Academy easy linux ✓ Directory brute forcing Vhost and subdomain fuzzing Insecure deserialization Mass assignment Public CVE exploitation +5
Access easy windows ✓ Credentials in files Hash cracking Backups and archives Saved credentials / DPAPI AppLocker and Constrained Language Mode
Active easy windows ✓ SMB/NFS enumeration GPP and GPO abuse Domain LDAP/RPC enumeration Kerberoasting Remote execution (WinRM, PsExec, WMI) +1
Admirer easy linux ✓ Directory brute forcing Authentication bypass LFI / path traversal Credentials in files Library hijacking +1
Alert easy linux ✓ Cross-Site Scripting (XSS) LFI / path traversal Hash cracking Internal services and port forwarding
Armageddon easy linux ✓ CMS exploitation Public CVE exploitation Credentials in files Hash cracking Sudo abuse
Artificial easy linux ✓ Insecure deserialization Malicious file upload Hash cracking Command injection Internal services and port forwarding +1
Bank easy linux ✓ Directory brute forcing Vhost and subdomain fuzzing Authentication bypass Malicious file upload Credentials in files +2
Bastion easy windows ✓ SMB/NFS enumeration SAM/LSA/LSASS dumping Hash cracking Backups and archives Saved credentials / DPAPI
Bizness easy linux ✓ Directory brute forcing Authentication bypass Insecure deserialization Public CVE exploitation Hash cracking
Blocky easy linux ✓ Directory brute forcing CMS exploitation Credentials in files Reverse engineering Password reuse +2
Boardlight easy linux ✓ Vhost and subdomain fuzzing Default credentials Public CVE exploitation Credentials in files Password reuse +1
Bounty easy windows ✓ Directory brute forcing IIS and ASP.NET Malicious file upload SeImpersonate / Potatoes Windows exploits
BountyHunter easy linux ✓ Directory brute forcing LFI / path traversal XXE Credentials in files Password reuse +1
Buff easy windows ✓ Public CVE exploitation Internal services and port forwarding Stack buffer overflow
Busqueda easy linux ✓ Server-Side Template Injection Exposed .git repository Vhost and subdomain fuzzing Credentials in files Container escape +2
Chemistry easy linux ✓ Public CVE exploitation Credentials in files Hash cracking LFI / path traversal Internal services and port forwarding
Cicada easy windows ✓ Domain LDAP/RPC enumeration SMB/NFS enumeration Password spraying and valid users Credentials in files Remote execution (WinRM, PsExec, WMI) +2
CodePartTwo easy linux ✓ Public CVE exploitation Credentials in files Sudo abuse Backups and archives
Codify easy linux ✓ Public CVE exploitation Hash cracking Authentication bypass Cron jobs and processes Sudo abuse
Conversor easy linux ✓ LFI / path traversal Cron jobs and processes Public CVE exploitation Sudo abuse
CozyHosting easy linux ✓ Directory brute forcing Authentication bypass Command injection Credentials in files Reverse engineering +2
Crafty easy windows ✓ Public CVE exploitation Credentials in files Remote execution (WinRM, PsExec, WMI) Reverse engineering
Devvortex easy linux ✓ Vhost and subdomain fuzzing CMS exploitation Mass assignment Public CVE exploitation Hash cracking +1
Doctor easy linux ✓ Command injection Server-Side Template Injection Privileged groups Log analysis Public CVE exploitation
Dog easy linux ✓ Exposed .git repository CMS exploitation Credentials in files Password reuse Sudo abuse
Driver easy windows ✓ Default credentials NTLM capture and relay Remote execution (WinRM, PsExec, WMI) Hash cracking Public CVE exploitation +1
Eighteen easy windows ✓ Domain LDAP/RPC enumeration Password spraying and valid users MSSQL abuse Remote execution (WinRM, PsExec, WMI) Hash cracking +3
EscapeTwo easy windows ✓ Credentials in files MSSQL abuse Password spraying and valid users ACL abuse (BloodHound) ADCS (certificates) +1
