Academy easy linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing Vhost and subdomain fuzzing Insecure deserialization Mass assignment Public CVE exploitation Privileged groups Credentials in files Password reuse Log analysis Sudo abuse
Armageddon easy linux ✓ ▶ Public CVE exploitation (foothold) CMS exploitation Public CVE exploitation Credentials in files Hash cracking Sudo abuse
Backdoor easy linux ✓ ▶ Public CVE exploitation (foothold) CMS exploitation LFI / path traversal Public CVE exploitation Sudo abuse
Bizness easy linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing Authentication bypass Insecure deserialization Public CVE exploitation Hash cracking
Boardlight easy linux ✓ ▶ Public CVE exploitation (foothold) Vhost and subdomain fuzzing Default credentials Public CVE exploitation Credentials in files Password reuse SUID binaries
Broker easy linux ✓ ▶ Public CVE exploitation (foothold) Default credentials Public CVE exploitation SSH keys Sudo abuse
Buff easy windows ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Internal services and port forwarding Stack buffer overflow
Chemistry easy linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Credentials in files Hash cracking LFI / path traversal Internal services and port forwarding
CodePartTwo easy linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Credentials in files Sudo abuse Backups and archives
Codify easy linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Hash cracking Authentication bypass Cron jobs and processes Sudo abuse
Conversor easy linux ✓ ▶ Public CVE exploitation (root) LFI / path traversal Cron jobs and processes Public CVE exploitation Sudo abuse
Crafty easy windows ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Credentials in files Remote execution (WinRM, PsExec, WMI) Reverse engineering
Devvortex easy linux ✓ ▶ Public CVE exploitation (foothold) Vhost and subdomain fuzzing CMS exploitation Mass assignment Public CVE exploitation Hash cracking Sudo abuse
Doctor easy linux ✓ ▶ Public CVE exploitation (root) Command injection Server-Side Template Injection Privileged groups Log analysis Public CVE exploitation
Driver easy windows ✓ ▶ Public CVE exploitation (root) Default credentials NTLM capture and relay Remote execution (WinRM, PsExec, WMI) Hash cracking Public CVE exploitation Windows exploits
Editor easy linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Credentials in files PATH hijacking SUID binaries
Frolic easy linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing Malicious file upload Public CVE exploitation Hash cracking SUID binaries ROP / ret2libc Stack buffer overflow
Haystack easy linux ✓ ▶ Public CVE exploitation (user) API enumeration Credentials in files Public CVE exploitation Internal services and port forwarding Log analysis
Help easy linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing GraphQL Malicious file upload Public CVE exploitation SQL injection Kernel or system exploit
Inject easy linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing LFI / path traversal Public CVE exploitation Credentials in files Cron jobs and processes
Irked easy linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Steganography SUID binaries Reverse engineering
Keeper easy linux ✓ ▶ Public CVE exploitation (root) Default credentials Credentials in files Public CVE exploitation SSH keys Memory dumps
Kobold easy linux ✓ ▶ Public CVE exploitation (foothold) Vhost and subdomain fuzzing Public CVE exploitation SSH keys Container escape Privileged groups Credentials in files
LaCasaDePapel easy linux ✓ ▶ Public CVE exploitation (foothold) LFI / path traversal Public CVE exploitation Weak or homemade cryptography SSH keys Cron jobs and processes
LinkVortex easy linux ✓ ▶ Public CVE exploitation (foothold) Exposed .git repository Vhost and subdomain fuzzing Public CVE exploitation LFI / path traversal Command injection Sudo abuse Symlink abuse Race condition
Mailing easy windows ✓ ▶ Public CVE exploitation (root) LFI / path traversal Credentials in files Phishing and malicious documents NTLM capture and relay Remote execution (WinRM, PsExec, WMI) Public CVE exploitation
MonitorsFour easy windows ✓ ▶ Public CVE exploitation (foothold) Vhost and subdomain fuzzing Authentication bypass Public CVE exploitation Hash cracking Container escape Scheduled tasks and admin scripts
MonitorsTwo easy linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Hash cracking Container escape Linux capabilities SUID binaries
Netmon easy windows ✓ ▶ Public CVE exploitation (foothold) Command injection Public CVE exploitation Credentials in files Backups and archives
