Academy easy linux ✓ Directory brute forcing Vhost and subdomain fuzzing Insecure deserialization Mass assignment Public CVE exploitation +5
Admirer easy linux ✓ Directory brute forcing Authentication bypass LFI / path traversal Credentials in files Library hijacking +1
Armageddon easy linux ✓ CMS exploitation Public CVE exploitation Credentials in files Hash cracking Sudo abuse
Bank easy linux ✓ Directory brute forcing Vhost and subdomain fuzzing Authentication bypass Malicious file upload Credentials in files +2
Blocky easy linux ✓ Directory brute forcing CMS exploitation Credentials in files Reverse engineering Password reuse +2
Boardlight easy linux ✓ Vhost and subdomain fuzzing Default credentials Public CVE exploitation Credentials in files Password reuse +1
BountyHunter easy linux ✓ Directory brute forcing LFI / path traversal XXE Credentials in files Password reuse +1
Busqueda easy linux ✓ Server-Side Template Injection Exposed .git repository Vhost and subdomain fuzzing Credentials in files Container escape +2
CodePartTwo easy linux ✓ Public CVE exploitation Credentials in files Sudo abuse Backups and archives
Codify easy linux ✓ Public CVE exploitation Hash cracking Authentication bypass Cron jobs and processes Sudo abuse
Conversor easy linux ✓ LFI / path traversal Cron jobs and processes Public CVE exploitation Sudo abuse
CozyHosting easy linux ✓ Directory brute forcing Authentication bypass Command injection Credentials in files Reverse engineering +2
Devvortex easy linux ✓ Vhost and subdomain fuzzing CMS exploitation Mass assignment Public CVE exploitation Hash cracking +1
Doctor easy linux ✓ Command injection Server-Side Template Injection Privileged groups Log analysis Public CVE exploitation
Dog easy linux ✓ Exposed .git repository CMS exploitation Credentials in files Password reuse Sudo abuse
Frolic easy linux ✓ Directory brute forcing Malicious file upload Public CVE exploitation Hash cracking SUID binaries +2
Help easy linux ✓ Directory brute forcing GraphQL Malicious file upload Public CVE exploitation SQL injection +1
Inject easy linux ✓ Directory brute forcing LFI / path traversal Public CVE exploitation Credentials in files Cron jobs and processes
Keeper easy linux ✓ Default credentials Credentials in files Public CVE exploitation SSH keys Memory dumps
Kobold easy linux ✓ Vhost and subdomain fuzzing Public CVE exploitation SSH keys Container escape Privileged groups +1
LaCasaDePapel easy linux ✓ LFI / path traversal Public CVE exploitation Weak or homemade cryptography SSH keys Cron jobs and processes
LinkVortex easy linux ✓ Exposed .git repository Vhost and subdomain fuzzing Public CVE exploitation LFI / path traversal Command injection +3
MonitorsFour easy windows ✓ Vhost and subdomain fuzzing Authentication bypass Public CVE exploitation Hash cracking Container escape +1
MonitorsTwo easy linux ✓ Public CVE exploitation Hash cracking Container escape Linux capabilities SUID binaries
Networked easy linux ✓ Directory brute forcing Malicious file upload Backups and archives Command injection Cron jobs and processes +1
Nibbles easy linux ✓ Directory brute forcing CMS exploitation Malicious file upload Public CVE exploitation Sudo abuse
OpenAdmin easy linux ✓ Directory brute forcing Public CVE exploitation SSH keys Credentials in files Internal services and port forwarding +3
OpenSource easy linux ✓ Exposed .git repository LFI / path traversal Container escape SSH keys Internal services and port forwarding +2
Pandora easy linux ✓ SNMP enumeration Malicious file upload Public CVE exploitation SQL injection Internal services and port forwarding +2
PermX easy linux ✓ Vhost and subdomain fuzzing Public CVE exploitation Credentials in files Password reuse Sudo abuse +1
Planning easy linux ✓ Vhost and subdomain fuzzing Public CVE exploitation Credentials in files Cron jobs and processes Internal services and port forwarding
Precious easy linux ✓ Metadata and OSINT Command injection Public CVE exploitation Credentials in files Insecure deserialization +1
Previse easy linux ✓ Directory brute forcing Authentication bypass Command injection Credentials in files Hash cracking +2