Fluffy easy windows ✓ Kerberoasting NTLM capture and relay Hash cracking ACL abuse (BloodHound) Shadow Credentials +1
Forest easy windows ✓ Domain LDAP/RPC enumeration AS-REP roasting Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Hash cracking +4
Frolic easy linux ✓ Directory brute forcing Malicious file upload Public CVE exploitation Hash cracking SUID binaries +2
Haystack easy linux ✓ API enumeration Credentials in files Public CVE exploitation Internal services and port forwarding Log analysis
Heist easy windows ✓ Domain LDAP/RPC enumeration Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Hash cracking Memory dumps
Help easy linux ✓ Directory brute forcing GraphQL Malicious file upload Public CVE exploitation SQL injection +1
Inject easy linux ✓ Directory brute forcing LFI / path traversal Public CVE exploitation Credentials in files Cron jobs and processes
Keeper easy linux ✓ Default credentials Credentials in files Public CVE exploitation SSH keys Memory dumps
Kobold easy linux ✓ Vhost and subdomain fuzzing Public CVE exploitation SSH keys Container escape Privileged groups +1
LaCasaDePapel easy linux ✓ LFI / path traversal Public CVE exploitation Weak or homemade cryptography SSH keys Cron jobs and processes
LinkVortex easy linux ✓ Exposed .git repository Vhost and subdomain fuzzing Public CVE exploitation LFI / path traversal Command injection +3
Mailing easy windows ✓ LFI / path traversal Credentials in files Phishing and malicious documents NTLM capture and relay Remote execution (WinRM, PsExec, WMI) +1
MonitorsFour easy windows ✓ Vhost and subdomain fuzzing Authentication bypass Public CVE exploitation Hash cracking Container escape +1
MonitorsTwo easy linux ✓ Public CVE exploitation Hash cracking Container escape Linux capabilities SUID binaries
Nest easy windows ✓ SMB/NFS enumeration Password spraying and valid users Credentials in files Reverse engineering Remote execution (WinRM, PsExec, WMI)
Netmon easy windows ✓ Command injection Public CVE exploitation Credentials in files Backups and archives
Networked easy linux ✓ Directory brute forcing Malicious file upload Backups and archives Command injection Cron jobs and processes +1
Nibbles easy linux ✓ Directory brute forcing CMS exploitation Malicious file upload Public CVE exploitation Sudo abuse
Nocturnal easy linux ✓ Directory brute forcing Command injection IDOR Hash cracking Public CVE exploitation +1
OpenAdmin easy linux ✓ Directory brute forcing Public CVE exploitation SSH keys Credentials in files Internal services and port forwarding +3
OpenSource easy linux ✓ Exposed .git repository LFI / path traversal Container escape SSH keys Internal services and port forwarding +2
Pandora easy linux ✓ SNMP enumeration Malicious file upload Public CVE exploitation SQL injection Internal services and port forwarding +2
PC easy linux ✓ API enumeration SQL injection Public CVE exploitation Internal services and port forwarding
PermX easy linux ✓ Vhost and subdomain fuzzing Public CVE exploitation Credentials in files Password reuse Sudo abuse +1
Planning easy linux ✓ Vhost and subdomain fuzzing Public CVE exploitation Credentials in files Cron jobs and processes Internal services and port forwarding
Precious easy linux ✓ Metadata and OSINT Command injection Public CVE exploitation Credentials in files Insecure deserialization +1
Previse easy linux ✓ Directory brute forcing Authentication bypass Command injection Credentials in files Hash cracking +2
RedPanda easy linux ✓ Server-Side Template Injection Metadata and OSINT XXE Cron jobs and processes Reverse engineering +1
Remote easy windows ✓ SMB/NFS enumeration CMS exploitation Public CVE exploitation Credentials in files Misconfigured services +1
