Academy easy linux ✓ Directory brute forcing Vhost and subdomain fuzzing Insecure deserialization Mass assignment Public CVE exploitation +5
Access easy windows ✓ Credentials in files Hash cracking Backups and archives Saved credentials / DPAPI AppLocker and Constrained Language Mode
Active easy windows ✓ SMB/NFS enumeration GPP and GPO abuse Domain LDAP/RPC enumeration Kerberoasting Remote execution (WinRM, PsExec, WMI) +1
Admirer easy linux ✓ Directory brute forcing Authentication bypass LFI / path traversal Credentials in files Library hijacking +1
Alert easy linux ✓ Cross-Site Scripting (XSS) LFI / path traversal Hash cracking Internal services and port forwarding
Armageddon easy linux ✓ CMS exploitation Public CVE exploitation Credentials in files Hash cracking Sudo abuse
Artificial easy linux ✓ Insecure deserialization Malicious file upload Hash cracking Command injection Internal services and port forwarding +1
Bank easy linux ✓ Directory brute forcing Vhost and subdomain fuzzing Authentication bypass Malicious file upload Credentials in files +2
Bastion easy windows ✓ SMB/NFS enumeration SAM/LSA/LSASS dumping Hash cracking Backups and archives Saved credentials / DPAPI
Bizness easy linux ✓ Directory brute forcing Authentication bypass Insecure deserialization Public CVE exploitation Hash cracking
Blocky easy linux ✓ Directory brute forcing CMS exploitation Credentials in files Reverse engineering Password reuse +2
Boardlight easy linux ✓ Vhost and subdomain fuzzing Default credentials Public CVE exploitation Credentials in files Password reuse +1
Bounty easy windows ✓ Directory brute forcing IIS and ASP.NET Malicious file upload SeImpersonate / Potatoes Windows exploits
BountyHunter easy linux ✓ Directory brute forcing LFI / path traversal XXE Credentials in files Password reuse +1
Buff easy windows ✓ Public CVE exploitation Internal services and port forwarding Stack buffer overflow
Busqueda easy linux ✓ Server-Side Template Injection Exposed .git repository Vhost and subdomain fuzzing Credentials in files Container escape +2
Chemistry easy linux ✓ Public CVE exploitation Credentials in files Hash cracking LFI / path traversal Internal services and port forwarding
Cicada easy windows ✓ Domain LDAP/RPC enumeration SMB/NFS enumeration Password spraying and valid users Credentials in files Remote execution (WinRM, PsExec, WMI) +2
CodePartTwo easy linux ✓ Public CVE exploitation Credentials in files Sudo abuse Backups and archives
Codify easy linux ✓ Public CVE exploitation Hash cracking Authentication bypass Cron jobs and processes Sudo abuse
Conversor easy linux ✓ LFI / path traversal Cron jobs and processes Public CVE exploitation Sudo abuse
CozyHosting easy linux ✓ Directory brute forcing Authentication bypass Command injection Credentials in files Reverse engineering +2
Crafty easy windows ✓ Public CVE exploitation Credentials in files Remote execution (WinRM, PsExec, WMI) Reverse engineering
Devvortex easy linux ✓ Vhost and subdomain fuzzing CMS exploitation Mass assignment Public CVE exploitation Hash cracking +1
Doctor easy linux ✓ Command injection Server-Side Template Injection Privileged groups Log analysis Public CVE exploitation
Dog easy linux ✓ Exposed .git repository CMS exploitation Credentials in files Password reuse Sudo abuse
Driver easy windows ✓ Default credentials NTLM capture and relay Remote execution (WinRM, PsExec, WMI) Hash cracking Public CVE exploitation +1
Eighteen easy windows ✓ Domain LDAP/RPC enumeration Password spraying and valid users MSSQL abuse Remote execution (WinRM, PsExec, WMI) Hash cracking +3
EscapeTwo easy windows ✓ Credentials in files MSSQL abuse Password spraying and valid users ACL abuse (BloodHound) ADCS (certificates) +1
Fluffy easy windows ✓ Kerberoasting NTLM capture and relay Hash cracking ACL abuse (BloodHound) Shadow Credentials +1
Forest easy windows ✓ Domain LDAP/RPC enumeration AS-REP roasting Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Hash cracking +4
Frolic easy linux ✓ Directory brute forcing Malicious file upload Public CVE exploitation Hash cracking SUID binaries +2
Haystack easy linux ✓ API enumeration Credentials in files Public CVE exploitation Internal services and port forwarding Log analysis
Heist easy windows ✓ Domain LDAP/RPC enumeration Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Hash cracking Memory dumps
Help easy linux ✓ Directory brute forcing GraphQL Malicious file upload Public CVE exploitation SQL injection +1
Inject easy linux ✓ Directory brute forcing LFI / path traversal Public CVE exploitation Credentials in files Cron jobs and processes
Keeper easy linux ✓ Default credentials Credentials in files Public CVE exploitation SSH keys Memory dumps
