Blocky easy linux ✓ ▶ Reverse engineering (foothold) Directory brute forcing CMS exploitation Credentials in files Reverse engineering Password reuse Kernel or system exploit Sudo abuse
CozyHosting easy linux ✓ ▶ Reverse engineering (user) Directory brute forcing Authentication bypass Command injection Credentials in files Reverse engineering Hash cracking Sudo abuse
Crafty easy windows ✓ ▶ Reverse engineering (root) Public CVE exploitation Credentials in files Remote execution (WinRM, PsExec, WMI) Reverse engineering
Irked easy linux ✓ ▶ Reverse engineering (root) Public CVE exploitation Steganography SUID binaries Reverse engineering
Nest easy windows ✓ ▶ Reverse engineering (user) SMB/NFS enumeration Password spraying and valid users Credentials in files Reverse engineering Remote execution (WinRM, PsExec, WMI)
RedPanda easy linux ✓ ▶ Reverse engineering (root) Server-Side Template Injection Metadata and OSINT XXE Cron jobs and processes Reverse engineering Log analysis
RouterSpace easy linux ✓ ▶ Reverse engineering (foothold) Command injection Reverse engineering SSH keys Kernel or system exploit
Shoppy easy linux ✓ ▶ Reverse engineering (user) Authentication bypass NoSQL injection Vhost and subdomain fuzzing Reverse engineering Hash cracking Container escape
Support easy windows ✓ ▶ Reverse engineering (foothold) SMB/NFS enumeration Reverse engineering Traffic analysis (pcap) Domain LDAP/RPC enumeration ACL abuse (BloodHound) Kerberos delegation (RBCD) Pass-the-hash / ticket
Atom medium windows ✓ ▶ Reverse engineering (foothold) SMB/NFS enumeration Public CVE exploitation Reverse engineering Credentials in files Weak or homemade cryptography Windows exploits SAM/LSA/LSASS dumping
Bitlab medium linux ✓ ▶ Reverse engineering (user) Directory brute forcing Malicious file upload Credentials in files Git history Reverse engineering Sudo abuse
Cascade medium windows ✓ ▶ Reverse engineering (root) Domain LDAP/RPC enumeration SMB/NFS enumeration Credentials in the registry and history Remote execution (WinRM, PsExec, WMI) Weak or homemade cryptography Privileged Windows groups Deleted AD objects Reverse engineering
DevArea medium linux ✓ ▶ Reverse engineering (foothold) LFI / path traversal Public CVE exploitation Reverse engineering Command injection Cron jobs and processes Symlink abuse Internal services and port forwarding Cookie or session forging
Enterprise medium linux ✓ ▶ Reverse engineering (root) CMS exploitation Public CVE exploitation SQL injection Container escape Reverse engineering Stack buffer overflow
Gavel medium linux ✓ ▶ Reverse engineering (root) Exposed .git repository SQL injection Hash cracking Reverse engineering
Instant medium linux ✓ ▶ Reverse engineering (foothold) API enumeration LFI / path traversal Credentials in files Reverse engineering SSH keys Hash cracking Backups and archives
Investigation medium linux ✓ ▶ Reverse engineering (root) Directory brute forcing Malicious file upload Public CVE exploitation Log analysis Sudo abuse Race condition Reverse engineering
JSON medium windows ✓ ▶ Reverse engineering (root) Default credentials Insecure deserialization SeImpersonate / Potatoes Internal services and port forwarding Reverse engineering
Ophiuchi medium linux ✓ ▶ Reverse engineering (root) Insecure deserialization Credentials in files Sudo abuse Reverse engineering
Overwatch medium windows ✓ ▶ Reverse engineering (foothold) SMB/NFS enumeration MSSQL abuse Reverse engineering NTLM capture and relay API enumeration
Retired medium linux ✓ ▶ Reverse engineering (foothold) Directory brute forcing LFI / path traversal Reverse engineering ROP / ret2libc Stack buffer overflow Cron jobs and processes SSH keys Symlink abuse Linux capabilities