Sauna easy windows ✓ AS-REP roasting Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Hash cracking Credentials in the registry and history +3
Sea easy linux ✓ Directory brute forcing CMS exploitation Cross-Site Scripting (XSS) Public CVE exploitation Hash cracking +2
ServMon easy windows ✓ LFI / path traversal Public CVE exploitation Password spraying and valid users Credentials in files Internal services and port forwarding +1
Shoppy easy linux ✓ Authentication bypass NoSQL injection Vhost and subdomain fuzzing Reverse engineering Hash cracking +1
Silentium easy linux ✓ Vhost and subdomain fuzzing Authentication bypass Public CVE exploitation Credentials in files SSH keys +1
Soccer easy linux ✓ Directory brute forcing Default credentials Malicious file upload Vhost and subdomain fuzzing SQL injection +1
Support easy windows ✓ SMB/NFS enumeration Reverse engineering Traffic analysis (pcap) Domain LDAP/RPC enumeration ACL abuse (BloodHound) +2
Swagshop easy linux ✓ CMS exploitation Insecure deserialization Public CVE exploitation SQL injection Sudo abuse
Tabby easy linux ✓ Vhost and subdomain fuzzing LFI / path traversal Malicious file upload Password reuse Hash cracking +3
Teacher easy linux ✓ Metadata and OSINT Public CVE exploitation Hash cracking Cron jobs and processes
Timelapse easy windows ✓ SMB/NFS enumeration Remote execution (WinRM, PsExec, WMI) Hash cracking Backups and archives Credentials in the registry and history +1
Titanic easy linux ✓ Vhost and subdomain fuzzing LFI / path traversal Hash cracking Public CVE exploitation Cron jobs and processes
Topology easy linux ✓ Vhost and subdomain fuzzing LFI / path traversal Hash cracking Cron jobs and processes
Traceback easy linux ✓ Directory brute forcing Default credentials SSH keys Sudo abuse Cron jobs and processes
TwoMillion easy linux ✓ API enumeration Command injection Mass assignment Credentials in files Password reuse +1
Writeup easy linux ✓ CMS exploitation Public CVE exploitation SQL injection Hash cracking Cron jobs and processes +2
Administrator medium windows ✓ ACL abuse (BloodHound) Password spraying and valid users Hash cracking DCSync Kerberoasting
Agile medium linux ✓ LFI / path traversal IDOR Credentials in files Internal services and port forwarding Public CVE exploitation +1
AI medium linux ✓ Directory brute forcing SQL injection Command injection Internal services and port forwarding
AirTouch medium linux ✓ SNMP enumeration Wi-Fi attacks Authentication bypass Malicious file upload Hash cracking +3
Ambassador medium linux ✓ LFI / path traversal Public CVE exploitation Credentials in files API enumeration Internal services and port forwarding +1
Arkham medium windows ✓ SMB/NFS enumeration Insecure deserialization Hash cracking Credentials in files Remote execution (WinRM, PsExec, WMI) +3
Atom medium windows ✓ SMB/NFS enumeration Public CVE exploitation Reverse engineering Credentials in files Weak or homemade cryptography +2
Authority medium windows ✓ SMB/NFS enumeration Credentials in files Hash cracking ADCS (certificates) Kerberos delegation (RBCD)
Awkward medium linux ✓ API enumeration Vhost and subdomain fuzzing Authentication bypass JWT attacks LFI / path traversal +6
Backfire medium linux ✓ Public CVE exploitation SSRF Authentication bypass JWT attacks Internal services and port forwarding +2
Bart medium windows ✓ Vhost and subdomain fuzzing LFI / path traversal Log analysis Credentials in the registry and history Hash cracking
Bitlab medium linux ✓ Directory brute forcing Malicious file upload Credentials in files Git history Reverse engineering +1
Blurry medium linux ✓ Vhost and subdomain fuzzing Insecure deserialization Public CVE exploitation SSH keys Sudo abuse
