Admirer easy linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing Authentication bypass LFI / path traversal Credentials in files Library hijacking Sudo abuse
Alert easy linux ✓ ▶ LFI / path traversal (foothold) Cross-Site Scripting (XSS) LFI / path traversal Hash cracking Internal services and port forwarding
Backdoor easy linux ✓ ▶ LFI / path traversal (foothold) CMS exploitation LFI / path traversal Public CVE exploitation Sudo abuse
BountyHunter easy linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing LFI / path traversal XXE Credentials in files Password reuse Sudo abuse
Chemistry easy linux ✓ ▶ LFI / path traversal (root) Public CVE exploitation Credentials in files Hash cracking LFI / path traversal Internal services and port forwarding
Conversor easy linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Cron jobs and processes Public CVE exploitation Sudo abuse
Down easy linux ✓ ▶ LFI / path traversal (foothold) Command injection LFI / path traversal SSRF Hash cracking
Inject easy linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing LFI / path traversal Public CVE exploitation Credentials in files Cron jobs and processes
LaCasaDePapel easy linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation Weak or homemade cryptography SSH keys Cron jobs and processes
LinkVortex easy linux ✓ ▶ LFI / path traversal (user) Exposed .git repository Vhost and subdomain fuzzing Public CVE exploitation LFI / path traversal Command injection Sudo abuse Symlink abuse Race condition
Mailing easy windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Credentials in files Phishing and malicious documents NTLM capture and relay Remote execution (WinRM, PsExec, WMI) Public CVE exploitation
OpenSource easy linux ✓ ▶ LFI / path traversal (foothold) Exposed .git repository LFI / path traversal Container escape SSH keys Internal services and port forwarding Git history Cron jobs and processes
ServMon easy windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation Password spraying and valid users Credentials in files Internal services and port forwarding AV and EDR evasion
Tabby easy linux ✓ ▶ LFI / path traversal (foothold) Vhost and subdomain fuzzing LFI / path traversal Malicious file upload Password reuse Hash cracking Backups and archives Container escape Privileged groups
Titanic easy linux ✓ ▶ LFI / path traversal (foothold) Vhost and subdomain fuzzing LFI / path traversal Hash cracking Public CVE exploitation Cron jobs and processes
Topology easy linux ✓ ▶ LFI / path traversal (foothold) Vhost and subdomain fuzzing LFI / path traversal Hash cracking Cron jobs and processes
Agile medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal IDOR Credentials in files Internal services and port forwarding Public CVE exploitation Sudo abuse
Ambassador medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation Credentials in files API enumeration Internal services and port forwarding Git history
Aragog medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal XXE SSH keys CMS exploitation Cron jobs and processes
Awkward medium linux ✓ ▶ LFI / path traversal (foothold) API enumeration Vhost and subdomain fuzzing Authentication bypass JWT attacks LFI / path traversal SSRF Hash cracking Credentials in files Command injection Cron jobs and processes Symlink abuse
Bart medium windows ✓ ▶ LFI / path traversal (foothold) Vhost and subdomain fuzzing LFI / path traversal Log analysis Credentials in the registry and history Hash cracking
Book medium linux ✓ ▶ LFI / path traversal (foothold) Authentication bypass Cross-Site Scripting (XSS) LFI / path traversal SSH keys Public CVE exploitation Log analysis
BroScience medium linux ✓ ▶ LFI / path traversal (foothold) Insecure deserialization LFI / path traversal Weak or homemade cryptography Credentials in files Hash cracking Command injection Cron jobs and processes
Bucket medium linux ✓ ▶ LFI / path traversal (root) Vhost and subdomain fuzzing Malicious file upload Credentials in files Password reuse LFI / path traversal SSH keys Internal services and port forwarding
Builder medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation Hash cracking SSH keys
DevArea medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation Reverse engineering Command injection Cron jobs and processes Symlink abuse Internal services and port forwarding Cookie or session forging
Format medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Malicious file upload SSRF Credentials in files Sudo abuse Format string
Health medium linux ✓ ▶ LFI / path traversal (root) Public CVE exploitation SQL injection SSRF Hash cracking LFI / path traversal Cron jobs and processes
