Artificial easy linux ✓ ▶ Malicious file upload (foothold) Insecure deserialization Malicious file upload Hash cracking Command injection Internal services and port forwarding Backups and archives
Bank easy linux ✓ ▶ Malicious file upload (foothold) Directory brute forcing Vhost and subdomain fuzzing Authentication bypass Malicious file upload Credentials in files Privileged groups SUID binaries
Bounty easy windows ✓ ▶ Malicious file upload (foothold) Directory brute forcing IIS and ASP.NET Malicious file upload SeImpersonate / Potatoes Windows exploits
Devel easy windows ✓ ▶ Malicious file upload (foothold) IIS and ASP.NET Malicious file upload Windows exploits
Frolic easy linux ✓ ▶ Malicious file upload (foothold) Directory brute forcing Malicious file upload Public CVE exploitation Hash cracking SUID binaries ROP / ret2libc Stack buffer overflow
Greenhorn easy linux ✓ ▶ Malicious file upload (foothold) CMS exploitation Malicious file upload Credentials in files Password reuse
Help easy linux ✓ ▶ Malicious file upload (foothold) Directory brute forcing GraphQL Malicious file upload Public CVE exploitation SQL injection Kernel or system exploit
Love easy windows ✓ ▶ Malicious file upload (foothold) Vhost and subdomain fuzzing Malicious file upload SSRF AlwaysInstallElevated
Networked easy linux ✓ ▶ Malicious file upload (foothold) Directory brute forcing Malicious file upload Backups and archives Command injection Cron jobs and processes Sudo abuse
Nibbles easy linux ✓ ▶ Malicious file upload (foothold) Directory brute forcing CMS exploitation Malicious file upload Public CVE exploitation Sudo abuse
Pandora easy linux ✓ ▶ Malicious file upload (user) SNMP enumeration Malicious file upload Public CVE exploitation SQL injection Internal services and port forwarding PATH hijacking SUID binaries
Soccer easy linux ✓ ▶ Malicious file upload (foothold) Directory brute forcing Default credentials Malicious file upload Vhost and subdomain fuzzing SQL injection Sudo abuse
Soulmate easy linux ✓ ▶ Malicious file upload (foothold) Vhost and subdomain fuzzing Malicious file upload Public CVE exploitation
Tabby easy linux ✓ ▶ Malicious file upload (foothold) Vhost and subdomain fuzzing LFI / path traversal Malicious file upload Password reuse Hash cracking Backups and archives Container escape Privileged groups
Usage easy linux ✓ ▶ Malicious file upload (foothold) Malicious file upload SQL injection Hash cracking Sudo abuse Wildcard injection
AirTouch medium linux ✓ ▶ Malicious file upload (user) SNMP enumeration Wi-Fi attacks Authentication bypass Malicious file upload Hash cracking Traffic analysis (pcap) Sudo abuse Credentials in files
Bitlab medium linux ✓ ▶ Malicious file upload (foothold) Directory brute forcing Malicious file upload Credentials in files Git history Reverse engineering Sudo abuse
Bucket medium linux ✓ ▶ Malicious file upload (foothold) Vhost and subdomain fuzzing Malicious file upload Credentials in files Password reuse LFI / path traversal SSH keys Internal services and port forwarding
Cache medium linux ✓ ▶ Malicious file upload (foothold) Vhost and subdomain fuzzing Malicious file upload Public CVE exploitation SQL injection Credentials in files Internal services and port forwarding Container escape Privileged groups
Environment medium linux ✓ ▶ Malicious file upload (foothold) Directory brute forcing Authentication bypass Malicious file upload Public CVE exploitation Credentials in files Sudo abuse
Format medium linux ✓ ▶ Malicious file upload (foothold) LFI / path traversal Malicious file upload SSRF Credentials in files Sudo abuse Format string
Hospital medium windows ✓ ▶ Malicious file upload (foothold) Malicious file upload Phishing and malicious documents Public CVE exploitation Kernel or system exploit Hash cracking
Inception medium linux ✓ ▶ Malicious file upload (foothold) LFI / path traversal Malicious file upload Credentials in files Sudo abuse Internal services and port forwarding Cron jobs and processes
Investigation medium linux ✓ ▶ Malicious file upload (foothold) Directory brute forcing Malicious file upload Public CVE exploitation Log analysis Sudo abuse Race condition Reverse engineering