Bolt medium linux ✓ Vhost and subdomain fuzzing Server-Side Template Injection Container escape Hash cracking Git history +3
Book medium linux ✓ Authentication bypass Cross-Site Scripting (XSS) LFI / path traversal SSH keys Public CVE exploitation +1
BroScience medium linux ✓ Insecure deserialization LFI / path traversal Weak or homemade cryptography Credentials in files Hash cracking +2
Bucket medium linux ✓ Vhost and subdomain fuzzing Malicious file upload Credentials in files Password reuse LFI / path traversal +2
Cache medium linux ✓ Vhost and subdomain fuzzing Malicious file upload Public CVE exploitation SQL injection Credentials in files +3
Canape medium linux ✓ Directory brute forcing Exposed .git repository Insecure deserialization Git history Public CVE exploitation +2
Cascade medium windows ✓ Domain LDAP/RPC enumeration SMB/NFS enumeration Credentials in the registry and history Remote execution (WinRM, PsExec, WMI) Weak or homemade cryptography +3
Cat medium linux ✓ Exposed .git repository Cross-Site Scripting (XSS) SQL injection Privileged groups Hash cracking +4
Certified medium windows ✓ ACL abuse (BloodHound) Shadow Credentials ADCS (certificates) Remote execution (WinRM, PsExec, WMI)
Chaos medium linux ✓ Directory brute forcing CMS exploitation Command injection Credentials in files Weak or homemade cryptography +1
Chatterbox medium windows ✓ Public CVE exploitation Stack buffer overflow Credentials in the registry and history Password reuse
Checkpoint medium windows ✓ ACL abuse (BloodHound) Deleted AD objects Password reuse Phishing and malicious documents BadSuccessor (dMSA) +2
DevArea medium linux ✓ LFI / path traversal Public CVE exploitation Reverse engineering Command injection Cron jobs and processes +3
DevHub medium linux ✓ Public CVE exploitation SSH keys Internal services and port forwarding API enumeration Credentials in files
Enterprise medium linux ✓ CMS exploitation Public CVE exploitation SQL injection Container escape Reverse engineering +1
Environment medium linux ✓ Directory brute forcing Authentication bypass Malicious file upload Public CVE exploitation Credentials in files +1
Era medium linux ✓ Directory brute forcing Vhost and subdomain fuzzing Authentication bypass IDOR Backups and archives +2
Escape medium windows ✓ SMB/NFS enumeration NTLM capture and relay Credentials in files MSSQL abuse Hash cracking +4
Europa medium linux ✓ Vhost and subdomain fuzzing Authentication bypass Command injection SQL injection Cron jobs and processes
Format medium linux ✓ LFI / path traversal Malicious file upload SSRF Credentials in files Sudo abuse +1
Fuse medium windows ✓ Password spraying and valid users Domain LDAP/RPC enumeration Remote execution (WinRM, PsExec, WMI) Other token privileges
Giddy medium windows ✓ Directory brute forcing SQL injection NTLM capture and relay Hash cracking Misconfigured services +2
Hacknet medium linux ✓ Server-Side Template Injection Insecure deserialization Password reuse Hash cracking Backups and archives
Hawk medium linux ✓ CMS exploitation Weak or homemade cryptography Credentials in files Public CVE exploitation Internal services and port forwarding
Health medium linux ✓ Public CVE exploitation SQL injection SSRF Hash cracking LFI / path traversal +1
Hospital medium windows ✓ Malicious file upload Phishing and malicious documents Public CVE exploitation Kernel or system exploit Hash cracking
iClean medium linux ✓ Cross-Site Scripting (XSS) Server-Side Template Injection Credentials in files Hash cracking Sudo abuse
Imagery medium linux ✓ Command injection Cross-Site Scripting (XSS) LFI / path traversal Hash cracking Backups and archives
Inception medium linux ✓ LFI / path traversal Malicious file upload Credentials in files Sudo abuse Internal services and port forwarding +1