Nibbles easy linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing CMS exploitation Malicious file upload Public CVE exploitation Sudo abuse
Nocturnal easy linux ✓ ▶ Public CVE exploitation (root) Directory brute forcing Command injection IDOR Hash cracking Public CVE exploitation Internal services and port forwarding
OpenAdmin easy linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing Public CVE exploitation SSH keys Credentials in files Internal services and port forwarding Password reuse Hash cracking Sudo abuse
Pandora easy linux ✓ ▶ Public CVE exploitation (user) SNMP enumeration Malicious file upload Public CVE exploitation SQL injection Internal services and port forwarding PATH hijacking SUID binaries
PC easy linux ✓ ▶ Public CVE exploitation (root) API enumeration SQL injection Public CVE exploitation Internal services and port forwarding
PermX easy linux ✓ ▶ Public CVE exploitation (foothold) Vhost and subdomain fuzzing Public CVE exploitation Credentials in files Password reuse Sudo abuse Symlink abuse
Planning easy linux ✓ ▶ Public CVE exploitation (foothold) Vhost and subdomain fuzzing Public CVE exploitation Credentials in files Cron jobs and processes Internal services and port forwarding
Postman easy linux ✓ ▶ Public CVE exploitation (root) SSH keys Password reuse Hash cracking Public CVE exploitation
Precious easy linux ✓ ▶ Public CVE exploitation (foothold) Metadata and OSINT Command injection Public CVE exploitation Credentials in files Insecure deserialization Sudo abuse
Reactor easy linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Credentials in files
Remote easy windows ✓ ▶ Public CVE exploitation (foothold) SMB/NFS enumeration CMS exploitation Public CVE exploitation Credentials in files Misconfigured services SeImpersonate / Potatoes
Sau easy linux ✓ ▶ Public CVE exploitation (foothold) Command injection Public CVE exploitation SSRF Sudo abuse
ScriptKiddie easy linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Command injection Sudo abuse
Sea easy linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing CMS exploitation Cross-Site Scripting (XSS) Public CVE exploitation Hash cracking Command injection Internal services and port forwarding
ServMon easy windows ✓ ▶ Public CVE exploitation (foothold) LFI / path traversal Public CVE exploitation Password spraying and valid users Credentials in files Internal services and port forwarding AV and EDR evasion
Silentium easy linux ✓ ▶ Public CVE exploitation (foothold) Vhost and subdomain fuzzing Authentication bypass Public CVE exploitation Credentials in files SSH keys Internal services and port forwarding
Soulmate easy linux ✓ ▶ Public CVE exploitation (foothold) Vhost and subdomain fuzzing Malicious file upload Public CVE exploitation
Swagshop easy linux ✓ ▶ Public CVE exploitation (foothold) CMS exploitation Insecure deserialization Public CVE exploitation SQL injection Sudo abuse
Teacher easy linux ✓ ▶ Public CVE exploitation (foothold) Metadata and OSINT Public CVE exploitation Hash cracking Cron jobs and processes
Titanic easy linux ✓ ▶ Public CVE exploitation (root) Vhost and subdomain fuzzing LFI / path traversal Hash cracking Public CVE exploitation Cron jobs and processes
Valentine easy linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation SSH keys Memory dumps Kernel or system exploit
WingData easy linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Hash cracking Sudo abuse
Writeup easy linux ✓ ▶ Public CVE exploitation (foothold) CMS exploitation Public CVE exploitation SQL injection Hash cracking Cron jobs and processes PATH hijacking Privileged groups
Agile medium linux ✓ ▶ Public CVE exploitation (root) LFI / path traversal IDOR Credentials in files Internal services and port forwarding Public CVE exploitation Sudo abuse
Ambassador medium linux ✓ ▶ Public CVE exploitation (foothold) LFI / path traversal Public CVE exploitation Credentials in files API enumeration Internal services and port forwarding Git history
Atom medium windows ✓ ▶ Public CVE exploitation (foothold) SMB/NFS enumeration Public CVE exploitation Reverse engineering Credentials in files Weak or homemade cryptography Windows exploits SAM/LSA/LSASS dumping
Backfire medium linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation SSRF Authentication bypass JWT attacks Internal services and port forwarding SSH keys Sudo abuse
Blurry medium linux ✓ ▶ Public CVE exploitation (foothold) Vhost and subdomain fuzzing Insecure deserialization Public CVE exploitation SSH keys Sudo abuse
Book medium linux ✓ ▶ Public CVE exploitation (root) Authentication bypass Cross-Site Scripting (XSS) LFI / path traversal SSH keys Public CVE exploitation Log analysis
Builder medium linux ✓ ▶ Public CVE exploitation (foothold) LFI / path traversal Public CVE exploitation Hash cracking SSH keys