Shared medium linux ✓ ▶ Reverse engineering (root) Vhost and subdomain fuzzing SQL injection Public CVE exploitation Cron jobs and processes Hash cracking Credentials in files Reverse engineering
Socket medium linux ✓ ▶ Reverse engineering (foothold) SQL injection Reverse engineering Traffic analysis (pcap) Password reuse Sudo abuse
Undetected medium linux ✓ ▶ Reverse engineering (root) Directory brute forcing Vhost and subdomain fuzzing Public CVE exploitation Hash cracking Reverse engineering
Unicode medium linux ✓ ▶ Reverse engineering (root) JWT attacks LFI / path traversal Credentials in files SSH keys Sudo abuse Reverse engineering
Wall medium linux ✓ ▶ Reverse engineering (user) API enumeration Directory brute forcing Authentication bypass Command injection Credentials in files Reverse engineering Public CVE exploitation SUID binaries
AppSanity hard windows ✓ ▶ Reverse engineering (user) Vhost and subdomain fuzzing IIS and ASP.NET Malicious file upload Mass assignment SSRF Password spraying and valid users Reverse engineering DLL hijacking Internal services and port forwarding
Blazorized hard windows ✓ ▶ Reverse engineering (foothold) JWT attacks SQL injection MSSQL abuse Reverse engineering ACL abuse (BloodHound) Kerberoasting Scheduled tasks and admin scripts DCSync
Breadcrumbs hard windows ✓ ▶ Reverse engineering (root) JWT attacks LFI / path traversal Malicious file upload AV and EDR evasion Cookie or session forging Credentials in the registry and history Credentials in files SQL injection Internal services and port forwarding Reverse engineering Weak or homemade cryptography
Hancliffe hard windows ✓ ▶ Reverse engineering (root) Directory brute forcing LFI / path traversal Server-Side Template Injection Public CVE exploitation Saved credentials / DPAPI Internal services and port forwarding Reverse engineering Stack buffer overflow Weak or homemade cryptography
Napper hard windows ✓ ▶ Reverse engineering (root) Vhost and subdomain fuzzing Credentials in files Internal services and port forwarding Remote execution (WinRM, PsExec, WMI) Reverse engineering Weak or homemade cryptography
Proper hard windows ✓ ▶ Reverse engineering (root) LFI / path traversal Remote file inclusion (RFI) SQL injection NTLM capture and relay Race condition Symlink abuse Reverse engineering
Sharp hard windows ✓ ▶ Reverse engineering (foothold) SMB/NFS enumeration Reverse engineering Weak or homemade cryptography Insecure deserialization Password spraying and valid users API enumeration
Coder insane windows ✓ ▶ Reverse engineering (foothold) SMB/NFS enumeration CI/CD and build abuse AV and EDR evasion Reverse engineering Weak or homemade cryptography Credentials in files ADCS (certificates)
Fighter insane windows ✓ ▶ Reverse engineering (root) Vhost and subdomain fuzzing SQL injection MSSQL abuse Scheduled tasks and admin scripts AppLocker and Constrained Language Mode Other token privileges SeImpersonate / Potatoes Reverse engineering
Infiltrator insane windows ✓ ▶ Reverse engineering (user) AS-REP roasting Password spraying and valid users API enumeration Domain LDAP/RPC enumeration ACL abuse (BloodHound) Shadow Credentials Internal services and port forwarding Reverse engineering ADCS (certificates) SAM/LSA/LSASS dumping Traffic analysis (pcap)
PivotAPI insane windows ✓ ▶ Reverse engineering (user) Metadata and OSINT SMB/NFS enumeration AS-REP roasting Hash cracking Internal services and port forwarding MSSQL abuse Reverse engineering ACL abuse (BloodHound) Kerberos delegation (RBCD) Reading LAPS passwords AV and EDR evasion