Instant medium linux ✓ API enumeration LFI / path traversal Credentials in files Reverse engineering SSH keys +2
Intelligence medium windows ✓ Metadata and OSINT SMB/NFS enumeration Password spraying and valid users NTLM capture and relay Hash cracking +2
Interface medium linux ✓ API enumeration Metadata and OSINT Public CVE exploitation Command injection Cron jobs and processes
Investigation medium linux ✓ Directory brute forcing Malicious file upload Public CVE exploitation Log analysis Sudo abuse +2
Jab medium windows ✓ AS-REP roasting Password spraying and valid users Hash cracking ACL abuse (BloodHound) Remote execution (WinRM, PsExec, WMI) +2
Jarvis medium linux ✓ Directory brute forcing LFI / path traversal Public CVE exploitation SQL injection Hash cracking +3
Jeeves medium windows ✓ CI/CD and build abuse SeImpersonate / Potatoes Pass-the-hash / ticket Hash cracking
JSON medium windows ✓ Default credentials Insecure deserialization SeImpersonate / Potatoes Internal services and port forwarding Reverse engineering
LightWeight medium linux ✓ Directory brute forcing Linux capabilities Hash cracking Backups and archives Traffic analysis (pcap) +1
Logging medium windows ✓ SMB/NFS enumeration Log analysis DLL hijacking Scheduled tasks and admin scripts ACL abuse (BloodHound) +4
Manager medium windows ✓ Domain LDAP/RPC enumeration Password spraying and valid users MSSQL abuse Backups and archives Credentials in files +1
Mentor medium linux ✓ API enumeration SNMP enumeration Vhost and subdomain fuzzing Command injection Container escape +3
Meta medium linux ✓ Metadata and OSINT Vhost and subdomain fuzzing Malicious file upload Public CVE exploitation Cron jobs and processes +1
Monteverde medium windows ✓ Domain LDAP/RPC enumeration Password spraying and valid users SMB/NFS enumeration Credentials in files Remote execution (WinRM, PsExec, WMI) +2
Nineveh medium linux ✓ Directory brute forcing LFI / path traversal Public CVE exploitation Steganography Cron jobs and processes
Noter medium linux ✓ Authentication bypass Command injection Public CVE exploitation Credentials in files Cookie or session forging
Obscurity medium linux ✓ Directory brute forcing Command injection LFI / path traversal Weak or homemade cryptography Sudo abuse +2
October medium linux ✓ CMS exploitation Default credentials Malicious file upload SUID binaries ROP / ret2libc +1
Olympus medium linux ✓ Public CVE exploitation Container escape Wi-Fi attacks Traffic analysis (pcap) Privileged groups
Outdated medium windows ✓ Phishing and malicious documents Public CVE exploitation ACL abuse (BloodHound) Shadow Credentials WSUS abuse
Overwatch medium windows ✓ SMB/NFS enumeration MSSQL abuse Reverse engineering NTLM capture and relay API enumeration
POV medium windows ✓ Vhost and subdomain fuzzing IIS and ASP.NET Insecure deserialization LFI / path traversal Credentials in files +2
Pterodactyl medium linux ✓ Vhost and subdomain fuzzing Public CVE exploitation Hash cracking Kernel or system exploit
Puppy medium windows ✓ SMB/NFS enumeration ACL abuse (BloodHound) Password spraying and valid users Hash cracking Credentials in files +3
Querier medium windows ✓ SMB/NFS enumeration Credentials in files MSSQL abuse NTLM capture and relay Hash cracking +2
Ready medium linux ✓ Public CVE exploitation SSRF Container escape Password reuse Backups and archives
Resolute medium windows ✓ Domain LDAP/RPC enumeration Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Credentials in the registry and history Privileged Windows groups
Retired medium linux ✓ Directory brute forcing LFI / path traversal Reverse engineering ROP / ret2libc Stack buffer overflow +4
