Search machines

OS Difficulty Category Phase Hide the ones I have done

Specific techniques

Tick several to find machines that use all of them.

Reconnaissance API enumeration 15 Directory brute forcing 42 Domain LDAP/RPC enumeration 18 Exposed .git repository 10 Metadata and OSINT 10 SMB/NFS enumeration 34 SNMP enumeration 6 Vhost and subdomain fuzzing 47 Wi-Fi attacks 3

Web Authentication bypass 22 CI/CD and build abuse 4 CMS exploitation 22 Command injection 40 Cross-Site Scripting (XSS) 14 CSRF 4 Default credentials 17 GraphQL 2 IDOR 6 IIS and ASP.NET 9 Insecure deserialization 20 JWT attacks 9 LDAP injection 2 LFI / path traversal 50 Malicious file upload 46 Mass assignment 5 NoSQL injection 1 Phishing and malicious documents 14 Public CVE exploitation 110 Remote file inclusion (RFI) 3 Server-Side Template Injection 12 SQL injection 31 SSRF 15 XXE 4

Linux privilege escalation Container escape 16 Cron jobs and processes 31 Kernel or system exploit 7 Library hijacking 5 Linux capabilities 4 PATH hijacking 8 Privileged groups 10 SSH keys 33 Sudo abuse 61 SUID binaries 16 Symlink abuse 8 Wildcard injection 2

Windows privilege escalation AlwaysInstallElevated 1 Credentials in the registry and history 14 DLL hijacking 7 Misconfigured services 7 Other token privileges 6 Privileged Windows groups 4 Saved credentials / DPAPI 12 Scheduled tasks and admin scripts 9 SeBackup / SeRestore 3 SeImpersonate / Potatoes 14 UAC bypass 1 Windows exploits 15

Active Directory ACL abuse (BloodHound) 33 ADCS (certificates) 17 AS-REP roasting 8 BadSuccessor (dMSA) 2 DCSync 9 Deleted AD objects 5 Domain and forest trusts 2 gMSA accounts 13 GPP and GPO abuse 5 Kerberoasting 12 Kerberos delegation (RBCD) 13 NTLM capture and relay 28 Pass-the-hash / ticket 14 Password spraying and valid users 37 Reading LAPS passwords 3 Shadow Credentials 10 WSUS abuse 2

Post-exploitation and lateral movement Credentials in files 99 Internal services and port forwarding 56 MSSQL abuse 17 Password reuse 24 Remote execution (WinRM, PsExec, WMI) 39 SAM/LSA/LSASS dumping 14

Defense evasion AppLocker and Constrained Language Mode 11 AV and EDR evasion 17

Binary exploitation (pwn) Format string 1 Race condition 4 Reverse engineering 37 ROP / ret2libc 3 Stack buffer overflow 10

Cryptography and cracking Cookie or session forging 5 Hash cracking 101 Padding oracle 2 Weak or homemade cryptography 16

Forensics Backups and archives 23 Git history 9 Log analysis 13 Memory dumps 8 Steganography 3 Traffic analysis (pcap) 12

4 machines Clear filters

BountyHunter

easy linux

▶ XXE (foothold)

RedPanda

easy linux

▶ XXE (root)

Aragog

medium linux

▶ XXE (foothold)

RE

hard windows

▶ XXE (root)