flag:** `CybICS(sc4n_d3tect3d)`
diff --git a/training/detect_overwrite/README.md b/training/detect_overwrite/README.md
index f4b246c8..8ef66e76 100644
--- a/training/detect_overwrite/README.md
+++ b/training/detect_overwrite/README.md
@@ -1,54 +1,139 @@
-# 🔍 Detection Training - Override
+# 🔥 Detect Modbus Flooding
 
 > **MITRE D3FEND:** `Detect` | [D3-NTA - Network Traffic Analysis](https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/) | [D3-OPM - Operational Process Monitoring](https://d3fend.mitre.org/technique/d3f:OperationalProcessMonitoring/)
 
 ## 📋 Overview
-One common attack is Modbus TCP register flooding, where an attacker sends a continuous stream of malicious Modbus commands to overwrite or spoof register values.
-This can disrupt processes, cause equipment failure, or provide incorrect data to operators.
-This training focuses on how to detect this type of attack by analyzing network traffic and monitoring system behavior.
-
-## 🎯 Indicators of Modbus Flooding Attacks
-Detecting Modbus flooding and register overwriting attacks requires understanding how normal Modbus traffic behaves and recognizing anomalies in the communication pattern. Key indicators include:
-
-### 1. 📈 High Frequency of Modbus Write Requests
-Modbus systems typically have a stable frequency of write operations. A sudden spike in write requests, particularly to the same registers, is a sign of flooding. Monitor for:
-- Unusual write frequencies: Multiple write commands to the same register in a short time span
-- Repeated overwrites: The same register being modified continuously
-
-### 2. 🔄 Unexplained Process Values Changes
-When a Modbus register is being spoofed, the values stored in registers might change frequently without corresponding physical events. For example:
-- A temperature sensor reports fluctuating values despite stable environmental conditions
-- Equipment parameters (e.g., pressure, motor speed) are altered without operator action
-
-### 3. 🚫 Unusual Source IPs or Unauthorized Devices
-Flooding may come from unauthorized IP addresses or devices not normally involved in the communication. Look for:
-- Write commands originating from unknown sources
-- Devices sending Modbus traffic that do not typically perform write operations
-
-### 4. 📊 Network Traffic Abnormalities
-Flooding often generates a high volume of packets, potentially leading to congestion or delays in legitimate traffic. Watch for:
-- Unusually high Modbus traffic: A sharp increase in Modbus TCP packets on the network
-- Packet loss: Legitimate Modbus traffic may be delayed or dropped due to the attack
-
-## ❓ Training Questions
-1. What is happening with the physical process?
-2. What can you observe within the network capture?
-
-## ⚠️ Important Note
-***!!! Execute the python script without looking into it !!!***
-
-```sh
-python3 override.py <DEVICE_IP>
-```
+
+Modbus TCP has **no authentication** — any device on the network can write to PLC registers. A flooding attack sends hundreds or thousands of write commands per second to overwrite process values, disrupting the physical process.
+
+In this challenge you will launch a Modbus flooding attack, observe its impact on the physical process, verify the IDS detected it, analyze the attack in a packet capture, and retrieve the flag from the IDS.
+
+### Detection Rules
+
+The IDS has two rules that detect Modbus write attacks:
+
+| Rule | Threshold | What It Detects |
+|------|-----------|-----------------|
+| `modbus_flood` | **50 writes in 5 seconds** | High-rate Modbus writes (flooding) |
+| `modbus_unauth_write` | **10 writes in 30 seconds** | Modbus writes from unauthorized sources |
+
+The flooding script sends ~1000 writes/second — far above both thresholds.
+
+## 🎯 Task
+
+Launch the attack, observe the IDS detection, capture and analyze the traffic, and find the flag.
+
+The flag has the format `CybICS(flag)`.
+
+---
+
+### Phase 1: Launch the Attack
+
+> **Important:** Run the script first **without looking at its source code** — observe the effects before understanding the cause.
+
+1. Open the FUXA HMI at [http://localhost:1881](http://localhost:1881) in one browser tab to watch the physical process.
+
+2. In a terminal, start a packet capture (stop it later with Ctrl+C):
+   ```bash
+   tcpdump -i any -w modbus_attack.pcap 'tcp port 502' &
+   ```
+
+3. Run the attack script:
+   ```bash
+   python3 override.py 172.18.0.3
+   ```
+
+4. Watch the FUXA HMI — what happens to the process values? The Gas Storage Tank (GST) register is being overwritten with a fixed value.
+
+5. After ~30 seconds, stop the attack (Ctrl+C) and stop tcpdump (`kill %1`).
+
+### Phase 2: IDS Analysis
+
+Your attack triggered IDS alerts. Verify this:
+
+1. Open the IDS dashboard at [http://localhost:8443](http://localhost:8443) and check the **Alerts** tab.
+
+2. Query the rule statistics:
+   ```bash
+   curl -s http://localhost:8443/api/rules/stats | python3 -m json.tool
+   ```
+
+3. Look at the `modbus_flood` entry — when `count > 0`, the **flag is revealed** in the response:
+   ```bash
+   curl -s http://localhost:8443/api/rules/stats | python3 -c "
+   import sys, json
+   data = json.load(sys.stdin)
+   for rule in ['modbus_flood', 'modbus_unauth_write']:
+       r = data.get(rule, {})
+       print(f'{rule}: count={r.get(\"count\", 0)}, flag={r.get(\"flag\", \"-\")}')
+   "
+   ```
+
+4. Check the alert details — what source IP was detected? What severity?
+   ```bash
+   curl -s http://localhost:8443/api/alerts | python3 -c "
+   import sys, json
+   for a in json.load(sys.stdin).get('alerts', []):
+       if 'modbus' in a['rule']:
+           print(f\"{a['rule']:25s} | {a['src']:15s} -> {a['dst']:15s} | {a['severity']}\")
+   "
+   ```
+
+### Phase 3: PCAP Forensics
+
+Analyze the captured traffic to understand the attack pattern:
+
+1. Open the packet capture in Wireshark (or use tshark):
+   ```bash
+   wireshark modbus_attack.pcap
+   ```
+
+2. Apply this filter to see only Modbus write commands:
+   ```
+   modbus.func_code == 6 || modbus.func_code == 16
+   ```
+
+3. Answer these analysis questions:
+
+   | Question | How to Find It |
+   |----------|---------------|
+   | How many total Modbus write packets? | Wireshark status bar after applying filter |
+   | What is the write rate (writes/second)? | Total writes / capture duration |
+   | Which register is being overwritten? | Check Modbus payload: register address 1124 |
+   | What value is being written? | Check Modbus payload: value = 1 |
+   | What is the attacker's source IP? | Source column in Wireshark |
+
+4. Use Wireshark's **IO Graph** (Statistics -> IO Graphs) to visualize the write rate spike:
+   - Display filter: `modbus.func_code == 16`
+   - This shows the dramatic spike during the flooding attack
+
+### Phase 4: Correlation
+
+Connect your findings across all three data sources:
+
+| Data Point | PCAP (Wireshark) | IDS Alert | Match? |
+|------------|-------------------|-----------|--------|
+| Attacker IP | ___________ | ___________ | Yes / No |
+| Target IP | ___________ | ___________ | Yes / No |
+| Write rate | ___/sec | Threshold: 50/5s | Exceeded? |
+| Rule triggered | N/A | `modbus_flood` | |
+
+**Why did `modbus_flood` fire?**
+- Threshold: 50 writes in 5 seconds
+- Your attack: ~1000 writes/second = ~5000 writes in 5 seconds
+- 5000 >> 50 = rule triggered
+
+**Why did `modbus_unauth_write` fire?**
+- Threshold: 10 writes in 30 seconds from a non-service IP
+- Your attack machine is not in the authorized Modbus writers list (hwio, fuxa)
+- Any write from your IP triggers this rule after 10 writes
 
 ## 🛡️ Security Framework References
 
 <details>
-  <summary>Click to expand</summary>
-
-### MITRE ATT&CK for ICS - Detected Techniques
+<summary>Click to expand</summary>
 
-This training focuses on **detecting** the following adversary techniques:
+### MITRE ATT&CK for ICS — Detected Techniques
 
 | Tactic | Technique | ID | Description |
 |--------|-----------|-----|-------------|
@@ -56,61 +141,46 @@ This training focuses on **detecting** the following adversary techniques:
 | Impair Process Control | Unauthorized Command Message | [T0855](https://attack.mitre.org/techniques/T0855/) | Sending unauthorized commands to ICS devices |
 | Impair Process Control | Brute Force I/O | [T0806](https://attack.mitre.org/techniques/T0806/) | Repeatedly overwriting I/O values |
 
