Access easy windows ✓ Credentials in files Hash cracking Backups and archives Saved credentials / DPAPI AppLocker and Constrained Language Mode
ServMon easy windows ✓ LFI / path traversal Public CVE exploitation Password spraying and valid users Credentials in files Internal services and port forwarding +1
Giddy medium windows ✓ Directory brute forcing SQL injection NTLM capture and relay Hash cracking Misconfigured services +2
Sniper medium windows ✓ LFI / path traversal Remote file inclusion (RFI) AppLocker and Constrained Language Mode Credentials in files Phishing and malicious documents +2
Acute hard windows ✓ Password spraying and valid users Remote execution (WinRM, PsExec, WMI) AV and EDR evasion Password reuse SAM/LSA/LSASS dumping +4
Breadcrumbs hard windows ✓ JWT attacks LFI / path traversal Malicious file upload AV and EDR evasion Cookie or session forging +6
Control hard windows ✓ Directory brute forcing Authentication bypass SQL injection AV and EDR evasion Credentials in the registry and history +2
Freelancer hard windows ✓ IDOR MSSQL abuse AV and EDR evasion Password spraying and valid users Credentials in files +5
Helpline hard windows ✓ Authentication bypass Default credentials Public CVE exploitation Saved credentials / DPAPI Credentials in files +3
RE hard windows ✓ SMB/NFS enumeration Phishing and malicious documents AV and EDR evasion Public CVE exploitation XXE +3
Reel hard windows ✓ Metadata and OSINT Phishing and malicious documents Public CVE exploitation Credentials in files AppLocker and Constrained Language Mode +1
Reel2 hard windows ✓ Phishing and malicious documents NTLM capture and relay Password spraying and valid users Hash cracking Credentials in the registry and history +3
Search hard windows ✓ Password spraying and valid users Credentials in files SMB/NFS enumeration Kerberoasting Hash cracking +3
Tally hard windows ✓ CMS exploitation Credentials in files Hash cracking SMB/NFS enumeration MSSQL abuse +4
APT insane windows ✓ SMB/NFS enumeration Pass-the-hash / ticket Password spraying and valid users SAM/LSA/LSASS dumping Backups and archives +4
Coder insane windows ✓ SMB/NFS enumeration CI/CD and build abuse AV and EDR evasion Reverse engineering Weak or homemade cryptography +2
Eloquia insane windows ✓ Authentication bypass Cross-Site Scripting (XSS) Malicious file upload Server-Side Template Injection NTLM capture and relay +3
Fighter insane windows ✓ Vhost and subdomain fuzzing SQL injection MSSQL abuse Scheduled tasks and admin scripts AppLocker and Constrained Language Mode +3
Ghost insane windows ✓ Vhost and subdomain fuzzing LDAP injection LFI / path traversal gMSA accounts NTLM capture and relay +5
HackBack insane windows ✓ Command injection Default credentials Internal services and port forwarding Remote execution (WinRM, PsExec, WMI) Other token privileges +3
Hathor insane windows ✓ Default credentials IIS and ASP.NET Malicious file upload AppLocker and Constrained Language Mode SMB/NFS enumeration +4
Mist insane windows ✓ LFI / path traversal Public CVE exploitation AV and EDR evasion Hash cracking Phishing and malicious documents +7
Multimaster insane windows ✓ API enumeration Domain LDAP/RPC enumeration SQL injection Remote execution (WinRM, PsExec, WMI) Hash cracking +6
PivotAPI insane windows ✓ Metadata and OSINT SMB/NFS enumeration AS-REP roasting Hash cracking Internal services and port forwarding +6
Sekhmet insane windows ✓ Vhost and subdomain fuzzing Default credentials Insecure deserialization Command injection Password spraying and valid users +6
Sizzle insane windows ✓ SMB/NFS enumeration NTLM capture and relay Remote execution (WinRM, PsExec, WMI) Hash cracking AppLocker and Constrained Language Mode +2