Academy easy linux ✓ ▶ Password reuse (user) Directory brute forcing Vhost and subdomain fuzzing Insecure deserialization Mass assignment Public CVE exploitation Privileged groups Credentials in files Password reuse Log analysis Sudo abuse
Blocky easy linux ✓ ▶ Password reuse (user) Directory brute forcing CMS exploitation Credentials in files Reverse engineering Password reuse Kernel or system exploit Sudo abuse
Boardlight easy linux ✓ ▶ Password reuse (user) Vhost and subdomain fuzzing Default credentials Public CVE exploitation Credentials in files Password reuse SUID binaries
BountyHunter easy linux ✓ ▶ Password reuse (user) Directory brute forcing LFI / path traversal XXE Credentials in files Password reuse Sudo abuse
Cap easy linux ✓ ▶ Password reuse (user) IDOR Traffic analysis (pcap) Password reuse Linux capabilities
Dog easy linux ✓ ▶ Password reuse (user) Exposed .git repository CMS exploitation Credentials in files Password reuse Sudo abuse
Greenhorn easy linux ✓ ▶ Password reuse (user) CMS exploitation Malicious file upload Credentials in files Password reuse
OpenAdmin easy linux ✓ ▶ Password reuse (user) Directory brute forcing Public CVE exploitation SSH keys Credentials in files Internal services and port forwarding Password reuse Hash cracking Sudo abuse
PermX easy linux ✓ ▶ Password reuse (user) Vhost and subdomain fuzzing Public CVE exploitation Credentials in files Password reuse Sudo abuse Symlink abuse
Postman easy linux ✓ ▶ Password reuse (user) SSH keys Password reuse Hash cracking Public CVE exploitation
Tabby easy linux ✓ ▶ Password reuse (user) Vhost and subdomain fuzzing LFI / path traversal Malicious file upload Password reuse Hash cracking Backups and archives Container escape Privileged groups
TwoMillion easy linux ✓ ▶ Password reuse (user) API enumeration Command injection Mass assignment Credentials in files Password reuse Kernel or system exploit
Bolt medium linux ✓ ▶ Password reuse (user) Vhost and subdomain fuzzing Server-Side Template Injection Container escape Hash cracking Git history Credentials in files Password reuse Weak or homemade cryptography
Bucket medium linux ✓ ▶ Password reuse (user) Vhost and subdomain fuzzing Malicious file upload Credentials in files Password reuse LFI / path traversal SSH keys Internal services and port forwarding
Chaos medium linux ✓ ▶ Password reuse (user) Directory brute forcing CMS exploitation Command injection Credentials in files Weak or homemade cryptography Password reuse
Chatterbox medium windows ✓ ▶ Password reuse (root) Public CVE exploitation Stack buffer overflow Credentials in the registry and history Password reuse
Checkpoint medium windows ✓ ▶ Password reuse (foothold) ACL abuse (BloodHound) Deleted AD objects Password reuse Phishing and malicious documents BadSuccessor (dMSA) Pass-the-hash / ticket Memory dumps
Hacknet medium linux ✓ ▶ Password reuse (user) Server-Side Template Injection Insecure deserialization Password reuse Hash cracking Backups and archives
Ready medium linux ✓ ▶ Password reuse (root) Public CVE exploitation SSRF Container escape Password reuse Backups and archives
Shibboleth medium linux ✓ ▶ Password reuse (user) Vhost and subdomain fuzzing Hash cracking Password reuse Public CVE exploitation
Socket medium linux ✓ ▶ Password reuse (user) SQL injection Reverse engineering Traffic analysis (pcap) Password reuse Sudo abuse
SolarLab medium windows ✓ ▶ Password reuse (user) SMB/NFS enumeration Public CVE exploitation Password spraying and valid users Credentials in files Password reuse Remote execution (WinRM, PsExec, WMI) Authentication bypass Internal services and port forwarding Weak or homemade cryptography
Acute hard windows ✓ ▶ Password reuse (user) Password spraying and valid users Remote execution (WinRM, PsExec, WMI) AV and EDR evasion Password reuse SAM/LSA/LSASS dumping AppLocker and Constrained Language Mode Hash cracking Scheduled tasks and admin scripts ACL abuse (BloodHound)