-**Why this matters:** Detecting ongoing attacks is more challenging than detecting reconnaissance. Register flooding attacks actively manipulate the process while you're trying to detect them. This training simulates the pressure of real incident response—you must identify the attack, understand its impact, and gather evidence while the attack continues.
-
-### MITRE D3FEND - Defensive Techniques (Primary Focus)
+### MITRE D3FEND — Defensive Techniques
 
 | Technique | ID | Description |
 |-----------|-----|-------------|
-| Network Traffic Analysis | [D3-NTA](https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/) | Analyzing Modbus traffic for anomalies |
+| Network Traffic Analysis | [D3-NTA](https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/) | Analyzing Modbus traffic for flooding patterns |
 | Operational Process Monitoring | [D3-OPM](https://d3fend.mitre.org/technique/d3f:OperationalProcessMonitoring/) | Monitoring process values for unexpected changes |
-| Message Analysis | [D3-MA](https://d3fend.mitre.org/technique/d3f:MessageAnalysis/) | Analyzing message content to identify malicious commands |
-| Baseline Deviation Detection | [D3-BDD](https://d3fend.mitre.org/technique/d3f:BaselineDeviationDetection/) | Detecting deviations from normal traffic baselines |
-
-**Detection indicators to look for:**
-- Abnormally high frequency of Modbus write commands (Function Code 6 or 16)
-- Repeated writes to the same register address
-- Write commands from unexpected source IPs
-- Process values that don't match expected physics (e.g., pressure changing faster than physically possible)
 
 ### NIST SP 800-82r3 Reference
 
 | Control Family | Controls | Relevance |
 |----------------|----------|-----------|
-| **System and Information Integrity (SI)** | SI-4, SI-7 | System monitoring and software/information integrity |
-| **Audit and Accountability (AU)** | AU-3, AU-6 | Detailed audit records and automated review |
+| **System and Information Integrity (SI)** | SI-4, SI-7 | System monitoring and integrity verification |
+| **Audit and Accountability (AU)** | AU-3, AU-6 | Audit record content and automated review |
 | **Incident Response (IR)** | IR-4, IR-5 | Incident handling and monitoring |
-| **System and Communications Protection (SC)** | SC-5, SC-7 | Denial of service protection and boundary protection |
 
-**Why NIST 800-82r3 matters here:** NIST 800-82r3 Section 6.2.7 recommends both network-based and process-based monitoring for comprehensive detection. SI-4 (System Monitoring) should include industrial protocol-aware intrusion detection systems (IDS) that understand Modbus semantics. SC-5 (Denial of Service Protection) recommends rate limiting and anomaly detection for industrial protocols. This training teaches you to correlate network observations (high write frequency) with process observations (unexpected pressure changes)—the hallmark of effective OT security monitoring.
+**Why NIST 800-82r3 matters here:** NIST 800-82r3 Section 6.2.7 emphasizes that OT monitoring (SI-4) must include both network-level detection (IDS alerts) and process-level monitoring (register values). The combination of PCAP forensics and IDS analysis practiced here mirrors real SOC workflows where analysts correlate multiple data sources during incident response.
 
 </details>
 
+## 🔍 Defensive Thinking
+
+After completing this challenge, consider:
+- The attack sends ~1000 writes/second but the threshold is only 50/5s. How would you lower the threshold without causing false positives from legitimate FUXA polling?
+- What if the attacker sent only 9 writes per 30 seconds (below `modbus_unauth_write` threshold)? The **IDS Evasion** challenge explores exactly this.
+- How would you implement **allowlisting** so only FUXA and hwio can write to Modbus?
+- What process-level indicators (register values, control loop behavior) could supplement network detection?
+
+
+## 💡 Hints
+
+Run `override.py` against the PLC, then query `http://localhost:8443/api/rules/stats`. Look at the `modbus_flood` entry — when `count > 0`, a `flag` field appears in the JSON response. For the PCAP analysis, use Wireshark filter `modbus.func_code == 16` to isolate the write commands.
+
 ## 🔍 Solution
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
-
-  ### 🔍 Wireshark Analysis
-
-  #### 📡 Modbus Filter
-  To filter only Modbus traffic, use the following filter in Wireshark:
-  ```sh
-  tcp.port == 502
-  ```
-
-  #### ✍️ Identifying Excessive Write Requests
-  Apply a filter for Modbus function codes responsible for writing registers:
-  ```sh
-  modbus.func_code == 6 || modbus.func_code == 16
-  ```
-  Look for a large number of write requests to the same register (e.g., modbus.reference_num indicates the register address).
-
-  #### 📊 IO Graphs
-  Use Wireshark's IO Graphs to visualize the traffic over time. A spike in the number of write requests is a strong indicator of flooding.
-
-  After completion, use the following flag:
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(detection_evasion_complete)
-  </div>
-</details>
\ No newline at end of file
+Run the Modbus flooding attack, then query the IDS rule statistics API:
+
+```bash
+curl -s http://localhost:8443/api/rules/stats
+```
+
+Look for the `flag` field in the `modbus_flood` entry when `count > 0`.
+
+**Flag:** `CybICS(m0dbus_fl00d_d3tect3d)`
diff --git a/training/flood_overwrite/README.md b/training/flood_overwrite/README.md
index 73a67608..b4188e93 100644
--- a/training/flood_overwrite/README.md
+++ b/training/flood_overwrite/README.md
@@ -55,6 +55,14 @@ Check if these settings are correct, before executing the flooding script.
 ### 📚 Prerequisites
 A basic understanding of Modbus/TCP is required for this example.
 
+## 🎯 Task
+The flag has the format `CybICS(flag)`.
+
+1. Run the provided `flooding_hpt.py` script to flood Modbus registers on the PLC
+2. While the attack is running, open the **FUXA HMI** and observe how the physical process responds to the manipulated register values
+3. You should see the high pressure tank (HPT) register values being overwritten, causing the compressor (C) to remain enabled continuously, which drives the HPT toward a critical pressure value
+4. After observing the impact, retrieve the flag
+
 ## 🛡️ Security Framework References
 
 <details>
@@ -90,12 +98,14 @@ A basic understanding of Modbus/TCP is required for this example.
 
 </details>
 
-## 🔍 Solution
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
+## 💡 Hints
+
+Run `python3 flooding_hpt.py` and check the FUXA HMI dashboard for changes in pressure readings.
 