Sandworm medium linux ✓ Server-Side Template Injection Cron jobs and processes Library hijacking Credentials in files Public CVE exploitation
Scrambled medium windows ✓ Kerberoasting Password spraying and valid users Hash cracking Pass-the-hash / ticket Credentials in files +3
SecNotes medium windows ✓ SMB/NFS enumeration CSRF Malicious file upload SQL injection Credentials in the registry and history
Shared medium linux ✓ Vhost and subdomain fuzzing SQL injection Public CVE exploitation Cron jobs and processes Hash cracking +2
Shibboleth medium linux ✓ Vhost and subdomain fuzzing Hash cracking Password reuse Public CVE exploitation
Signed medium windows ✓ Domain LDAP/RPC enumeration NTLM capture and relay MSSQL abuse Hash cracking Pass-the-hash / ticket +2
SmartHire medium linux ✓ Vhost and subdomain fuzzing Insecure deserialization Library hijacking Sudo abuse
SneakyMailer medium linux ✓ Directory brute forcing Vhost and subdomain fuzzing Cross-Site Scripting (XSS) Malicious file upload Hash cracking +1
Sniper medium windows ✓ LFI / path traversal Remote file inclusion (RFI) AppLocker and Constrained Language Mode Credentials in files Phishing and malicious documents +2
Socket medium linux ✓ SQL injection Reverse engineering Traffic analysis (pcap) Password reuse Sudo abuse
SolarLab medium windows ✓ SMB/NFS enumeration Public CVE exploitation Password spraying and valid users Credentials in files Password reuse +4
StreamIO medium windows ✓ LFI / path traversal SQL injection NTLM capture and relay Password spraying and valid users Hash cracking +4
Surveillance medium linux ✓ CMS exploitation Public CVE exploitation Internal services and port forwarding Hash cracking Backups and archives +3
Tartarsauce medium linux ✓ CMS exploitation Public CVE exploitation Remote file inclusion (RFI) Sudo abuse Cron jobs and processes +2
TheFrizz medium windows ✓ Malicious file upload Public CVE exploitation Password spraying and valid users Credentials in files Hash cracking +1
TheNotebook medium linux ✓ JWT attacks Malicious file upload SSH keys Backups and archives Public CVE exploitation +2
Tombwatcher medium windows ✓ ACL abuse (BloodHound) Kerberoasting gMSA accounts Shadow Credentials ADCS (certificates) +1
Trickster medium linux ✓ Directory brute forcing Exposed .git repository Vhost and subdomain fuzzing Cross-Site Scripting (XSS) CSRF +8
Undetected medium linux ✓ Directory brute forcing Vhost and subdomain fuzzing Public CVE exploitation Hash cracking Reverse engineering
VariaType medium linux ✓ Exposed .git repository LFI / path traversal Malicious file upload Public CVE exploitation Metadata and OSINT +2
Vault medium linux ✓ Directory brute forcing Malicious file upload Command injection Credentials in files Internal services and port forwarding +1
Voleur medium windows ✓ Credentials in files Hash cracking Saved credentials / DPAPI ACL abuse (BloodHound) Deleted AD objects +3
Wall medium linux ✓ API enumeration Directory brute forcing Authentication bypass Command injection Credentials in files +3
WifineticTwo medium linux ✓ Default credentials Malicious file upload Wi-Fi attacks Internal services and port forwarding
Worker medium windows ✓ Vhost and subdomain fuzzing CI/CD and build abuse Git history Password spraying and valid users Remote execution (WinRM, PsExec, WMI) +2
Zipping medium linux ✓ LFI / path traversal Malicious file upload SQL injection Library hijacking Sudo abuse
Acute hard windows ✓ Password spraying and valid users Remote execution (WinRM, PsExec, WMI) AV and EDR evasion Password reuse SAM/LSA/LSASS dumping +4
Analysis hard windows ✓ Directory brute forcing Vhost and subdomain fuzzing LDAP injection Malicious file upload Credentials in the registry and history +2