Imagery medium linux ✓ ▶ LFI / path traversal (foothold) Command injection Cross-Site Scripting (XSS) LFI / path traversal Hash cracking Backups and archives
Inception medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Malicious file upload Credentials in files Sudo abuse Internal services and port forwarding Cron jobs and processes
Instant medium linux ✓ ▶ LFI / path traversal (foothold) API enumeration LFI / path traversal Credentials in files Reverse engineering SSH keys Hash cracking Backups and archives
Jarvis medium linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing LFI / path traversal Public CVE exploitation SQL injection Hash cracking Command injection Sudo abuse SUID binaries
Nineveh medium linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing LFI / path traversal Public CVE exploitation Steganography Cron jobs and processes
Obscurity medium linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing Command injection LFI / path traversal Weak or homemade cryptography Sudo abuse Race condition Hash cracking
POV medium windows ✓ ▶ LFI / path traversal (foothold) Vhost and subdomain fuzzing IIS and ASP.NET Insecure deserialization LFI / path traversal Credentials in files Remote execution (WinRM, PsExec, WMI) Other token privileges
Retired medium linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing LFI / path traversal Reverse engineering ROP / ret2libc Stack buffer overflow Cron jobs and processes SSH keys Symlink abuse Linux capabilities
Sniper medium windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Remote file inclusion (RFI) AppLocker and Constrained Language Mode Credentials in files Phishing and malicious documents NTLM capture and relay Internal services and port forwarding
StreamIO medium windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal SQL injection NTLM capture and relay Password spraying and valid users Hash cracking Saved credentials / DPAPI MSSQL abuse ACL abuse (BloodHound) Reading LAPS passwords
Unicode medium linux ✓ ▶ LFI / path traversal (foothold) JWT attacks LFI / path traversal Credentials in files SSH keys Sudo abuse Reverse engineering
VariaType medium linux ✓ ▶ LFI / path traversal (foothold) Exposed .git repository LFI / path traversal Malicious file upload Public CVE exploitation Metadata and OSINT SSH keys Sudo abuse
Zipping medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Malicious file upload SQL injection Library hijacking Sudo abuse
Breadcrumbs hard windows ✓ ▶ LFI / path traversal (foothold) JWT attacks LFI / path traversal Malicious file upload AV and EDR evasion Cookie or session forging Credentials in the registry and history Credentials in files SQL injection Internal services and port forwarding Reverse engineering Weak or homemade cryptography
Cerberus hard windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation SUID binaries Credentials in files Internal services and port forwarding Remote execution (WinRM, PsExec, WMI)
Hancliffe hard windows ✓ ▶ LFI / path traversal (foothold) Directory brute forcing LFI / path traversal Server-Side Template Injection Public CVE exploitation Saved credentials / DPAPI Internal services and port forwarding Reverse engineering Stack buffer overflow Weak or homemade cryptography
Haze hard windows ✓ ▶ LFI / path traversal (foothold) Domain LDAP/RPC enumeration LFI / path traversal Public CVE exploitation Password spraying and valid users Credentials in files ACL abuse (BloodHound) gMSA accounts Shadow Credentials Backups and archives SeImpersonate / Potatoes
Proper hard windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Remote file inclusion (RFI) SQL injection NTLM capture and relay Race condition Symlink abuse Reverse engineering
Reel2 hard windows ✓ ▶ LFI / path traversal (root) Phishing and malicious documents NTLM capture and relay Password spraying and valid users Hash cracking Credentials in the registry and history Remote execution (WinRM, PsExec, WMI) AppLocker and Constrained Language Mode LFI / path traversal
Bighead insane windows ✓ ▶ LFI / path traversal (root) Vhost and subdomain fuzzing Stack buffer overflow Credentials in the registry and history Internal services and port forwarding LFI / path traversal Hash cracking
Ghost insane windows ✓ ▶ LFI / path traversal (foothold) Vhost and subdomain fuzzing LDAP injection LFI / path traversal gMSA accounts NTLM capture and relay Pass-the-hash / ticket SeImpersonate / Potatoes Domain and forest trusts MSSQL abuse AV and EDR evasion
Mist insane windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation AV and EDR evasion Hash cracking Phishing and malicious documents ADCS (certificates) DCSync gMSA accounts Kerberos delegation (RBCD) NTLM capture and relay Shadow Credentials SAM/LSA/LSASS dumping