-  ### 🚀 Running the Attack
+## 🔍 Solution
+
+### 🚀 Running the Attack
   Execute the provided script to flood the sensor values of the high pressure tank (HPT):
   ```sh
   python3 flooding_hpt.py
@@ -125,8 +135,6 @@ A basic understanding of Modbus/TCP is required for this example.
   - Potential actions: reducing heat or shutting down components
 
   After completion, use the following flag:
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(flood_attack_successful)
-  </div>
-</details>
+
+**Flag:** `CybICS(flood_attack_successful)`
 
diff --git a/training/fuzzingMB/README.md b/training/fuzzingMB/README.md
index 2d30dc9a..55cdf39e 100644
--- a/training/fuzzingMB/README.md
+++ b/training/fuzzingMB/README.md
@@ -27,6 +27,18 @@ There are different approaches to network fuzzing:
 - **📖 Protocol Complexity** – Some protocols require deep understanding
 - **⚖️ Legal and Ethical Considerations** – Unauthorized fuzzing can violate laws
 
+## 🎯 Task
+The target for this exercise is the **OpenPLC Modbus service running on port 502**. Your goal is to run the Modbus fuzzer against the PLC's Modbus port to test how the device handles malformed or unexpected Modbus/TCP messages. After completing the fuzzing exercise, you will receive the flag.
+
+The flag has the format `CybICS(flag)`.
+
+### Steps
+1. Clone the Modbus fuzzer repository
+2. Install Python dependencies with pip
+3. Run the fuzzer against the OpenPLC Modbus service on port 502
+4. Select a fuzzing mode from the menu and let the fuzzer run to completion
+5. Retrieve the flag after completing the fuzzing exercise
+
 ## 🚀 Using the Modbus Fuzzer
 
 ### 🔧 Setup Steps
@@ -115,14 +127,13 @@ Grab a coffee ☕☕☕☕ while the fuzzer runs
 
 </details>
 
-## 🔍 Solution
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
+## 💡 Hints
 
-  After completion, use the following flag:
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(modbus_fuzzing_complete)
-  </div>
+Run the fuzzer with `python3 modbus_fuzzer.py`, enter the target IP and port 502 when prompted, then select option 1 from the interactive menu to fuzz all function codes.
 
-</details>
+## 🔍 Solution
+
+After completion, use the following flag:
+
+**Flag:** `CybICS(modbus_fuzzing_complete)`
diff --git a/training/ids_challenge/README.md b/training/ids_challenge/README.md
index d2c93928..310ed14a 100644
--- a/training/ids_challenge/README.md
+++ b/training/ids_challenge/README.md
@@ -1,32 +1,29 @@
-# Intrusion Detection System Challenge
+# 🔍 Intrusion Detection System Challenge
 
-## Objective
+> **MITRE ATT&CK for ICS:** `Discovery` | [T0846 - Remote System Discovery](https://attack.mitre.org/techniques/T0846/) | [T0855 - Unauthorized Command Message](https://attack.mitre.org/techniques/T0855/)
 
-Learn how intrusion detection systems (IDS) work in industrial control environments by interacting with the CybICS IDS and triggering real detection rules.
-
-## Background
+## 📋 Overview
 
 Industrial Control Systems (ICS) are often deployed without proper network monitoring. An IDS watches network traffic for signs of reconnaissance, unauthorized access, and attacks against industrial protocols like Modbus TCP, S7comm, and OPC-UA.
 
 The CybICS IDS is a lightweight, purpose-built IDS designed for ICS environments. It monitors the CybICS network (172.18.0.0/24) and applies detection rules based on MITRE ATT&CK for ICS.
 
-## MITRE ATT&CK for ICS Alignment
+## 🎯 Task
 
-| Technique | ID | Detection Rule |
-|---|---|---|
-| Remote System Discovery | T0846 | Port scan, S7 enumeration, OPC-UA access |
-| Denial of Service | T0814 | SYN flood, Modbus write flood |
-| Unauthorized Command Message | T0855 | Modbus writes from unexpected sources |
-| Spoof Reporting Message | T0856 | ARP spoofing |
-| Default Credentials | T0812 | HTTP brute force against OpenPLC/FUXA |
+Learn how intrusion detection systems work in ICS environments by interacting with the CybICS IDS and triggering real detection rules.
 
-## Task
+The flag has the format `CybICS(flag)`.
 
 1. **Access the IDS Dashboard** at [http://localhost:8443](http://localhost:8443)
 2. Ensure the IDS is running (it auto-starts by default)
 3. **Trigger at least 3 different detection rules** using the attack machine or webshell
+4. **Observe the alerts** on the IDS dashboard
+5. Once you have triggered at least 3 alerts, retrieve the flag:
+   ```bash
+   curl http://localhost:8443/api/flag
+   ```
 
-### Suggested Attacks to Trigger
+### 📝 Suggested Attacks to Trigger
 
 From the attack machine (http://localhost:6081/vnc.html) or webshell:
 
@@ -56,32 +53,67 @@ for i in range(15):
 client.close()
 ```
 
-4. **Observe the alerts** on the IDS dashboard
-5. Once you have triggered at least 3 alerts, visit the flag endpoint:
-   ```
-   curl http://localhost:8443/api/flag
-   ```
-
-## Detection Rules
+## 📖 Detection Rules
 
 The CybICS IDS implements 9 detection rules:
 
-1. **Port Scan** - Detects SYN packets to multiple ports on a single target
-2. **SYN Flood** - Detects excessive SYN packets from a single source
-3. **Modbus Write Flood** - Detects high-rate Modbus write operations
-4. **Modbus Unauthorized Write** - Detects Modbus writes from non-service hosts
-5. **Modbus Diagnostic** - Detects use of diagnostic function codes
-6. **S7comm Enumeration** - Detects S7 protocol access attempts
-7. **HTTP Brute Force** - Detects repeated login attempts on OpenPLC/FUXA
-8. **ARP Spoofing** - Detects multiple MAC addresses for a single IP
-9. **OPC-UA Unauthorized Access** - Detects OPC-UA connections from unknown hosts
+1. **Port Scan** — Detects SYN packets to multiple ports on a single target
+2. **SYN Flood** — Detects excessive SYN packets from a single source
+3. **Modbus Write Flood** — Detects high-rate Modbus write operations
+4. **Modbus Unauthorized Write** — Detects Modbus writes from non-service hosts
+5. **Modbus Diagnostic** — Detects use of diagnostic function codes
+6. **S7comm Enumeration** — Detects S7 protocol access attempts
+7. **HTTP Brute Force** — Detects repeated login attempts on OpenPLC/FUXA
+8. **ARP Spoofing** — Detects multiple MAC addresses for a single IP
+9. **OPC-UA Unauthorized Access** — Detects OPC-UA connections from unknown hosts
 
-## Defensive Thinking
+## 🛡️ Security Framework References
 
-After completing the offensive tasks, consider:
+<details>
+  <summary>Click to expand</summary>
+
+### MITRE ATT&CK for ICS — Techniques Detected
+
+| Tactic | Technique | ID | Description |
+|--------|-----------|-----|-------------|
+| Discovery | Remote System Discovery | [T0846](https://attack.mitre.org/techniques/T0846/) | Port scan, S7 enumeration, OPC-UA access |
+| Impact | Denial of Service | [T0836](https://attack.mitre.org/techniques/T0836/) | SYN flood, Modbus write flood |
+| Impair Process Control | Unauthorized Command Message | [T0855](https://attack.mitre.org/techniques/T0855/) | Modbus writes from unexpected sources |
+| Collection | Spoof Reporting Message | [T0856](https://attack.mitre.org/techniques/T0856/) | ARP spoofing |
+| Initial Access | Default Credentials | [T0812](https://attack.mitre.org/techniques/T0812/) | HTTP brute force against OpenPLC/FUXA |
+
+### NIST SP 800-82r3 Reference
+
+| Control Family | Controls | Relevance |
+|----------------|----------|-----------|
+| **System and Information Integrity (SI)** | SI-4 | Information system monitoring — detecting attacks in real time |
+| **Incident Response (IR)** | IR-4, IR-5 | Incident handling and monitoring |
+| **Audit and Accountability (AU)** | AU-6 | Audit review, analysis, and reporting |
 
+**Why NIST 800-82r3 matters here:** NIST 800-82r3 Section 6.2.7 emphasizes continuous monitoring (SI-4) as essential for OT security. An IDS that is not actively monitoring traffic cannot detect attacks. Understanding which attacks are detectable — and which are not — is a fundamental skill for both attackers and defenders in ICS environments.
+
+</details>
+
+## 🔍 Defensive Thinking
+
+After completing the offensive tasks, consider:
 - Which attacks were detected? Which were missed?
 - How could you modify your attacks to evade detection?
 - What additional rules would you add to improve detection?
 - How would you implement alerting (email, SMS, SIEM integration)?
 - What is the trade-off between detection sensitivity and false positives?
+
+
+## 💡 Hints
+
+You need to trigger at least 3 different IDS rules. Try a port scan (nmap), Modbus writes (pymodbus), and S7 access (nmap s7-info script). After triggering alerts, check the flag endpoint at `/api/flag`.
+
+## 🔍 Solution
+
+After triggering 3 or more detection rules (e.g., port scan, Modbus writes, S7 enumeration), retrieve the flag:
+
+```bash
+curl http://localhost:8443/api/flag
+```
+
+**Flag:** `CybICS(1ntrusi0n_d3tect3d)`
diff --git a/training/ids_evasion/README.md b/training/ids_evasion/README.md
index 6dd23811..1320c835 100644
--- a/training/ids_evasion/README.md
+++ b/training/ids_evasion/README.md
@@ -1,42 +1,28 @@
-# IDS Evasion Challenge
+# 🥷 IDS Evasion Challenge
 
-## Objective
+> **MITRE ATT&CK for ICS:** `Evasion` | [T0820 - Exploitation for Evasion](https://attack.mitre.org/techniques/T0820/) | [T0855 - Unauthorized Command Message](https://attack.mitre.org/techniques/T0855/)
 
-Perform a stealth Modbus write operation against the OpenPLC controller without triggering any IDS alerts. This challenge tests your understanding of IDS detection thresholds and evasion techniques.
-
-## Background
+## 📋 Overview
 
 Real-world attackers study intrusion detection systems to understand their detection logic and thresholds. By operating below these thresholds ("low-and-slow" attacks), they can manipulate industrial processes without triggering alerts.
 
 This challenge simulates that scenario: you must write to Modbus registers on the PLC while staying invisible to the CybICS IDS. Understanding the detection rules and their exact thresholds is the key to success.
 