Cache medium linux ✓ ▶ Public CVE exploitation (foothold) Vhost and subdomain fuzzing Malicious file upload Public CVE exploitation SQL injection Credentials in files Internal services and port forwarding Container escape Privileged groups
Canape medium linux ✓ ▶ Public CVE exploitation (user) Directory brute forcing Exposed .git repository Insecure deserialization Git history Public CVE exploitation Credentials in files Sudo abuse
Cat medium linux ✓ ▶ Public CVE exploitation (root) Exposed .git repository Cross-Site Scripting (XSS) SQL injection Privileged groups Hash cracking Log analysis CSRF Public CVE exploitation Internal services and port forwarding
Chatterbox medium windows ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Stack buffer overflow Credentials in the registry and history Password reuse
Compiled medium windows ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Hash cracking Windows exploits
DevArea medium linux ✓ ▶ Public CVE exploitation (foothold) LFI / path traversal Public CVE exploitation Reverse engineering Command injection Cron jobs and processes Symlink abuse Internal services and port forwarding Cookie or session forging
DevHub medium linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation SSH keys Internal services and port forwarding API enumeration Credentials in files
Enterprise medium linux ✓ ▶ Public CVE exploitation (foothold) CMS exploitation Public CVE exploitation SQL injection Container escape Reverse engineering Stack buffer overflow
Environment medium linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing Authentication bypass Malicious file upload Public CVE exploitation Credentials in files Sudo abuse
EvilCUPS medium linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Credentials in files
Hawk medium linux ✓ ▶ Public CVE exploitation (root) CMS exploitation Weak or homemade cryptography Credentials in files Public CVE exploitation Internal services and port forwarding
Health medium linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation SQL injection SSRF Hash cracking LFI / path traversal Cron jobs and processes
Hospital medium windows ✓ ▶ Public CVE exploitation (user) Malicious file upload Phishing and malicious documents Public CVE exploitation Kernel or system exploit Hash cracking
Interface medium linux ✓ ▶ Public CVE exploitation (foothold) API enumeration Metadata and OSINT Public CVE exploitation Command injection Cron jobs and processes
Investigation medium linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing Malicious file upload Public CVE exploitation Log analysis Sudo abuse Race condition Reverse engineering
Jarvis medium linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing LFI / path traversal Public CVE exploitation SQL injection Hash cracking Command injection Sudo abuse SUID binaries
Meta medium linux ✓ ▶ Public CVE exploitation (foothold) Metadata and OSINT Vhost and subdomain fuzzing Malicious file upload Public CVE exploitation Cron jobs and processes Sudo abuse
Nineveh medium linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing LFI / path traversal Public CVE exploitation Steganography Cron jobs and processes
Noter medium linux ✓ ▶ Public CVE exploitation (foothold) Authentication bypass Command injection Public CVE exploitation Credentials in files Cookie or session forging
Olympus medium linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Container escape Wi-Fi attacks Traffic analysis (pcap) Privileged groups
Outdated medium windows ✓ ▶ Public CVE exploitation (foothold) Phishing and malicious documents Public CVE exploitation ACL abuse (BloodHound) Shadow Credentials WSUS abuse
Passage medium linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation SSH keys Hash cracking
Principal medium linux ✓ ▶ Public CVE exploitation (foothold) JWT attacks Public CVE exploitation Credentials in files SSH keys
Pterodactyl medium linux ✓ ▶ Public CVE exploitation (foothold) Vhost and subdomain fuzzing Public CVE exploitation Hash cracking Kernel or system exploit
Ready medium linux ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation SSRF Container escape Password reuse Backups and archives
Sandworm medium linux ✓ ▶ Public CVE exploitation (root) Server-Side Template Injection Cron jobs and processes Library hijacking Credentials in files Public CVE exploitation
Shared medium linux ✓ ▶ Public CVE exploitation (user) Vhost and subdomain fuzzing SQL injection Public CVE exploitation Cron jobs and processes Hash cracking Credentials in files Reverse engineering
Shibboleth medium linux ✓ ▶ Public CVE exploitation (root) Vhost and subdomain fuzzing Hash cracking Password reuse Public CVE exploitation