AppSanity hard windows ✓ Vhost and subdomain fuzzing IIS and ASP.NET Malicious file upload Mass assignment SSRF +4
Axlle hard windows ✓ Phishing and malicious documents Credentials in the registry and history ACL abuse (BloodHound) Scheduled tasks and admin scripts
Blackfield hard windows ✓ SMB/NFS enumeration AS-REP roasting Password spraying and valid users ACL abuse (BloodHound) Remote execution (WinRM, PsExec, WMI) +3
Blazorized hard windows ✓ JWT attacks SQL injection MSSQL abuse Reverse engineering ACL abuse (BloodHound) +3
Breadcrumbs hard windows ✓ JWT attacks LFI / path traversal Malicious file upload AV and EDR evasion Cookie or session forging +6
Cerberus hard windows ✓ LFI / path traversal Public CVE exploitation SUID binaries Credentials in files Internal services and port forwarding +1
Cereal hard windows ✓ Exposed .git repository Cross-Site Scripting (XSS) Insecure deserialization JWT attacks Git history +4
Certificate hard windows ✓ Malicious file upload Hash cracking Traffic analysis (pcap) Other token privileges ADCS (certificates)
Conceal hard windows ✓ SNMP enumeration IIS and ASP.NET Malicious file upload Hash cracking SeImpersonate / Potatoes +1
Control hard windows ✓ Directory brute forcing Authentication bypass SQL injection AV and EDR evasion Credentials in the registry and history +2
DarkZero hard windows ✓ MSSQL abuse Windows exploits Domain and forest trusts Kerberos delegation (RBCD) NTLM capture and relay
Freelancer hard windows ✓ IDOR MSSQL abuse AV and EDR evasion Password spraying and valid users Credentials in files +5
Fries hard windows ✓ Vhost and subdomain fuzzing Public CVE exploitation SMB/NFS enumeration Container escape Internal services and port forwarding +2
Hancliffe hard windows ✓ Directory brute forcing LFI / path traversal Server-Side Template Injection Public CVE exploitation Saved credentials / DPAPI +4
Haze hard windows ✓ Domain LDAP/RPC enumeration LFI / path traversal Public CVE exploitation Password spraying and valid users Credentials in files +5
Helpline hard windows ✓ Authentication bypass Default credentials Public CVE exploitation Saved credentials / DPAPI Credentials in files +3
Mirage hard windows ✓ SMB/NFS enumeration Traffic analysis (pcap) Kerberoasting NTLM capture and relay Hash cracking +4
Nanocorp hard windows ✓ NTLM capture and relay Hash cracking ACL abuse (BloodHound) Remote execution (WinRM, PsExec, WMI) Public CVE exploitation
Napper hard windows ✓ Vhost and subdomain fuzzing Credentials in files Internal services and port forwarding Remote execution (WinRM, PsExec, WMI) Reverse engineering +1
Office hard windows ✓ CMS exploitation Public CVE exploitation Password spraying and valid users Hash cracking Traffic analysis (pcap) +4
Pirate hard windows ✓ Domain LDAP/RPC enumeration Default credentials gMSA accounts Internal services and port forwarding Remote execution (WinRM, PsExec, WMI) +3
Proper hard windows ✓ LFI / path traversal Remote file inclusion (RFI) SQL injection NTLM capture and relay Race condition +2
RE hard windows ✓ SMB/NFS enumeration Phishing and malicious documents AV and EDR evasion Public CVE exploitation XXE +3
Reel hard windows ✓ Metadata and OSINT Phishing and malicious documents Public CVE exploitation Credentials in files AppLocker and Constrained Language Mode +1
Reel2 hard windows ✓ Phishing and malicious documents NTLM capture and relay Password spraying and valid users Hash cracking Credentials in the registry and history +3
RustyKey hard windows ✓ Hash cracking DLL hijacking ACL abuse (BloodHound) Remote execution (WinRM, PsExec, WMI) Kerberos delegation (RBCD)
Scepter hard windows ✓ SMB/NFS enumeration Hash cracking ACL abuse (BloodHound) ADCS (certificates) Remote execution (WinRM, PsExec, WMI) +1
