Admirer easy linux ✓ ▶ Authentication bypass (foothold) Directory brute forcing Authentication bypass LFI / path traversal Credentials in files Library hijacking Sudo abuse
Bank easy linux ✓ ▶ Authentication bypass (foothold) Directory brute forcing Vhost and subdomain fuzzing Authentication bypass Malicious file upload Credentials in files Privileged groups SUID binaries
Bizness easy linux ✓ ▶ Authentication bypass (foothold) Directory brute forcing Authentication bypass Insecure deserialization Public CVE exploitation Hash cracking
Codify easy linux ✓ ▶ Authentication bypass (root) Public CVE exploitation Hash cracking Authentication bypass Cron jobs and processes Sudo abuse
CozyHosting easy linux ✓ ▶ Authentication bypass (foothold) Directory brute forcing Authentication bypass Command injection Credentials in files Reverse engineering Hash cracking Sudo abuse
MonitorsFour easy windows ✓ ▶ Authentication bypass (foothold) Vhost and subdomain fuzzing Authentication bypass Public CVE exploitation Hash cracking Container escape Scheduled tasks and admin scripts
Previse easy linux ✓ ▶ Authentication bypass (foothold) Directory brute forcing Authentication bypass Command injection Credentials in files Hash cracking PATH hijacking Sudo abuse
Shoppy easy linux ✓ ▶ Authentication bypass (foothold) Authentication bypass NoSQL injection Vhost and subdomain fuzzing Reverse engineering Hash cracking Container escape
Silentium easy linux ✓ ▶ Authentication bypass (foothold) Vhost and subdomain fuzzing Authentication bypass Public CVE exploitation Credentials in files SSH keys Internal services and port forwarding
AirTouch medium linux ✓ ▶ Authentication bypass (user) SNMP enumeration Wi-Fi attacks Authentication bypass Malicious file upload Hash cracking Traffic analysis (pcap) Sudo abuse Credentials in files
Awkward medium linux ✓ ▶ Authentication bypass (foothold) API enumeration Vhost and subdomain fuzzing Authentication bypass JWT attacks LFI / path traversal SSRF Hash cracking Credentials in files Command injection Cron jobs and processes Symlink abuse
Backfire medium linux ✓ ▶ Authentication bypass (user) Public CVE exploitation SSRF Authentication bypass JWT attacks Internal services and port forwarding SSH keys Sudo abuse
Book medium linux ✓ ▶ Authentication bypass (foothold) Authentication bypass Cross-Site Scripting (XSS) LFI / path traversal SSH keys Public CVE exploitation Log analysis
Environment medium linux ✓ ▶ Authentication bypass (foothold) Directory brute forcing Authentication bypass Malicious file upload Public CVE exploitation Credentials in files Sudo abuse
Era medium linux ✓ ▶ Authentication bypass (foothold) Directory brute forcing Vhost and subdomain fuzzing Authentication bypass IDOR Backups and archives Cron jobs and processes Privileged groups
Europa medium linux ✓ ▶ Authentication bypass (foothold) Vhost and subdomain fuzzing Authentication bypass Command injection SQL injection Cron jobs and processes
Noter medium linux ✓ ▶ Authentication bypass (foothold) Authentication bypass Command injection Public CVE exploitation Credentials in files Cookie or session forging
SolarLab medium windows ✓ ▶ Authentication bypass (root) SMB/NFS enumeration Public CVE exploitation Password spraying and valid users Credentials in files Password reuse Remote execution (WinRM, PsExec, WMI) Authentication bypass Internal services and port forwarding Weak or homemade cryptography
Wall medium linux ✓ ▶ Authentication bypass (foothold) API enumeration Directory brute forcing Authentication bypass Command injection Credentials in files Reverse engineering Public CVE exploitation SUID binaries
Control hard windows ✓ ▶ Authentication bypass (foothold) Directory brute forcing Authentication bypass SQL injection AV and EDR evasion Credentials in the registry and history Hash cracking Misconfigured services
Helpline hard windows ✓ ▶ Authentication bypass (foothold) Authentication bypass Default credentials Public CVE exploitation Saved credentials / DPAPI Credentials in files SAM/LSA/LSASS dumping AV and EDR evasion Log analysis
Eloquia insane windows ✓ ▶ Authentication bypass (foothold) Authentication bypass Cross-Site Scripting (XSS) Malicious file upload Server-Side Template Injection NTLM capture and relay Saved credentials / DPAPI AppLocker and Constrained Language Mode DLL hijacking