SolarLab medium windows ✓ ▶ Public CVE exploitation (foothold) SMB/NFS enumeration Public CVE exploitation Password spraying and valid users Credentials in files Password reuse Remote execution (WinRM, PsExec, WMI) Authentication bypass Internal services and port forwarding Weak or homemade cryptography
Surveillance medium linux ✓ ▶ Public CVE exploitation (foothold) CMS exploitation Public CVE exploitation Internal services and port forwarding Hash cracking Backups and archives Command injection Library hijacking Sudo abuse
Tartarsauce medium linux ✓ ▶ Public CVE exploitation (foothold) CMS exploitation Public CVE exploitation Remote file inclusion (RFI) Sudo abuse Cron jobs and processes SUID binaries Symlink abuse
TheFrizz medium windows ✓ ▶ Public CVE exploitation (foothold) Malicious file upload Public CVE exploitation Password spraying and valid users Credentials in files Hash cracking GPP and GPO abuse
TheNotebook medium linux ✓ ▶ Public CVE exploitation (root) JWT attacks Malicious file upload SSH keys Backups and archives Public CVE exploitation Container escape Sudo abuse
Trickster medium linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing Exposed .git repository Vhost and subdomain fuzzing Cross-Site Scripting (XSS) CSRF Public CVE exploitation Server-Side Template Injection Container escape Credentials in files Internal services and port forwarding Hash cracking Backups and archives Sudo abuse
Undetected medium linux ✓ ▶ Public CVE exploitation (foothold) Directory brute forcing Vhost and subdomain fuzzing Public CVE exploitation Hash cracking Reverse engineering
VariaType medium linux ✓ ▶ Public CVE exploitation (foothold) Exposed .git repository LFI / path traversal Malicious file upload Public CVE exploitation Metadata and OSINT SSH keys Sudo abuse
Wall medium linux ✓ ▶ Public CVE exploitation (root) API enumeration Directory brute forcing Authentication bypass Command injection Credentials in files Reverse engineering Public CVE exploitation SUID binaries
Cerberus hard windows ✓ ▶ Public CVE exploitation (foothold) LFI / path traversal Public CVE exploitation SUID binaries Credentials in files Internal services and port forwarding Remote execution (WinRM, PsExec, WMI)
Fries hard windows ✓ ▶ Public CVE exploitation (foothold) Vhost and subdomain fuzzing Public CVE exploitation SMB/NFS enumeration Container escape Internal services and port forwarding ADCS (certificates) gMSA accounts
Hancliffe hard windows ✓ ▶ Public CVE exploitation (user) Directory brute forcing LFI / path traversal Server-Side Template Injection Public CVE exploitation Saved credentials / DPAPI Internal services and port forwarding Reverse engineering Stack buffer overflow Weak or homemade cryptography
Haze hard windows ✓ ▶ Public CVE exploitation (foothold) Domain LDAP/RPC enumeration LFI / path traversal Public CVE exploitation Password spraying and valid users Credentials in files ACL abuse (BloodHound) gMSA accounts Shadow Credentials Backups and archives SeImpersonate / Potatoes
Helpline hard windows ✓ ▶ Public CVE exploitation (foothold) Authentication bypass Default credentials Public CVE exploitation Saved credentials / DPAPI Credentials in files SAM/LSA/LSASS dumping AV and EDR evasion Log analysis
Nanocorp hard windows ✓ ▶ Public CVE exploitation (root) NTLM capture and relay Hash cracking ACL abuse (BloodHound) Remote execution (WinRM, PsExec, WMI) Public CVE exploitation
Office hard windows ✓ ▶ Public CVE exploitation (foothold) CMS exploitation Public CVE exploitation Password spraying and valid users Hash cracking Traffic analysis (pcap) Phishing and malicious documents Internal services and port forwarding Saved credentials / DPAPI GPP and GPO abuse
RE hard windows ✓ ▶ Public CVE exploitation (user) SMB/NFS enumeration Phishing and malicious documents AV and EDR evasion Public CVE exploitation XXE Misconfigured services NTLM capture and relay Hash cracking
Reel hard windows ✓ ▶ Public CVE exploitation (foothold) Metadata and OSINT Phishing and malicious documents Public CVE exploitation Credentials in files AppLocker and Constrained Language Mode ACL abuse (BloodHound)
Mist insane windows ✓ ▶ Public CVE exploitation (foothold) LFI / path traversal Public CVE exploitation AV and EDR evasion Hash cracking Phishing and malicious documents ADCS (certificates) DCSync gMSA accounts Kerberos delegation (RBCD) NTLM capture and relay Shadow Credentials SAM/LSA/LSASS dumping
University insane windows ✓ ▶ Public CVE exploitation (foothold) Public CVE exploitation Phishing and malicious documents Credentials in files Internal services and port forwarding gMSA accounts Kerberos delegation (RBCD) NTLM capture and relay