-## MITRE ATT&CK for ICS Alignment
-
-| Technique | ID | Relevance |
-|---|---|---|
-| Exploitation of Remote Services | T0866 | Accessing PLC via Modbus protocol |
-| Unauthorized Command Message | T0855 | Writing to PLC registers |
-| Evasion | T0820 | Exploiting trusted communication patterns |
-| Manipulation of Control | T0831 | Modifying PLC register values |
-
-## MITRE D3FEND Alignment
-
-| Technique | ID | Description |
-|---|---|---|
-| Network Traffic Analysis | D3-NTA | Understanding what the IDS can and cannot detect |
-| Protocol Metadata Anomaly Detection | D3-PMAD | Analyzing protocol-level detection rules |
-
-## Prerequisites
+## 📦 Prerequisites
 
 - The IDS must be running (check the IDS dashboard at http://localhost:8443)
 - Access to the attack machine (http://localhost:6081/vnc.html) or webshell
 - Python with `pymodbus` library (`pip install pymodbus`)
 
-## IDS Detection Rules to Understand
+## 🎯 Task
 
-Before attempting evasion, study the IDS rules on the **Rules tab** of the dashboard. The relevant rules are:
+Perform a stealth Modbus write operation against the OpenPLC controller without triggering any IDS alerts.
 
-### Rules You Must Evade
+The flag has the format `CybICS(flag)`.
+
+### 📝 Step 1: Study the Detection Rules
+
+Before attempting evasion, study the IDS rules on the **Rules tab** of the dashboard. The relevant rules are:
 
 | Rule | Threshold | What Triggers It |
 |---|---|---|
@@ -45,15 +31,9 @@ Before attempting evasion, study the IDS rules on the **Rules tab** of the dashb
 | `port_scan` | **5 ports in 10 seconds** | SYN packets to multiple destination ports |
 | `syn_flood` | **100 SYNs in 10 seconds** | Excessive SYN packets from single source |
 
-### Key Insight
-
-The `modbus_unauth_write` rule triggers when **10 or more** write operations are detected from a non-service IP within a 30-second sliding window. If you send **fewer than 10 writes within any 30-second period**, this rule will not fire.
+**Key Insight:** The `modbus_unauth_write` rule triggers when **10 or more** write operations are detected from a non-service IP within a 30-second sliding window. If you send **fewer than 10 writes within any 30-second period**, this rule will not fire.
 
-The IDS also has a 30-second alert cooldown per rule+source, but this only matters if you've already triggered an alert.
-
-## Task
-
-### Step 1: Start the Evasion Window
+### 📝 Step 2: Start the Evasion Window
 
 Start a 2-minute evasion challenge via the API or the Challenges tab:
 
@@ -63,7 +43,7 @@ curl -X POST http://localhost:8443/api/evasion/start
 
 This records the current alert count and begins monitoring for your stealth Modbus writes.
 
-### Step 2: Send Stealth Modbus Writes
+### 📝 Step 3: Send Stealth Modbus Writes
 
 From the attack machine, send **at least 3** Modbus write commands to OpenPLC, staying below the detection thresholds.
 
@@ -92,7 +72,7 @@ print("Stealth writes complete!")
 #### Alternative: Single Write Commands
 
 ```bash
-# Using modbus-cli or similar tools, send individual writes:
+# Using Python one-liners, send individual writes:
 python3 -c "
 from pymodbus.client import ModbusTcpClient
 c = ModbusTcpClient('172.18.0.3', port=502)
@@ -105,7 +85,7 @@ print('Write 1 done')
 # Repeat 2 more times
 ```
 
-### Step 3: Verify Success
+### 📝 Step 4: Verify Success
 
 Check the evasion challenge status:
 
@@ -120,35 +100,70 @@ curl http://localhost:8443/api/evasion/check
 
 If successful, the flag will be included in the response.
 
-### Common Mistakes
+### ⚠️ Common Mistakes
 
 1. **Too many writes too fast**: Sending 10+ writes within 30 seconds triggers `modbus_unauth_write`
 2. **Port scanning first**: If you nmap the target during the evasion window, `port_scan` fires
 3. **Connecting to multiple ports**: Stick to port 502 only
 4. **Running flooding scripts**: Scripts like `flooding_hpt.py` send writes in tight loops, triggering `modbus_flood`
 
-## Advanced Evasion Techniques
+## 🛡️ Security Framework References
+
+<details>
+  <summary>Click to expand</summary>
+
+### MITRE ATT&CK for ICS — Techniques Applied
 
-For students who want to explore further:
+| Tactic | Technique | ID | Description |
+|--------|-----------|-----|-------------|
+| Lateral Movement | Exploitation of Remote Services | [T0866](https://attack.mitre.org/techniques/T0866/) | Accessing PLC via Modbus protocol |
+| Impair Process Control | Unauthorized Command Message | [T0855](https://attack.mitre.org/techniques/T0855/) | Writing to PLC registers |
+| Evasion | Exploitation for Evasion | [T0820](https://attack.mitre.org/techniques/T0820/) | Exploiting trusted communication patterns |
+| Impair Process Control | Manipulation of Control | [T0831](https://attack.mitre.org/techniques/T0831/) | Modifying PLC register values |
 
+### MITRE D3FEND — Defensive Techniques Tested
+
+| Technique | ID | Description |
+|-----------|-----|-------------|
+| Network Traffic Analysis | [D3-NTA](https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/) | Understanding what the IDS can and cannot detect |
+| Protocol Metadata Anomaly Detection | [D3-PMAD](https://d3fend.mitre.org/technique/d3f:ProtocolMetadataAnomalyDetection/) | Analyzing protocol-level detection rules |
+
+### NIST SP 800-82r3 Reference
+
+| Control Family | Controls | Relevance |
+|----------------|----------|-----------|
+| **System and Information Integrity (SI)** | SI-4 | Information system monitoring |
+| **Risk Assessment (RA)** | RA-5 | Vulnerability scanning |
+| **Assessment, Authorization, and Monitoring (CA)** | CA-8 | Penetration testing |
+| **System and Communications Protection (SC)** | SC-7 | Boundary protection |
+
+**Why NIST 800-82r3 matters here:** NIST 800-82r3 Section 6.2.7 acknowledges that monitoring (SI-4) has inherent limitations. Threshold-based detection can be evaded by low-and-slow attacks. CA-8 (Penetration Testing) recommends testing detection capabilities to identify blind spots. Understanding evasion techniques helps defenders tune their IDS rules and implement defense-in-depth strategies where multiple detection layers compensate for individual weaknesses.
+
+</details>
+
+## 🔍 Defensive Thinking
+
+After completing this challenge, consider:
 - **Timing analysis**: How does the sliding window work? Can you send 9 writes, wait 31 seconds, then send 9 more?
 - **Source spoofing**: Could you spoof your source IP to match a known service? (Hint: the IDS checks source IP against the `KNOWN_SERVICES` list)
 - **Protocol-level evasion**: Are there Modbus function codes the IDS doesn't monitor?
 - **Fragmentation**: Would IP fragmentation bypass the payload inspection?
+- How would you improve detection to catch low-and-slow attacks?
+- What role does behavioral baselining play in detecting evasion?
 
-## Key Takeaways
 
-- IDS evasion is a critical skill for both red team and blue team professionals
-- Understanding detection thresholds helps defenders tune their systems
-- "Low-and-slow" attacks are harder to detect than high-volume attacks
-- Defense-in-depth (multiple detection layers) mitigates evasion risks
-- ICS protocols like Modbus have no built-in authentication, making threshold-based detection essential
+## 💡 Hints
 
-## NIST SP 800-82r3 Alignment
+The key threshold is `modbus_unauth_write`: 10 writes in 30 seconds. Send only 3 writes with 5-second delays between them — this keeps you well under the limit. Use a single TCP connection to port 502 only, and don't run any scans during the evasion window.
 
-| Control Family | Control | Description |
-|---|---|---|
-| SI (System and Information Integrity) | SI-4 | Information System Monitoring |
-| RA (Risk Assessment) | RA-5 | Vulnerability Scanning |
-| CA (Assessment, Authorization, and Monitoring) | CA-8 | Penetration Testing |
-| SC (System and Communications Protection) | SC-7 | Boundary Protection |
+## 🔍 Solution
+
+After sending 3 or more stealth Modbus writes without triggering alerts, query the evasion check endpoint:
+
+```bash
+curl http://localhost:8443/api/evasion/check
+```
+
+The flag appears when `success` is `true`.
+
+**Flag:** `CybICS(st34lth_0p3r4t0r)`
diff --git a/training/ids_forensics/README.md b/training/ids_forensics/README.md
index 3af319b5..ce31d40f 100644
--- a/training/ids_forensics/README.md
+++ b/training/ids_forensics/README.md
@@ -1,10 +1,8 @@
-# IDS Forensics Challenge
+# 🔎 IDS Forensics Challenge
 
-## Objective
+> **MITRE D3FEND:** `Detect` | [D3-NTA - Network Traffic Analysis](https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/)
 
-Analyze IDS alert data to investigate a security incident on the CybICS industrial network. Demonstrate your ability to use IDS APIs for incident response and forensic analysis.
-
-## Background
+## 📋 Overview
 
 Security Operations Center (SOC) analysts regularly triage alerts from intrusion detection systems to understand the scope and nature of attacks. This challenge simulates a real-world incident investigation where you must analyze IDS data programmatically.
 