RedPanda easy linux ✓ Server-Side Template Injection Metadata and OSINT XXE Cron jobs and processes Reverse engineering +1
Shoppy easy linux ✓ Authentication bypass NoSQL injection Vhost and subdomain fuzzing Reverse engineering Hash cracking +1
Silentium easy linux ✓ Vhost and subdomain fuzzing Authentication bypass Public CVE exploitation Credentials in files SSH keys +1
Soccer easy linux ✓ Directory brute forcing Default credentials Malicious file upload Vhost and subdomain fuzzing SQL injection +1
Swagshop easy linux ✓ CMS exploitation Insecure deserialization Public CVE exploitation SQL injection Sudo abuse
Tabby easy linux ✓ Vhost and subdomain fuzzing LFI / path traversal Malicious file upload Password reuse Hash cracking +3
Teacher easy linux ✓ Metadata and OSINT Public CVE exploitation Hash cracking Cron jobs and processes
Titanic easy linux ✓ Vhost and subdomain fuzzing LFI / path traversal Hash cracking Public CVE exploitation Cron jobs and processes
Topology easy linux ✓ Vhost and subdomain fuzzing LFI / path traversal Hash cracking Cron jobs and processes
Traceback easy linux ✓ Directory brute forcing Default credentials SSH keys Sudo abuse Cron jobs and processes
TwoMillion easy linux ✓ API enumeration Command injection Mass assignment Credentials in files Password reuse +1
Writeup easy linux ✓ CMS exploitation Public CVE exploitation SQL injection Hash cracking Cron jobs and processes +2
Agile medium linux ✓ LFI / path traversal IDOR Credentials in files Internal services and port forwarding Public CVE exploitation +1
AirTouch medium linux ✓ SNMP enumeration Wi-Fi attacks Authentication bypass Malicious file upload Hash cracking +3
Awkward medium linux ✓ API enumeration Vhost and subdomain fuzzing Authentication bypass JWT attacks LFI / path traversal +6
Backfire medium linux ✓ Public CVE exploitation SSRF Authentication bypass JWT attacks Internal services and port forwarding +2
Bitlab medium linux ✓ Directory brute forcing Malicious file upload Credentials in files Git history Reverse engineering +1
Blurry medium linux ✓ Vhost and subdomain fuzzing Insecure deserialization Public CVE exploitation SSH keys Sudo abuse
Bolt medium linux ✓ Vhost and subdomain fuzzing Server-Side Template Injection Container escape Hash cracking Git history +3
Book medium linux ✓ Authentication bypass Cross-Site Scripting (XSS) LFI / path traversal SSH keys Public CVE exploitation +1
BroScience medium linux ✓ Insecure deserialization LFI / path traversal Weak or homemade cryptography Credentials in files Hash cracking +2
Bucket medium linux ✓ Vhost and subdomain fuzzing Malicious file upload Credentials in files Password reuse LFI / path traversal +2
Cache medium linux ✓ Vhost and subdomain fuzzing Malicious file upload Public CVE exploitation SQL injection Credentials in files +3
Canape medium linux ✓ Directory brute forcing Exposed .git repository Insecure deserialization Git history Public CVE exploitation +2
Cat medium linux ✓ Exposed .git repository Cross-Site Scripting (XSS) SQL injection Privileged groups Hash cracking +4
DevArea medium linux ✓ LFI / path traversal Public CVE exploitation Reverse engineering Command injection Cron jobs and processes +3
DevHub medium linux ✓ Public CVE exploitation SSH keys Internal services and port forwarding API enumeration Credentials in files
Enterprise medium linux ✓ CMS exploitation Public CVE exploitation SQL injection Container escape Reverse engineering +1
Environment medium linux ✓ Directory brute forcing Authentication bypass Malicious file upload Public CVE exploitation Credentials in files +1
Era medium linux ✓ Directory brute forcing Vhost and subdomain fuzzing Authentication bypass IDOR Backups and archives +2
Europa medium linux ✓ Vhost and subdomain fuzzing Authentication bypass Command injection SQL injection Cron jobs and processes
Format medium linux ✓ LFI / path traversal Malicious file upload SSRF Credentials in files Sudo abuse +1
Health medium linux ✓ Public CVE exploitation SQL injection SSRF Hash cracking LFI / path traversal +1
