Academy easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Vhost and subdomain fuzzing Insecure deserialization Mass assignment Public CVE exploitation Privileged groups Credentials in files Password reuse Log analysis Sudo abuse
Admirer easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Authentication bypass LFI / path traversal Credentials in files Library hijacking Sudo abuse
Bank easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Vhost and subdomain fuzzing Authentication bypass Malicious file upload Credentials in files Privileged groups SUID binaries
Bizness easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Authentication bypass Insecure deserialization Public CVE exploitation Hash cracking
Blocky easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing CMS exploitation Credentials in files Reverse engineering Password reuse Kernel or system exploit Sudo abuse
Bounty easy windows ✓ ▶ Directory brute forcing (foothold) Directory brute forcing IIS and ASP.NET Malicious file upload SeImpersonate / Potatoes Windows exploits
BountyHunter easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing LFI / path traversal XXE Credentials in files Password reuse Sudo abuse
CozyHosting easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Authentication bypass Command injection Credentials in files Reverse engineering Hash cracking Sudo abuse
Frolic easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Malicious file upload Public CVE exploitation Hash cracking SUID binaries ROP / ret2libc Stack buffer overflow
Help easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing GraphQL Malicious file upload Public CVE exploitation SQL injection Kernel or system exploit
Inject easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing LFI / path traversal Public CVE exploitation Credentials in files Cron jobs and processes
Networked easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Malicious file upload Backups and archives Command injection Cron jobs and processes Sudo abuse
Nibbles easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing CMS exploitation Malicious file upload Public CVE exploitation Sudo abuse
Nocturnal easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Command injection IDOR Hash cracking Public CVE exploitation Internal services and port forwarding
OpenAdmin easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Public CVE exploitation SSH keys Credentials in files Internal services and port forwarding Password reuse Hash cracking Sudo abuse
Previse easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Authentication bypass Command injection Credentials in files Hash cracking PATH hijacking Sudo abuse
Sea easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing CMS exploitation Cross-Site Scripting (XSS) Public CVE exploitation Hash cracking Command injection Internal services and port forwarding
Soccer easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Default credentials Malicious file upload Vhost and subdomain fuzzing SQL injection Sudo abuse
Traceback easy linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Default credentials SSH keys Sudo abuse Cron jobs and processes
AI medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing SQL injection Command injection Internal services and port forwarding
Bitlab medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Malicious file upload Credentials in files Git history Reverse engineering Sudo abuse
Canape medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Exposed .git repository Insecure deserialization Git history Public CVE exploitation Credentials in files Sudo abuse
Chaos medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing CMS exploitation Command injection Credentials in files Weak or homemade cryptography Password reuse
Environment medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Authentication bypass Malicious file upload Public CVE exploitation Credentials in files Sudo abuse
Era medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Vhost and subdomain fuzzing Authentication bypass IDOR Backups and archives Cron jobs and processes Privileged groups
Forge medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Vhost and subdomain fuzzing SSRF SSH keys Sudo abuse
Giddy medium windows ✓ ▶ Directory brute forcing (foothold) Directory brute forcing SQL injection NTLM capture and relay Hash cracking Misconfigured services AppLocker and Constrained Language Mode AV and EDR evasion
Investigation medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Malicious file upload Public CVE exploitation Log analysis Sudo abuse Race condition Reverse engineering
Jarvis medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing LFI / path traversal Public CVE exploitation SQL injection Hash cracking Command injection Sudo abuse SUID binaries
LightWeight medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Linux capabilities Hash cracking Backups and archives Traffic analysis (pcap) Sudo abuse
Nineveh medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing LFI / path traversal Public CVE exploitation Steganography Cron jobs and processes
Obscurity medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Command injection LFI / path traversal Weak or homemade cryptography Sudo abuse Race condition Hash cracking
Retired medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing LFI / path traversal Reverse engineering ROP / ret2libc Stack buffer overflow Cron jobs and processes SSH keys Symlink abuse Linux capabilities
SneakyMailer medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Vhost and subdomain fuzzing Cross-Site Scripting (XSS) Malicious file upload Hash cracking Sudo abuse
Trickster medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Exposed .git repository Vhost and subdomain fuzzing Cross-Site Scripting (XSS) CSRF Public CVE exploitation Server-Side Template Injection Container escape Credentials in files Internal services and port forwarding Hash cracking Backups and archives Sudo abuse
Undetected medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Vhost and subdomain fuzzing Public CVE exploitation Hash cracking Reverse engineering
Vault medium linux ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Malicious file upload Command injection Credentials in files Internal services and port forwarding Weak or homemade cryptography
Wall medium linux ✓ ▶ Directory brute forcing (foothold) API enumeration Directory brute forcing Authentication bypass Command injection Credentials in files Reverse engineering Public CVE exploitation SUID binaries
Analysis hard windows ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Vhost and subdomain fuzzing LDAP injection Malicious file upload Credentials in the registry and history Log analysis DLL hijacking
Control hard windows ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Authentication bypass SQL injection AV and EDR evasion Credentials in the registry and history Hash cracking Misconfigured services
Hancliffe hard windows ✓ ▶ Directory brute forcing (foothold) Directory brute forcing LFI / path traversal Server-Side Template Injection Public CVE exploitation Saved credentials / DPAPI Internal services and port forwarding Reverse engineering Stack buffer overflow Weak or homemade cryptography
Mantis hard windows ✓ ▶ Directory brute forcing (foothold) Directory brute forcing Credentials in files Windows exploits