@@ -25,7 +23,7 @@ The CybICS IDS exposes a REST API that provides alert data, summary statistics,
 | Network Traffic Analysis | D3-NTA | Analyzing captured network alert data |
 | Alert Triage | D3-AT | Prioritizing and classifying security alerts |
 
-## Prerequisites
+## 📦 Prerequisites
 
 Before starting this challenge, you need alert data in the IDS. Complete the **IDS Challenge** first or trigger multiple different attacks to generate diverse alerts:
 
@@ -36,7 +34,9 @@ Before starting this challenge, you need alert data in the IDS. Complete the **I
 
 You need at least **5 alerts** from at least **3 different rule types**.
 
-## Task
+## 🎯 Task
+
+The flag has the format `CybICS(flag)`.
 
 ### Step 1: Check Investigation Readiness
 
@@ -63,6 +63,8 @@ Key fields in the response:
 - `top_sources`: List of source IPs ranked by alert count
 - `total`: Total number of alerts
 
+> **Tip:** The `/api/summary` endpoint provides aggregated data that is particularly useful for answering the investigation questions. It contains pre-computed statistics (top sources, rule counts, severity breakdowns) so you may not need to parse raw alerts at all.
+
 #### Get Raw Alert Data
 ```bash
 curl http://localhost:8443/api/alerts | python3 -m json.tool
@@ -104,7 +106,7 @@ If all answers are correct, the flag will be revealed.
 
 You can also submit via the **Challenges tab** on the IDS dashboard.
 
-### Python Scripting Approach
+### 🐍 Python Scripting Approach
 
 For a more programmatic approach:
 
@@ -139,18 +141,62 @@ result = requests.post(f"{BASE}/api/forensics/submit", json={
 print(result)
 ```
 
-## Key Takeaways
+## 🛡️ Security Framework References
 
-- SOC analysts must efficiently query and correlate alert data from multiple sources
-- API-based analysis enables automation and faster incident response
-- Understanding alert severity, source attribution, and rule classification is fundamental to triage
-- The same API skills apply to commercial SIEMs (Splunk, QRadar, Elastic Security)
+<details>
+  <summary>Click to expand</summary>
 
-## NIST SP 800-82r3 Alignment
+### MITRE ATT&CK for ICS — Techniques Investigated
 
-| Control Family | Control | Description |
-|---|---|---|
-| SI (System and Information Integrity) | SI-4 | Information System Monitoring |
-| IR (Incident Response) | IR-4 | Incident Handling |
-| IR (Incident Response) | IR-5 | Incident Monitoring |
-| AU (Audit and Accountability) | AU-6 | Audit Review, Analysis, and Reporting |
+| Tactic | Technique | ID | Relevance |
+|--------|-----------|-----|-----------|
+| Discovery | Remote System Discovery | [T0846](https://attack.mitre.org/techniques/T0846/) | Identifying reconnaissance patterns |
+| Impair Process Control | Unauthorized Command Message | [T0855](https://attack.mitre.org/techniques/T0855/) | Detecting unauthorized Modbus writes |
+| Impact | Denial of Service | [T0836](https://attack.mitre.org/techniques/T0836/) | Identifying flooding attacks |
+
+### MITRE D3FEND — Defensive Techniques Applied
+
+| Technique | ID | Description |
+|-----------|-----|-------------|
+| Network Traffic Analysis | [D3-NTA](https://d3fend.mitre.org/technique/d3f:NetworkTrafficAnalysis/) | Analyzing captured network alert data |
+
+### NIST SP 800-82r3 Reference
+
+| Control Family | Controls | Relevance |
+|----------------|----------|-----------|
+| **System and Information Integrity (SI)** | SI-4 | Information system monitoring |
+| **Incident Response (IR)** | IR-4, IR-5 | Incident handling and monitoring |
+| **Audit and Accountability (AU)** | AU-6 | Audit review, analysis, and reporting |
+
+**Why NIST 800-82r3 matters here:** NIST 800-82r3 Section 6.2.7 emphasizes that monitoring (SI-4) must be paired with effective incident handling (IR-4). Simply collecting alerts is insufficient — analysts must be able to query, correlate, and interpret alert data to respond effectively. AU-6 (Audit Review) requires that security alerts are reviewed and analyzed. The same API-based analysis skills apply to commercial SIEMs (Splunk, QRadar, Elastic Security).
+
+</details>
+
+## 🔍 Defensive Thinking
+
+After completing this challenge, consider:
+- How would you automate alert triage to reduce analyst workload?
+- What correlation rules would you create to identify multi-stage attacks?
+- How would you distinguish false positives from real attacks in ICS alert data?
+- What metrics would you track to measure IDS effectiveness over time?
+
+
+## 💡 Hints
+
+Query `/api/summary` to get aggregated data — it contains `top_sources` (sorted by alert count), `rules` (unique rule names), and `severity` (counts per level). The three answers can all be derived from this single endpoint without parsing raw alerts.
+
+## 🔍 Solution
+
+Submit correct answers to the 3 investigation questions via POST to `/api/forensics/submit`. The flag is returned in the response when all answers are correct:
+
+```bash
+curl -X POST http://localhost:8443/api/forensics/submit \
+  -H "Content-Type: application/json" \
+  -d '{
+    "top_attacker": "<top source IP from /api/summary>",
+    "unique_rules": <number of distinct rules>,
+    "critical_count": <number of critical alerts>
+  }'
+```
+
+**Flag:** `CybICS(f0r3ns1c_4n4lyst)`
diff --git a/training/mitm/README.md b/training/mitm/README.md
index e35253b7..ad7e1754 100644
--- a/training/mitm/README.md
+++ b/training/mitm/README.md
@@ -31,6 +31,42 @@ This shows the basic flow:
 - Server responds (<-----) to the Attacker.
 - Attacker potentially modifies and sends the response back to the Client.
 
+## 🔧 ARP Spoofing: Becoming the Man-in-the-Middle
+
+To position yourself between the client (FUXA HMI) and server (OpenPLC), you need to redirect their network traffic through your machine. This is accomplished using **ARP spoofing** (also called ARP cache poisoning).
+
+### What is ARP Spoofing?
+
+The Address Resolution Protocol (ARP) maps IP addresses to MAC addresses on a local network. Each device maintains an ARP cache — a table of IP-to-MAC mappings. ARP spoofing exploits the fact that ARP has **no authentication**: any device can send ARP replies claiming to be any other device.
+
+By sending forged ARP replies, you trick both the client and server into sending their traffic to your machine instead of directly to each other:
+
+1. **Tell the client (FUXA):** "I am the server (OpenPLC)" — send a spoofed ARP reply to FUXA with OpenPLC's IP but your MAC address
+2. **Tell the server (OpenPLC):** "I am the client (FUXA)" — send a spoofed ARP reply to OpenPLC with FUXA's IP but your MAC address
+
+Once both devices update their ARP caches, all traffic between them flows through your machine.
+
+### Tools for ARP Spoofing
+
+Common tools include:
+- **arpspoof** (part of the `dsniff` package) — simple command-line ARP spoofing
+- **ettercap** — full-featured MITM framework
+- **scapy** — Python-based packet crafting (for custom scripts)
+
+You will need to run ARP spoofing in **both directions** (one for each target) so that traffic flows through your machine bidirectionally. You also need IP forwarding enabled on your machine so that intercepted packets are forwarded rather than dropped.
+
+## 🛠️ Two-Step Attack Process
+
+The full MITM attack requires two steps running simultaneously:
+
+### Step 1: ARP Spoof to Redirect Traffic
+
+Use ARP spoofing to redirect traffic between FUXA and OpenPLC through your machine. This must remain running for the duration of the attack.
+
+### Step 2: Run the Modbus Proxy
+
+Once traffic is flowing through your machine, run the Modbus TCP proxy to intercept and optionally manipulate the traffic.
+
 ## 🛠️ Prerequisite: Admin Access on FUXA HMI
 Before setting up the Python proxy for intercepting Modbus traffic, you need administrator access on the FUXA HMI. This is necessary to modify the IP settings of the connected PLC, directing its communication through the Python proxy.
 