Jab medium windows ✓ ▶ Malicious file upload (root) AS-REP roasting Password spraying and valid users Hash cracking ACL abuse (BloodHound) Remote execution (WinRM, PsExec, WMI) Malicious file upload Internal services and port forwarding
Meta medium linux ✓ ▶ Malicious file upload (foothold) Metadata and OSINT Vhost and subdomain fuzzing Malicious file upload Public CVE exploitation Cron jobs and processes Sudo abuse
October medium linux ✓ ▶ Malicious file upload (foothold) CMS exploitation Default credentials Malicious file upload SUID binaries ROP / ret2libc Stack buffer overflow
Seal medium linux ✓ ▶ Malicious file upload (foothold) Malicious file upload SSRF Git history Cron jobs and processes SSH keys Symlink abuse Sudo abuse
SecNotes medium windows ✓ ▶ Malicious file upload (foothold) SMB/NFS enumeration CSRF Malicious file upload SQL injection Credentials in the registry and history
SneakyMailer medium linux ✓ ▶ Malicious file upload (foothold) Directory brute forcing Vhost and subdomain fuzzing Cross-Site Scripting (XSS) Malicious file upload Hash cracking Sudo abuse
TheFrizz medium windows ✓ ▶ Malicious file upload (foothold) Malicious file upload Public CVE exploitation Password spraying and valid users Credentials in files Hash cracking GPP and GPO abuse
TheNotebook medium linux ✓ ▶ Malicious file upload (foothold) JWT attacks Malicious file upload SSH keys Backups and archives Public CVE exploitation Container escape Sudo abuse
VariaType medium linux ✓ ▶ Malicious file upload (foothold) Exposed .git repository LFI / path traversal Malicious file upload Public CVE exploitation Metadata and OSINT SSH keys Sudo abuse
Vault medium linux ✓ ▶ Malicious file upload (foothold) Directory brute forcing Malicious file upload Command injection Credentials in files Internal services and port forwarding Weak or homemade cryptography
WifineticTwo medium linux ✓ ▶ Malicious file upload (foothold) Default credentials Malicious file upload Wi-Fi attacks Internal services and port forwarding
Zipping medium linux ✓ ▶ Malicious file upload (foothold) LFI / path traversal Malicious file upload SQL injection Library hijacking Sudo abuse
Analysis hard windows ✓ ▶ Malicious file upload (foothold) Directory brute forcing Vhost and subdomain fuzzing LDAP injection Malicious file upload Credentials in the registry and history Log analysis DLL hijacking
AppSanity hard windows ✓ ▶ Malicious file upload (foothold) Vhost and subdomain fuzzing IIS and ASP.NET Malicious file upload Mass assignment SSRF Password spraying and valid users Reverse engineering DLL hijacking Internal services and port forwarding
Breadcrumbs hard windows ✓ ▶ Malicious file upload (foothold) JWT attacks LFI / path traversal Malicious file upload AV and EDR evasion Cookie or session forging Credentials in the registry and history Credentials in files SQL injection Internal services and port forwarding Reverse engineering Weak or homemade cryptography
Certificate hard windows ✓ ▶ Malicious file upload (foothold) Malicious file upload Hash cracking Traffic analysis (pcap) Other token privileges ADCS (certificates)
Conceal hard windows ✓ ▶ Malicious file upload (foothold) SNMP enumeration IIS and ASP.NET Malicious file upload Hash cracking SeImpersonate / Potatoes Windows exploits
Eloquia insane windows ✓ ▶ Malicious file upload (foothold) Authentication bypass Cross-Site Scripting (XSS) Malicious file upload Server-Side Template Injection NTLM capture and relay Saved credentials / DPAPI AppLocker and Constrained Language Mode DLL hijacking
Hathor insane windows ✓ ▶ Malicious file upload (foothold) Default credentials IIS and ASP.NET Malicious file upload AppLocker and Constrained Language Mode SMB/NFS enumeration DLL hijacking Credentials in files Hash cracking Pass-the-hash / ticket
Perspective insane windows ✓ ▶ Malicious file upload (foothold) IDOR IIS and ASP.NET Insecure deserialization Malicious file upload SSRF Cookie or session forging Command injection SeImpersonate / Potatoes Internal services and port forwarding Padding oracle