Blocky easy linux ✓ Directory brute forcing CMS exploitation Credentials in files Reverse engineering Password reuse +2
Buff easy windows ✓ Public CVE exploitation Internal services and port forwarding Stack buffer overflow
CozyHosting easy linux ✓ Directory brute forcing Authentication bypass Command injection Credentials in files Reverse engineering +2
Crafty easy windows ✓ Public CVE exploitation Credentials in files Remote execution (WinRM, PsExec, WMI) Reverse engineering
Frolic easy linux ✓ Directory brute forcing Malicious file upload Public CVE exploitation Hash cracking SUID binaries +2
LinkVortex easy linux ✓ Exposed .git repository Vhost and subdomain fuzzing Public CVE exploitation LFI / path traversal Command injection +3
Nest easy windows ✓ SMB/NFS enumeration Password spraying and valid users Credentials in files Reverse engineering Remote execution (WinRM, PsExec, WMI)
RedPanda easy linux ✓ Server-Side Template Injection Metadata and OSINT XXE Cron jobs and processes Reverse engineering +1
Shoppy easy linux ✓ Authentication bypass NoSQL injection Vhost and subdomain fuzzing Reverse engineering Hash cracking +1
Support easy windows ✓ SMB/NFS enumeration Reverse engineering Traffic analysis (pcap) Domain LDAP/RPC enumeration ACL abuse (BloodHound) +2
Atom medium windows ✓ SMB/NFS enumeration Public CVE exploitation Reverse engineering Credentials in files Weak or homemade cryptography +2
Bitlab medium linux ✓ Directory brute forcing Malicious file upload Credentials in files Git history Reverse engineering +1
Cascade medium windows ✓ Domain LDAP/RPC enumeration SMB/NFS enumeration Credentials in the registry and history Remote execution (WinRM, PsExec, WMI) Weak or homemade cryptography +3
Chatterbox medium windows ✓ Public CVE exploitation Stack buffer overflow Credentials in the registry and history Password reuse
DevArea medium linux ✓ LFI / path traversal Public CVE exploitation Reverse engineering Command injection Cron jobs and processes +3
Enterprise medium linux ✓ CMS exploitation Public CVE exploitation SQL injection Container escape Reverse engineering +1
Format medium linux ✓ LFI / path traversal Malicious file upload SSRF Credentials in files Sudo abuse +1
Instant medium linux ✓ API enumeration LFI / path traversal Credentials in files Reverse engineering SSH keys +2
Investigation medium linux ✓ Directory brute forcing Malicious file upload Public CVE exploitation Log analysis Sudo abuse +2
JSON medium windows ✓ Default credentials Insecure deserialization SeImpersonate / Potatoes Internal services and port forwarding Reverse engineering
Obscurity medium linux ✓ Directory brute forcing Command injection LFI / path traversal Weak or homemade cryptography Sudo abuse +2
October medium linux ✓ CMS exploitation Default credentials Malicious file upload SUID binaries ROP / ret2libc +1
Overwatch medium windows ✓ SMB/NFS enumeration MSSQL abuse Reverse engineering NTLM capture and relay API enumeration
Retired medium linux ✓ Directory brute forcing LFI / path traversal Reverse engineering ROP / ret2libc Stack buffer overflow +4
Shared medium linux ✓ Vhost and subdomain fuzzing SQL injection Public CVE exploitation Cron jobs and processes Hash cracking +2
Socket medium linux ✓ SQL injection Reverse engineering Traffic analysis (pcap) Password reuse Sudo abuse
Undetected medium linux ✓ Directory brute forcing Vhost and subdomain fuzzing Public CVE exploitation Hash cracking Reverse engineering
Wall medium linux ✓ API enumeration Directory brute forcing Authentication bypass Command injection Credentials in files +3
AppSanity hard windows ✓ Vhost and subdomain fuzzing IIS and ASP.NET Malicious file upload Mass assignment SSRF +4
Blazorized hard windows ✓ JWT attacks SQL injection MSSQL abuse Reverse engineering ACL abuse (BloodHound) +3
Breadcrumbs hard windows ✓ JWT attacks LFI / path traversal Malicious file upload AV and EDR evasion Cookie or session forging +6
Hancliffe hard windows ✓ Directory brute forcing LFI / path traversal Server-Side Template Injection Public CVE exploitation Saved credentials / DPAPI +4
Napper hard windows ✓ Vhost and subdomain fuzzing Credentials in files Internal services and port forwarding Remote execution (WinRM, PsExec, WMI) Reverse engineering +1
Proper hard windows ✓ LFI / path traversal Remote file inclusion (RFI) SQL injection NTLM capture and relay Race condition +2
Sharp hard windows ✓ SMB/NFS enumeration Reverse engineering Weak or homemade cryptography Insecure deserialization Password spraying and valid users +1
BankRobber insane windows ✓ Command injection Cross-Site Scripting (XSS) SQL injection Internal services and port forwarding Stack buffer overflow
Bighead insane windows ✓ Vhost and subdomain fuzzing Stack buffer overflow Credentials in the registry and history Internal services and port forwarding LFI / path traversal +1
Coder insane windows ✓ SMB/NFS enumeration CI/CD and build abuse AV and EDR evasion Reverse engineering Weak or homemade cryptography +2
Fighter insane windows ✓ Vhost and subdomain fuzzing SQL injection MSSQL abuse Scheduled tasks and admin scripts AppLocker and Constrained Language Mode +3
Infiltrator insane windows ✓ AS-REP roasting Password spraying and valid users API enumeration Domain LDAP/RPC enumeration ACL abuse (BloodHound) +6
PivotAPI insane windows ✓ Metadata and OSINT SMB/NFS enumeration AS-REP roasting Hash cracking Internal services and port forwarding +6