Hospital medium windows ✓ Malicious file upload Phishing and malicious documents Public CVE exploitation Kernel or system exploit Hash cracking
iClean medium linux ✓ Cross-Site Scripting (XSS) Server-Side Template Injection Credentials in files Hash cracking Sudo abuse
Inception medium linux ✓ LFI / path traversal Malicious file upload Credentials in files Sudo abuse Internal services and port forwarding +1
Instant medium linux ✓ API enumeration LFI / path traversal Credentials in files Reverse engineering SSH keys +2
Interface medium linux ✓ API enumeration Metadata and OSINT Public CVE exploitation Command injection Cron jobs and processes
Investigation medium linux ✓ Directory brute forcing Malicious file upload Public CVE exploitation Log analysis Sudo abuse +2
Jarvis medium linux ✓ Directory brute forcing LFI / path traversal Public CVE exploitation SQL injection Hash cracking +3
LightWeight medium linux ✓ Directory brute forcing Linux capabilities Hash cracking Backups and archives Traffic analysis (pcap) +1
Mentor medium linux ✓ API enumeration SNMP enumeration Vhost and subdomain fuzzing Command injection Container escape +3
Meta medium linux ✓ Metadata and OSINT Vhost and subdomain fuzzing Malicious file upload Public CVE exploitation Cron jobs and processes +1
Nineveh medium linux ✓ Directory brute forcing LFI / path traversal Public CVE exploitation Steganography Cron jobs and processes
Obscurity medium linux ✓ Directory brute forcing Command injection LFI / path traversal Weak or homemade cryptography Sudo abuse +2
October medium linux ✓ CMS exploitation Default credentials Malicious file upload SUID binaries ROP / ret2libc +1
Olympus medium linux ✓ Public CVE exploitation Container escape Wi-Fi attacks Traffic analysis (pcap) Privileged groups
Pterodactyl medium linux ✓ Vhost and subdomain fuzzing Public CVE exploitation Hash cracking Kernel or system exploit
Ready medium linux ✓ Public CVE exploitation SSRF Container escape Password reuse Backups and archives
Retired medium linux ✓ Directory brute forcing LFI / path traversal Reverse engineering ROP / ret2libc Stack buffer overflow +4
Sandworm medium linux ✓ Server-Side Template Injection Cron jobs and processes Library hijacking Credentials in files Public CVE exploitation
Shared medium linux ✓ Vhost and subdomain fuzzing SQL injection Public CVE exploitation Cron jobs and processes Hash cracking +2
SmartHire medium linux ✓ Vhost and subdomain fuzzing Insecure deserialization Library hijacking Sudo abuse
SneakyMailer medium linux ✓ Directory brute forcing Vhost and subdomain fuzzing Cross-Site Scripting (XSS) Malicious file upload Hash cracking +1
Socket medium linux ✓ SQL injection Reverse engineering Traffic analysis (pcap) Password reuse Sudo abuse
Surveillance medium linux ✓ CMS exploitation Public CVE exploitation Internal services and port forwarding Hash cracking Backups and archives +3
Tartarsauce medium linux ✓ CMS exploitation Public CVE exploitation Remote file inclusion (RFI) Sudo abuse Cron jobs and processes +2
TheNotebook medium linux ✓ JWT attacks Malicious file upload SSH keys Backups and archives Public CVE exploitation +2
Trickster medium linux ✓ Directory brute forcing Exposed .git repository Vhost and subdomain fuzzing Cross-Site Scripting (XSS) CSRF +8
VariaType medium linux ✓ Exposed .git repository LFI / path traversal Malicious file upload Public CVE exploitation Metadata and OSINT +2
Wall medium linux ✓ API enumeration Directory brute forcing Authentication bypass Command injection Credentials in files +3
Zipping medium linux ✓ LFI / path traversal Malicious file upload SQL injection Library hijacking Sudo abuse
Cerberus hard windows ✓ LFI / path traversal Public CVE exploitation SUID binaries Credentials in files Internal services and port forwarding +1
Fries hard windows ✓ Vhost and subdomain fuzzing Public CVE exploitation SMB/NFS enumeration Container escape Internal services and port forwarding +2
Proper hard windows ✓ LFI / path traversal Remote file inclusion (RFI) SQL injection NTLM capture and relay Race condition +2