Search hard windows ✓ Password spraying and valid users Credentials in files SMB/NFS enumeration Kerberoasting Hash cracking +3
Sharp hard windows ✓ SMB/NFS enumeration Reverse engineering Weak or homemade cryptography Insecure deserialization Password spraying and valid users +1
Tally hard windows ✓ CMS exploitation Credentials in files Hash cracking SMB/NFS enumeration MSSQL abuse +4
Vintage hard windows ✓ Default credentials gMSA accounts Saved credentials / DPAPI ACL abuse (BloodHound) Kerberoasting +4
Absolute insane windows ✓ Domain LDAP/RPC enumeration Metadata and OSINT AS-REP roasting Password spraying and valid users SMB/NFS enumeration +5
Anubis insane windows ✓ Vhost and subdomain fuzzing Server-Side Template Injection Cross-Site Scripting (XSS) NTLM capture and relay Internal services and port forwarding +2
APT insane windows ✓ SMB/NFS enumeration Pass-the-hash / ticket Password spraying and valid users SAM/LSA/LSASS dumping Backups and archives +4
BankRobber insane windows ✓ Command injection Cross-Site Scripting (XSS) SQL injection Internal services and port forwarding Stack buffer overflow
Bighead insane windows ✓ Vhost and subdomain fuzzing Stack buffer overflow Credentials in the registry and history Internal services and port forwarding LFI / path traversal +1
Coder insane windows ✓ SMB/NFS enumeration CI/CD and build abuse AV and EDR evasion Reverse engineering Weak or homemade cryptography +2
DarkCorp insane windows ✓ Cross-Site Scripting (XSS) CSRF SQL injection SSRF Saved credentials / DPAPI +10
Eloquia insane windows ✓ Authentication bypass Cross-Site Scripting (XSS) Malicious file upload Server-Side Template Injection NTLM capture and relay +3
Fighter insane windows ✓ Vhost and subdomain fuzzing SQL injection MSSQL abuse Scheduled tasks and admin scripts AppLocker and Constrained Language Mode +3
Ghost insane windows ✓ Vhost and subdomain fuzzing LDAP injection LFI / path traversal gMSA accounts NTLM capture and relay +5
HackBack insane windows ✓ Command injection Default credentials Internal services and port forwarding Remote execution (WinRM, PsExec, WMI) Other token privileges +3
Hathor insane windows ✓ Default credentials IIS and ASP.NET Malicious file upload AppLocker and Constrained Language Mode SMB/NFS enumeration +4
Infiltrator insane windows ✓ AS-REP roasting Password spraying and valid users API enumeration Domain LDAP/RPC enumeration ACL abuse (BloodHound) +6
Mist insane windows ✓ LFI / path traversal Public CVE exploitation AV and EDR evasion Hash cracking Phishing and malicious documents +7
Multimaster insane windows ✓ API enumeration Domain LDAP/RPC enumeration SQL injection Remote execution (WinRM, PsExec, WMI) Hash cracking +6
Perspective insane windows ✓ IDOR IIS and ASP.NET Insecure deserialization Malicious file upload SSRF +5
PivotAPI insane windows ✓ Metadata and OSINT SMB/NFS enumeration AS-REP roasting Hash cracking Internal services and port forwarding +6
Rabbit insane windows ✓ CMS exploitation SQL injection Phishing and malicious documents Scheduled tasks and admin scripts
Rebound insane windows ✓ Domain LDAP/RPC enumeration Kerberoasting Password spraying and valid users ACL abuse (BloodHound) NTLM capture and relay +4
Sekhmet insane windows ✓ Vhost and subdomain fuzzing Default credentials Insecure deserialization Command injection Password spraying and valid users +6
Sizzle insane windows ✓ SMB/NFS enumeration NTLM capture and relay Remote execution (WinRM, PsExec, WMI) Hash cracking AppLocker and Constrained Language Mode +2
University insane windows ✓ Public CVE exploitation Phishing and malicious documents Credentials in files Internal services and port forwarding gMSA accounts +2