@@ -39,7 +75,7 @@ With admin access, you'll be able to change the PLC's configuration to use the p
 ![FUXA IP Configuration](doc/fuxa_ip.png)
 
 ## 🚀 Example: Running the Proxy
-An example of this proxy can be found in the `mitm.py` file. 
+An example of this proxy can be found in the `mitm.py` file.
 By default, it does not modify or manipulate any values, allowing the proxy to only focus on significant traffic changes. You can easily extend it to customize the manipulations as needed for your specific use case.
 For this, a good understanding of Modbus/TCP is required.
 
@@ -47,9 +83,18 @@ For this, a good understanding of Modbus/TCP is required.
 python3 mitm.py
 ```
 
-## 🎯 Find the Flag
+## 🎯 Task
+Perform a Man-in-the-Middle attack using ARP spoofing and the provided Modbus proxy to intercept and analyze PLC communication.
+
 The flag has the format `CybICS(flag)`.
 
+### Steps
+1. Ensure you have access to the attack machine and identify the target IPs (PLC and HMI)
+2. Enable IP forwarding on the attack machine
+3. Run ARP spoofing to poison the ARP caches of both the PLC and HMI
+4. Start the provided mitm.py Modbus proxy script
+5. Observe the intercepted Modbus traffic and find the flag
+
 ## 🛡️ Security Framework References
 
 <details>
@@ -85,14 +130,13 @@ The flag has the format `CybICS(flag)`.
 
 </details>
 
-## 🔍 Solution
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
+## 💡 Hints
 
-  After completion, use the following flag:
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(mitm_attack_successful)
-  </div>
+Use `arpspoof -i eth0 -t <FUXA_IP> <OpenPLC_IP>` in one terminal and `arpspoof -i eth0 -t <OpenPLC_IP> <FUXA_IP>` in another. Enable IP forwarding with `echo 1 > /proc/sys/net/ipv4/ip_forward`. Then run `python3 mitm.py` in a third terminal.
 
-</details>
+## 🔍 Solution
+
+After completion, use the following flag:
+
+**Flag:** `CybICS(mitm_attack_successful)`
diff --git a/training/opcua/README.md b/training/opcua/README.md
index f3b541ac..9435b034 100644
--- a/training/opcua/README.md
+++ b/training/opcua/README.md
@@ -46,10 +46,18 @@ If this is successful, follow step 4 and use *opcua_login* to brute force creden
 
 In the case of a successful brute force attack, you should see the username and password labeled *success* as output. This procedure can also be traced in Wireshark and the usernames and passwords used in the attack can be read out in plaintext. 
 
-## 🎯 Find the User Flag
+## 🎯 Task
+Brute-force OPC-UA credentials, explore the server security configuration, and use leaked certificates to gain admin access.
+
 The flag has the format `CybICS(flag)`.
 
-**💡 Hint**: The flag is readable on the OPC UA system of the user, which you need to brute force
+### Steps
+1. Set up Metasploit and load the opcua_login module
+2. Configure the module with the target IP, port 4840, and credentials file
+3. Run the brute-force attack to discover valid OPC-UA credentials
+4. Connect to the OPC-UA server with the discovered credentials and read the user flag
+5. Use the opcua_server_config module to investigate the server's security configuration
+6. Locate the leaked certificates and use them to authenticate as admin
 
 ## 🛡️ Security Framework References
 
@@ -86,12 +94,14 @@ The flag has the format `CybICS(flag)`.
 
 </details>
 
-## 🔍 Solution (User Flag)
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
+## 💡 Hints
 
-  Check if connection to OPC UA works with:
+The flag is readable on the OPC UA system of the user, which you need to brute force.
+
+## 🔍 Solution (User Flag)
+
+Check if connection to OPC UA works with:
   ```
   msf6 > use auxiliary/scanner/opcua/opcua_hello
   msf6 auxiliary(scanner/opcua/opcua_hello) > set rhosts 10.0.0.1
@@ -126,22 +136,17 @@ The flag has the format `CybICS(flag)`.
 
   Username: user1
   Password: test
-  
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(OPC-UA)
-  </div>
+
+**Flag:** `CybICS(OPC-UA)`
+
   ![Flag opcua](doc/opcua_user.png)
-</details>
 
 ## 🛡️ Getting an Overview of the Security Configuration
 Use the metasploit module `auxiliary/scanner/opcua/opcua_server_config` for this investigation
 
 ## 🔍 Solution (Security Configuration)
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
-
-  ```
+```
   msf6 > use auxiliary/scanner/opcua/opcua_server_config
   msf6 auxiliary(scanner/opcua/opcua_server_config) > set rhosts 10.0.0.1
   msf6 auxiliary(scanner/opcua/opcua_server_config) > set rport 4840
@@ -150,7 +155,6 @@ Use the metasploit module `auxiliary/scanner/opcua/opcua_server_config` for this
   msf6 auxiliary(scanner/opcua/opcua_server_config) > set authentication Username
   msf6 auxiliary(scanner/opcua/opcua_server_config) > run
   ```
-</details>
 
 ## 🛡️ Getting Admin Access
 Previously, you had read-only access to the variables, which meant you could view but not modify them.
@@ -189,18 +193,13 @@ Certificates in OPC UA are essential for establishing secure, authenticated, and
 
 ## 🔍 Solution (Admin Access)
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
-
-  Use opcua-client and configure on `Connect option` the usage of the certificate.
+Use opcua-client and configure on `Connect option` the usage of the certificate.
   ```
   opcua-client
   ```
 
   Now you can change the variable `Set > 0 to obtain flag!` to a value bigger than zero and access the variable for the admin flag `adminFLAG`
 