Kobold easy linux ✓ Vhost and subdomain fuzzing Public CVE exploitation SSH keys Container escape Privileged groups +1
LaCasaDePapel easy linux ✓ LFI / path traversal Public CVE exploitation Weak or homemade cryptography SSH keys Cron jobs and processes
LinkVortex easy linux ✓ Exposed .git repository Vhost and subdomain fuzzing Public CVE exploitation LFI / path traversal Command injection +3
Mailing easy windows ✓ LFI / path traversal Credentials in files Phishing and malicious documents NTLM capture and relay Remote execution (WinRM, PsExec, WMI) +1
MonitorsFour easy windows ✓ Vhost and subdomain fuzzing Authentication bypass Public CVE exploitation Hash cracking Container escape +1
MonitorsTwo easy linux ✓ Public CVE exploitation Hash cracking Container escape Linux capabilities SUID binaries
Nest easy windows ✓ SMB/NFS enumeration Password spraying and valid users Credentials in files Reverse engineering Remote execution (WinRM, PsExec, WMI)
Netmon easy windows ✓ Command injection Public CVE exploitation Credentials in files Backups and archives
Networked easy linux ✓ Directory brute forcing Malicious file upload Backups and archives Command injection Cron jobs and processes +1
Nibbles easy linux ✓ Directory brute forcing CMS exploitation Malicious file upload Public CVE exploitation Sudo abuse
Nocturnal easy linux ✓ Directory brute forcing Command injection IDOR Hash cracking Public CVE exploitation +1
OpenAdmin easy linux ✓ Directory brute forcing Public CVE exploitation SSH keys Credentials in files Internal services and port forwarding +3
OpenSource easy linux ✓ Exposed .git repository LFI / path traversal Container escape SSH keys Internal services and port forwarding +2
Pandora easy linux ✓ SNMP enumeration Malicious file upload Public CVE exploitation SQL injection Internal services and port forwarding +2
PC easy linux ✓ API enumeration SQL injection Public CVE exploitation Internal services and port forwarding
PermX easy linux ✓ Vhost and subdomain fuzzing Public CVE exploitation Credentials in files Password reuse Sudo abuse +1
Planning easy linux ✓ Vhost and subdomain fuzzing Public CVE exploitation Credentials in files Cron jobs and processes Internal services and port forwarding
Precious easy linux ✓ Metadata and OSINT Command injection Public CVE exploitation Credentials in files Insecure deserialization +1
Previse easy linux ✓ Directory brute forcing Authentication bypass Command injection Credentials in files Hash cracking +2
RedPanda easy linux ✓ Server-Side Template Injection Metadata and OSINT XXE Cron jobs and processes Reverse engineering +1
Remote easy windows ✓ SMB/NFS enumeration CMS exploitation Public CVE exploitation Credentials in files Misconfigured services +1
Sauna easy windows ✓ AS-REP roasting Password spraying and valid users Remote execution (WinRM, PsExec, WMI) Hash cracking Credentials in the registry and history +3
Sea easy linux ✓ Directory brute forcing CMS exploitation Cross-Site Scripting (XSS) Public CVE exploitation Hash cracking +2
ServMon easy windows ✓ LFI / path traversal Public CVE exploitation Password spraying and valid users Credentials in files Internal services and port forwarding +1
Shoppy easy linux ✓ Authentication bypass NoSQL injection Vhost and subdomain fuzzing Reverse engineering Hash cracking +1
Silentium easy linux ✓ Vhost and subdomain fuzzing Authentication bypass Public CVE exploitation Credentials in files SSH keys +1
Soccer easy linux ✓ Directory brute forcing Default credentials Malicious file upload Vhost and subdomain fuzzing SQL injection +1
Support easy windows ✓ SMB/NFS enumeration Reverse engineering Traffic analysis (pcap) Domain LDAP/RPC enumeration ACL abuse (BloodHound) +2
Swagshop easy linux ✓ CMS exploitation Insecure deserialization Public CVE exploitation SQL injection Sudo abuse
Tabby easy linux ✓ Vhost and subdomain fuzzing LFI / path traversal Malicious file upload Password reuse Hash cracking +3
Teacher easy linux ✓ Metadata and OSINT Public CVE exploitation Hash cracking Cron jobs and processes
Timelapse easy windows ✓ SMB/NFS enumeration Remote execution (WinRM, PsExec, WMI) Hash cracking Backups and archives Credentials in the registry and history +1
Titanic easy linux ✓ Vhost and subdomain fuzzing LFI / path traversal Hash cracking Public CVE exploitation Cron jobs and processes
Topology easy linux ✓ Vhost and subdomain fuzzing LFI / path traversal Hash cracking Cron jobs and processes
Traceback easy linux ✓ Directory brute forcing Default credentials SSH keys Sudo abuse Cron jobs and processes
TwoMillion easy linux ✓ API enumeration Command injection Mass assignment Credentials in files Password reuse +1
Writeup easy linux ✓ CMS exploitation Public CVE exploitation SQL injection Hash cracking Cron jobs and processes +2