Search Ctrl K ES

All machines

Filters OS, difficulty, phase and techniques

OS Difficulty Category Phase Hide the ones I have done

Specific techniques

Tick several to find machines that use all of them.

Reconnaissance API enumeration 15 Directory brute forcing 42 Domain LDAP/RPC enumeration 18 Exposed .git repository 10 Metadata and OSINT 10 SMB/NFS enumeration 34 SNMP enumeration 6 Vhost and subdomain fuzzing 47 Wi-Fi attacks 3

Web Authentication bypass 22 CI/CD and build abuse 4 CMS exploitation 22 Command injection 40 Cross-Site Scripting (XSS) 14 CSRF 4 Default credentials 17 GraphQL 2 IDOR 6 IIS and ASP.NET 9 Insecure deserialization 20 JWT attacks 9 LDAP injection 2 LFI / path traversal 50 Malicious file upload 46 Mass assignment 5 NoSQL injection 1 Phishing and malicious documents 14 Public CVE exploitation 110 Remote file inclusion (RFI) 3 Server-Side Template Injection 12 SQL injection 31 SSRF 15 XXE 4

Linux privilege escalation Container escape 16 Cron jobs and processes 31 Kernel or system exploit 7 Library hijacking 5 Linux capabilities 4 PATH hijacking 8 Privileged groups 10 SSH keys 33 Sudo abuse 61 SUID binaries 16 Symlink abuse 8 Wildcard injection 2

Windows privilege escalation AlwaysInstallElevated 1 Credentials in the registry and history 14 DLL hijacking 7 Misconfigured services 7 Other token privileges 6 Privileged Windows groups 4 Saved credentials / DPAPI 12 Scheduled tasks and admin scripts 9 SeBackup / SeRestore 3 SeImpersonate / Potatoes 14 UAC bypass 1 Windows exploits 15

Active Directory ACL abuse (BloodHound) 33 ADCS (certificates) 17 AS-REP roasting 8 BadSuccessor (dMSA) 2 DCSync 9 Deleted AD objects 5 Domain and forest trusts 2 gMSA accounts 13 GPP and GPO abuse 5 Kerberoasting 12 Kerberos delegation (RBCD) 13 NTLM capture and relay 28 Pass-the-hash / ticket 14 Password spraying and valid users 37 Reading LAPS passwords 3 Shadow Credentials 10 WSUS abuse 2

Post-exploitation and lateral movement Credentials in files 99 Internal services and port forwarding 56 MSSQL abuse 17 Password reuse 24 Remote execution (WinRM, PsExec, WMI) 39 SAM/LSA/LSASS dumping 14

Defense evasion AppLocker and Constrained Language Mode 11 AV and EDR evasion 17

Binary exploitation (pwn) Format string 1 Race condition 4 Reverse engineering 37 ROP / ret2libc 3 Stack buffer overflow 10

Cryptography and cracking Cookie or session forging 5 Hash cracking 101 Padding oracle 2 Weak or homemade cryptography 16

Forensics Backups and archives 23 Git history 9 Log analysis 13 Memory dumps 8 Steganography 3 Traffic analysis (pcap) 12

35 machines Clear filters

Malicious file upload

All machines

Acute

Analysis

AppSanity

Axlle

Blackfield

Blazorized

Breadcrumbs

Cerberus

Cereal

Certificate

Conceal

Control

DarkZero

DropZone

Freelancer

Fries

Hancliffe

Haze

Helpline

Mantis

Mirage

Nanocorp

Napper

Office

Pirate

Proper

RE

Reel

Reel2

RustyKey

Scepter

Search

Sharp

Tally

Vintage