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(OPC-UA-$ADMIN)
-  </div>
-  ![Flag opcua](doc/opcua_admin.png)
-</details>
\ No newline at end of file
+**Flag:** `CybICS(OPC-UA-$ADMIN)`
+
+  ![Flag opcua](doc/opcua_admin.png)
\ No newline at end of file
diff --git a/training/password_attack/README.md b/training/password_attack/README.md
index db48f614..0cdd3fe5 100644
--- a/training/password_attack/README.md
+++ b/training/password_attack/README.md
@@ -51,31 +51,30 @@ For more info, start it without parameters:
 ./ffuf
 ```
 
-## 🎯 Find the Flag
+## 🎯 Task
+Brute-force the login credentials for both the OpenPLC web interface and the FUXA HMI using a dictionary attack with ffuf.
+
 The flag has the format `CybICS(flag)`.
 
-**💡 Hint**: The flag is part of the user information.
+### Steps
+1. Analyze the OpenPLC login page at port 8080 (examine the request and response in the browser developer console)
+2. Install ffuf and download the rockyou.txt wordlist
+3. Run ffuf against the OpenPLC login to brute-force the admin password
+4. Log in with the discovered credentials and find the flag in the user information
+5. Apply the same approach to the FUXA HMI at port 1881
+6. Log in to FUXA and find the flag
 
 ## 🔍 Solution (OpenPLC)
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
-
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(0penPLC)
-  </div>
+**Flag:** `CybICS(0penPLC)`
 
   ![Flag OpenPLC Password](doc/flag.png)
-</details>
 
 ## 🎯 FUXA Password Attack
 Use the previous knowledge to fuzz the admin login of FUXA.
 FUXA is running at [http://<DEVICE_IP>:1881](http://<DEVICE_IP>:1881).
 
-### 🎯 Find the Flag
-The flag has the format `CybICS(flag)`.
-
-**💡 Hint**: The flag appears after successful login on the HMI.
+**Note:** FUXA uses a different authentication mechanism than OpenPLC. While OpenPLC accepts form-encoded POST data at `/login`, FUXA uses a JSON-based API at `/api/signin`. This means you need to change the `Content-Type` header to `application/json`, format the payload as a JSON object, and use a different filter flag (e.g., `-fr "error"` instead of `-fs`) to distinguish successful from failed attempts.
 
 ## 🛡️ Security Framework References
 
@@ -112,19 +111,19 @@ The flag has the format `CybICS(flag)`.
 
 </details>
 
-## 🔍 Solution (FUXA)
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
+## 💡 Hints
+
+- **OpenPLC**: The flag is part of the user information.
+- **FUXA**: The flag appears after successful login on the HMI.
+
+## 🔍 Solution (FUXA)
 
-  Run the attack:
+Run the attack:
   ```sh
   ./ffuf -v -w ./rockyou.txt -X POST -H "Content-Type: application/json" -d '{"username": "admin", "password": "FUZZ"}' -raw -u http://$DEVICE_IP:1881/api/signin -fr "error"
   ```
 
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(FU##A)
-  </div>
+**Flag:** `CybICS(FU##A)`
 
-  ![Flag FUXA Password](doc/flag2.png)
-</details>
\ No newline at end of file
+  ![Flag FUXA Password](doc/flag2.png)
\ No newline at end of file
diff --git a/training/physical_process/README.md b/training/physical_process/README.md
index 81c8bcde..2946bd39 100644
--- a/training/physical_process/README.md
+++ b/training/physical_process/README.md
@@ -25,11 +25,17 @@ Try to control the process manually as an operator via the FUXA HMI.
 
 ![FUXA system view](doc/fuxa.png)
 
-## 🎯 Find the Flag
+## 🎯 Task
 The flag has the format `CybICS(flag)`.
-To get the flag, the blowout needs to be triggered.
 
-**💡 Hint**: The flag appears on the FUXA HMI, when the blowout was triggered.
+Your objective is to trigger the blowout on the system. The physical process works as follows:
+
+- The **System Valve (SV)** controls whether compressed air can flow out of the High Pressure Tank (HPT).
+- The **Compressor (C)** pumps air into the system, increasing pressure.
+- If the System Valve is **closed** while the **Compressor is running**, pressure in the High Pressure Tank (HPT) will rise continuously because the air has no path to escape.
+- When the pressure exceeds a critical threshold, the **Blowout (BO)** safety event is triggered.
+
+Using the manual control mode on the FUXA HMI, manipulate the valves and compressor to create the unsafe overpressure condition that causes the blowout.
 
 ## 🛡️ Security Framework References
 
@@ -62,20 +68,19 @@ To get the flag, the blowout needs to be triggered.
 
 </details>
 
-## 🔍 Solution
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
+## 💡 Hints
 
-  After login on the FUXA dashboard switch to the "System" view.
+The flag appears on the FUXA HMI when the blowout is triggered.
+
+## 🔍 Solution
+
+After login on the FUXA dashboard switch to the "System" view.
   By closing the "System Valve" (SV) and enabling the Compressor (C),
   the pressure is rising.
   After a certain time, the pressure in the High Pressure Tank (HPT)
   gets a critical level and the Blowout (BO) will be opened.
 
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(Bl0w0ut)
-  </div>
+**Flag:** `CybICS(Bl0w0ut)`
 
   ![Flag OpenPLC Password](doc/flag.png)
-</details>
diff --git a/training/plc_programming/README.md b/training/plc_programming/README.md
index 83fd57c1..e92cb7d8 100644
--- a/training/plc_programming/README.md
+++ b/training/plc_programming/README.md
@@ -85,6 +85,17 @@ The countHeartbeat variable is used for timing purposes, and the program is conf
 Upload the program to the OpenPLC via the web interface on port 8080.
 Do not forget to delete the previous CybICS ST code.
 
+## 🎯 Task
+The flag has the format `CybICS(flag)`.
+
+Your objective is to modify the PLC program, compile it, upload it to the OpenPLC runtime, and then find the flag hidden in the OpenPLC system.
+
+### 📝 Steps
+1. Open the CybICS project in OpenPLC Editor (using either the Engineering Workstation or a local installation as described above)
+2. Review the program logic and make a modification to the PLC program
+3. Compile the modified program and upload it to the OpenPLC runtime via the web interface on port 8080
+4. Once your modified program is uploaded and running, explore the OpenPLC web interface to find the flag
+5. Check the **Users** page in the OpenPLC web interface — the flag is hidden in the user account information, specifically in the **email field**
 
 ## 🛡️ Security Framework References
 
@@ -120,15 +131,14 @@ Do not forget to delete the previous CybICS ST code.
 
 </details>
 
-## 🔍 Solution
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
+## 💡 Hints
 
-  After completion, use the following flag:
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(ladder_logic_modified)
-  </div>
+Navigate to the Users page in the OpenPLC web interface at `http://<IP>:8080/users` and click on the default `openplc` user to view their full profile details.
 
-</details>
+## 🔍 Solution
+
+After completion, use the following flag:
+
+**Flag:** `CybICS(ladder_logic_modified)`
 
diff --git a/training/scanning/README.md b/training/scanning/README.md
index 21679bc5..4d5c5c86 100644
--- a/training/scanning/README.md
+++ b/training/scanning/README.md
@@ -17,7 +17,36 @@ To maximize security, network scans should be conducted periodically and after a
 - 🔐 Use a VPN or secure network when scanning remote devices
 
 ## 🛠️ Using Nmap
-To identify open ports and services within the CybICS testbed you can use nmap. Your goal is to perform service version detection to discover the flag hidden in a service banner.
+To identify open ports and services within the CybICS testbed you can use nmap. Nmap (Network Mapper) is an open-source tool for network discovery and security auditing.
+
+### Service Version Detection with `-sV`
+One of nmap's most powerful features is **service version detection**, enabled with the `-sV` flag. When you run `nmap -sV <target>`, nmap doesn't just check which ports are open — it actively probes each open port and analyzes the responses to determine:
+- What **service** is running (HTTP, Modbus, SSH, etc.)
+- The **version** of that service
+- The **service banner** — a text string the service returns to identify itself
+
+The basic syntax is:
+```bash
+nmap -sV $DEVICE_IP
+```
+
+### Flags Hidden in Service Banners
+In ICS environments, services expose identification information through **banners** and **headers**. For example, an HTTP server includes a `Server` header in its responses that identifies the web server software. These banners can reveal detailed system information — and in a CTF context, flags can be embedded in these service banners and HTTP headers.
+
+When performing service version detection, pay close attention to any unusual or non-standard version strings in the scan results, as these may contain valuable information.
+
+## 🎯 Task
+Your goal is to perform service version detection against the CybICS testbed using nmap's `-sV` flag and discover the flag hidden in a service banner.
+
+### Steps
+1. Run nmap with the `-sV` flag against the target device to perform service version detection:
+   ```bash
+   nmap -sV $DEVICE_IP
+   ```
+2. Examine the scan output and look at the service banners and version strings reported for each open port.
+3. Look for the flag embedded in an HTTP service banner or header. Pay close attention to any unusual or non-standard version strings.
+
+The flag has the format `CybICS(flag)`.
 
 ## 🛡️ Security Framework References
 
@@ -53,12 +82,14 @@ To identify open ports and services within the CybICS testbed you can use nmap.
 
 </details>
 
-## 🔍 Solution
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
+## 💡 Hints
+
+Pay attention to the HTTP server banner on port 80.
 
-  Execute the following nmap command to perform service version detection:
+## 🔍 Solution
+
+Execute the following nmap command to perform service version detection:
   ```sh
   nmap -sV $DEVICE_IP
   ```
@@ -91,7 +122,7 @@ To identify open ports and services within the CybICS testbed you can use nmap.
   This is the flag! The `-sV` flag triggers nmap to perform service version detection by connecting to the HTTP service and reading the Server header, which has been configured to contain the CTF flag.
 
   ### 🔎 Port Analysis
-  - **80/tcp**: HTTP service - Landing page with flag in Server header 🚩
+  - **80/tcp**: HTTP service - Landing page with flag in Server header
   - **102/tcp**: S7 Communication (S7comm) - Siemens PLC communication protocol
   - **502/tcp**: Modbus TCP - Industrial device communication
   - **1881/tcp**: HTTP (Node.js Express) - Web application interface
@@ -102,7 +133,5 @@ To identify open ports and services within the CybICS testbed you can use nmap.
 
 
   Submit the flag found in the service banner:
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(scanning_d0ne)
-  </div>
-</details>
\ No newline at end of file
+
+**Flag:** `CybICS(scanning_d0ne)`
\ No newline at end of file
diff --git a/training/scanning2/README.md b/training/scanning2/README.md
index 3de5efd9..6063d6f2 100644
--- a/training/scanning2/README.md
+++ b/training/scanning2/README.md
@@ -32,32 +32,45 @@ Before scanning, ensure you have:
 - ⏰ Avoid scanning production systems during working hours to prevent disruptions
 - 🔐 Use a VPN or secure network when scanning remote devices
 
-## 🚀 Running the Scan
+## 🚀 Background: S7comm and Nmap's s7-info Script
 
-There are two S7 services running on port 102 and 1102 (the standard port 102 is used by OpenPLC). Due to nmap's s7-info script being hardcoded for port 102, you'll need to do changes to the s7-info script or use an alternative approach to query the S7 service and discover the CTF flag.
+There are two S7 services running on port 102 and 1102 (the standard port 102 is used by OpenPLC). Nmap's `s7-info` NSE script can query S7 PLCs to retrieve detailed device information. However, the script's `portrule` is hardcoded for port 102 only, which means it will not automatically run against the S7 service on port 1102.
 
-```bash
-locate s7-info.nse
-```
-Usually at: /usr/share/nmap/scripts/s7-info.nse
+### 📊 Understanding the Output
+The s7-info script returns several fields about the PLC:
+  - **Module**: Hardware module identifier (e.g., 6ES7 315-2AG10-0AB0)
+  - **Basic Hardware**: Basic hardware type (e.g., SIMATIC 300)
+  - **Version**: Firmware version (e.g., 2.6.9)
+  - **System Name**: System identifier (e.g., SIMATIC 300(1))
+  - **Module Type**: Extended module type - **Contains the CTF flag!** 🚩
 
-Edit the script (you'll need sudo):
+## 🎯 Task
+Your goal is to use nmap's `s7-info` NSE script to query the Siemens S7 PLC running on a non-standard port and retrieve the CTF flag from the device identification fields.
 
-```bash
-sudo nano /usr/share/nmap/scripts/s7-info.nse
-```
+The flag has the format `CybICS(flag)` and is found in the **Module Type** field of the s7-info output.
 
-Find the portrule section (near the top) and modify it:
-```bash
-portrule = shortport.port_or_service({102, 1102}, "iso-tsap", "tcp")
-```
+### Steps
+1. **Locate the s7-info script** on your system:
+   ```bash
+   locate s7-info.nse
+   ```
+   It is usually found at: `/usr/share/nmap/scripts/s7-info.nse`
 
-### 📊 Output Analysis
-  - **Module**: Hardware module identifier (6ES7 315-2AG10-0AB0)
-  - **Basic Hardware**: Basic hardware type (SIMATIC 300)
-  - **Version**: Firmware version (2.6.9)
-  - **System Name**: System identifier (SIMATIC 300(1))
-  - **Module Type**: Extended module type - **Contains the CTF flag!** 🚩
+2. **Modify the portrule** to include port 1102. Edit the script (you'll need sudo):
+   ```bash
+   sudo nano /usr/share/nmap/scripts/s7-info.nse
+   ```
+   Find the `portrule` section near the top and change it to:
+   ```bash
+   portrule = shortport.port_or_service({102, 1102}, "iso-tsap", "tcp")
+   ```
+
+3. **Run the scan** against the target device with both ports:
+   ```bash
+   nmap --script s7-info -p 102,1102 $DEVICE_IP
+   ```
+
+4. **Find the flag** in the scan output. Look at the **Module Type** field in the s7-info results for port 1102.
 
 ### ✅ Conclusion
 Using Nmap's s7-info script, you can:
@@ -106,13 +119,13 @@ Using Nmap's s7-info script, you can:
 
 </details>
 
+
+## 💡 Hints
+
+After modifying the portrule, run: `nmap --script s7-info -p 102,1102 $DEVICE_IP` and look at the **Module Type** field in the output.
+
 ## 🔍 Solution
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
-  Submit the flag found in the Module Type field:
+Submit the flag found in the Module Type field:
 
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(s7comm_analysis_complete)
-  </div>
-</details>
+**Flag:** `CybICS(s7comm_analysis_complete)`
diff --git a/training/uart_basic/README.md b/training/uart_basic/README.md
index 126c189b..104452e9 100644
--- a/training/uart_basic/README.md
+++ b/training/uart_basic/README.md
@@ -29,12 +29,27 @@ This guide covers how to connect to the CybICS micro controller using UART (Univ
 3. Common picocom commands:
    - `Ctrl+A Ctrl+X`: Exit picocom
 
-## 🎯 Find the Flag
+## 🎯 Task
 The flag has the format `CybICS(flag)`.
 
-**💡 Hint**: The flag appears after successful login on the UART.
+### Steps
+1. Connect to the CybICS Raspberry Pi via SSH
+2. Install picocom if not already available
+3. Connect to the UART interface using picocom at 115200 baud on /dev/serial0
+4. Observe the login prompt on the UART console
+5. Run the brute-force script to discover the 3-character lowercase password
+6. Log in with the discovered password to retrieve the flag
 
-**🔑 Password Hint**: The password is 3 characters long and contains only out of lowercase letters.
+The flag appears after a successful login on the UART console. When you connect via picocom, you will be presented with a login prompt that requires a password.
+
+### Password Constraints
+- The password is **3 characters long**
+- It contains **only lowercase letters** (a-z)
+
+This means there are only 26^3 = 17,576 possible combinations, making brute-forcing a viable approach.
+
+### Brute-Force Approach
+Given the small keyspace, you can automate the login attempts using the provided `bruteforce_login.py` script, which systematically tries all lowercase 3-character combinations over the serial connection. At approximately 1-2 passwords per second, expect the process to take up to a few hours in the worst case.
 
 ## 🛡️ Security Framework References
 
@@ -71,12 +86,14 @@ The flag has the format `CybICS(flag)`.
 
 </details>
 
-## 🔍 Solution
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
+## 💡 Hints
 
-  Run the script:
+Run `python3 bruteforce_login.py /dev/serial0 3 3` to brute-force the 3-character lowercase password over the UART serial connection.
+
+## 🔍 Solution
+
+Run the script:
   ```bash
   python3 bruteforce_login.py /dev/serial0 3 3
   ```
@@ -97,7 +114,4 @@ The flag has the format `CybICS(flag)`.
    2025-06-05 14:27:33 - INFO - Disconnected
   ```
 
