Secret easy linux ✓ ▶ JWT attacks (foothold) API enumeration Command injection JWT attacks Git history SSH keys SUID binaries Memory dumps
Awkward medium linux ✓ ▶ JWT attacks (foothold) API enumeration Vhost and subdomain fuzzing Authentication bypass JWT attacks LFI / path traversal SSRF Hash cracking Credentials in files Command injection Cron jobs and processes Symlink abuse
Backfire medium linux ✓ ▶ JWT attacks (user) Public CVE exploitation SSRF Authentication bypass JWT attacks Internal services and port forwarding SSH keys Sudo abuse
Principal medium linux ✓ ▶ JWT attacks (foothold) JWT attacks Public CVE exploitation Credentials in files SSH keys
TheNotebook medium linux ✓ ▶ JWT attacks (foothold) JWT attacks Malicious file upload SSH keys Backups and archives Public CVE exploitation Container escape Sudo abuse
Unicode medium linux ✓ ▶ JWT attacks (foothold) JWT attacks LFI / path traversal Credentials in files SSH keys Sudo abuse Reverse engineering
Blazorized hard windows ✓ ▶ JWT attacks (foothold) JWT attacks SQL injection MSSQL abuse Reverse engineering ACL abuse (BloodHound) Kerberoasting Scheduled tasks and admin scripts DCSync
Breadcrumbs hard windows ✓ ▶ JWT attacks (foothold) JWT attacks LFI / path traversal Malicious file upload AV and EDR evasion Cookie or session forging Credentials in the registry and history Credentials in files SQL injection Internal services and port forwarding Reverse engineering Weak or homemade cryptography
Cereal hard windows ✓ ▶ JWT attacks (foothold) Exposed .git repository Cross-Site Scripting (XSS) Insecure deserialization JWT attacks Git history GraphQL SSRF SeImpersonate / Potatoes Internal services and port forwarding