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(U#RT)
-  </div>
-</details>
+**Flag:** `CybICS(U#RT)`
diff --git a/training/wireshark_capture/README.md b/training/wireshark_capture/README.md
index 3502b3e0..7018ad36 100644
--- a/training/wireshark_capture/README.md
+++ b/training/wireshark_capture/README.md
@@ -91,10 +91,32 @@ ssh pi@$DEVICE_IP -p 22 sudo tcpdump -U -s0 'not port 22' -i br-cybics -w - | su
 
 ![Wireshark Capture](doc/wireshark.png)
 
-## 🎯 Find the Flag
+## 🎯 Task
+Capture and analyze network traffic to find the flag hidden in Modbus register write operations.
+
 The flag has the format `CybICS(flag)`.
 
-**💡 Hint**: The flag is written to registers over modbus.
+### Steps
+1. Set up SSH key authentication and start a remote packet capture using tcpdump
+2. Let the capture run for 30-60 seconds to collect Modbus traffic
+3. Open the capture file in Wireshark
+4. Filter for Modbus write operations (function codes 06 and 16)
+5. Inspect the register data in write packets for ASCII-encoded flag content
+
+### Where to Look: Modbus Write Operations
+In ICS traffic captures, **Modbus write operations** are particularly interesting because they carry process data being sent to devices — values written to registers and coils that control physical processes. When analyzing a Modbus traffic capture, you should focus on **write** function codes rather than read operations:
+
+- **Function Code 06**: Write Single Register
+- **Function Code 16**: Write Multiple Registers
+- **Function Code 05**: Write Single Coil
+- **Function Code 15**: Write Multiple Coils
+
+In Wireshark, you can filter for Modbus write operations using a display filter such as:
+```
+modbus.func_code == 6 || modbus.func_code == 16
+```
+
+Examine the **data values** being written to registers — in a CTF context, flag data is typically embedded in these write operations. Look at the register values for ASCII-encoded text that matches the flag format `CybICS(flag)`.
 
 ## 🛡️ Security Framework References
 
@@ -129,14 +151,13 @@ The flag has the format `CybICS(flag)`.
 
 </details>
 
-## 🔍 Solution
 
-<details>
-  <summary><span style="color:orange;font-weight: 900">Click to expand</span></summary>
+## 💡 Hints
+
+Filter for `modbus.func_code == 6 || modbus.func_code == 16` (Write Single Register and Write Multiple Registers) and inspect the register data values for ASCII text.
+
+## 🔍 Solution
 
-  <div style="color:orange;font-weight: 900">
-    🚩 Flag: CybICS(m0dbu$)
-  </div>
+**Flag:** `CybICS(m0dbu$)`
 
-  ![Flag Modbus](doc/modbus.png)
-</details>
\ No newline at end of file
+  ![Flag Modbus](doc/modbus.png)
\ No newline at end of file