Admirer easy linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing Authentication bypass LFI / path traversal Credentials in files Library hijacking +1
Alert easy linux ✓ ▶ LFI / path traversal (foothold) Cross-Site Scripting (XSS) LFI / path traversal Hash cracking Internal services and port forwarding
Backdoor easy linux ✓ ▶ LFI / path traversal (foothold) CMS exploitation LFI / path traversal Public CVE exploitation Sudo abuse
BountyHunter easy linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing LFI / path traversal XXE Credentials in files Password reuse +1
Chemistry easy linux ✓ ▶ LFI / path traversal (root) Public CVE exploitation Credentials in files Hash cracking LFI / path traversal Internal services and port forwarding
Conversor easy linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Cron jobs and processes Public CVE exploitation Sudo abuse
Down easy linux ✓ ▶ LFI / path traversal (foothold) Command injection LFI / path traversal SSRF Hash cracking
Inject easy linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing LFI / path traversal Public CVE exploitation Credentials in files Cron jobs and processes
LaCasaDePapel easy linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation Weak or homemade cryptography SSH keys Cron jobs and processes
LinkVortex easy linux ✓ ▶ LFI / path traversal (user) Exposed .git repository Vhost and subdomain fuzzing Public CVE exploitation LFI / path traversal Command injection +3
Mailing easy windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Credentials in files Phishing and malicious documents NTLM capture and relay Remote execution (WinRM, PsExec, WMI) +1
OpenSource easy linux ✓ ▶ LFI / path traversal (foothold) Exposed .git repository LFI / path traversal Container escape SSH keys Internal services and port forwarding +2
ServMon easy windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation Password spraying and valid users Credentials in files Internal services and port forwarding +1
Tabby easy linux ✓ ▶ LFI / path traversal (foothold) Vhost and subdomain fuzzing LFI / path traversal Malicious file upload Password reuse Hash cracking +3
Titanic easy linux ✓ ▶ LFI / path traversal (foothold) Vhost and subdomain fuzzing LFI / path traversal Hash cracking Public CVE exploitation Cron jobs and processes
Topology easy linux ✓ ▶ LFI / path traversal (foothold) Vhost and subdomain fuzzing LFI / path traversal Hash cracking Cron jobs and processes
Agile medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal IDOR Credentials in files Internal services and port forwarding Public CVE exploitation +1
Ambassador medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation Credentials in files API enumeration Internal services and port forwarding +1
Aragog medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal XXE SSH keys CMS exploitation Cron jobs and processes
Awkward medium linux ✓ ▶ LFI / path traversal (foothold) API enumeration Vhost and subdomain fuzzing Authentication bypass JWT attacks LFI / path traversal +6
Bart medium windows ✓ ▶ LFI / path traversal (foothold) Vhost and subdomain fuzzing LFI / path traversal Log analysis Credentials in the registry and history Hash cracking
Book medium linux ✓ ▶ LFI / path traversal (foothold) Authentication bypass Cross-Site Scripting (XSS) LFI / path traversal SSH keys Public CVE exploitation +1
BroScience medium linux ✓ ▶ LFI / path traversal (foothold) Insecure deserialization LFI / path traversal Weak or homemade cryptography Credentials in files Hash cracking +2
Bucket medium linux ✓ ▶ LFI / path traversal (root) Vhost and subdomain fuzzing Malicious file upload Credentials in files Password reuse LFI / path traversal +2
Builder medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation Hash cracking SSH keys
DevArea medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation Reverse engineering Command injection Cron jobs and processes +3
Format medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Malicious file upload SSRF Credentials in files Sudo abuse +1
Health medium linux ✓ ▶ LFI / path traversal (root) Public CVE exploitation SQL injection SSRF Hash cracking LFI / path traversal +1
Imagery medium linux ✓ ▶ LFI / path traversal (foothold) Command injection Cross-Site Scripting (XSS) LFI / path traversal Hash cracking Backups and archives
Inception medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Malicious file upload Credentials in files Sudo abuse Internal services and port forwarding +1
Instant medium linux ✓ ▶ LFI / path traversal (foothold) API enumeration LFI / path traversal Credentials in files Reverse engineering SSH keys +2
Jarvis medium linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing LFI / path traversal Public CVE exploitation SQL injection Hash cracking +3
Nineveh medium linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing LFI / path traversal Public CVE exploitation Steganography Cron jobs and processes
Obscurity medium linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing Command injection LFI / path traversal Weak or homemade cryptography Sudo abuse +2
POV medium windows ✓ ▶ LFI / path traversal (foothold) Vhost and subdomain fuzzing IIS and ASP.NET Insecure deserialization LFI / path traversal Credentials in files +2
Retired medium linux ✓ ▶ LFI / path traversal (foothold) Directory brute forcing LFI / path traversal Reverse engineering ROP / ret2libc Stack buffer overflow +4
Sniper medium windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Remote file inclusion (RFI) AppLocker and Constrained Language Mode Credentials in files Phishing and malicious documents +2
StreamIO medium windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal SQL injection NTLM capture and relay Password spraying and valid users Hash cracking +4
Unicode medium linux ✓ ▶ LFI / path traversal (foothold) JWT attacks LFI / path traversal Credentials in files SSH keys Sudo abuse +1
VariaType medium linux ✓ ▶ LFI / path traversal (foothold) Exposed .git repository LFI / path traversal Malicious file upload Public CVE exploitation Metadata and OSINT +2
Zipping medium linux ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Malicious file upload SQL injection Library hijacking Sudo abuse
Breadcrumbs hard windows ✓ ▶ LFI / path traversal (foothold) JWT attacks LFI / path traversal Malicious file upload AV and EDR evasion Cookie or session forging +6
Cerberus hard windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation SUID binaries Credentials in files Internal services and port forwarding +1
Hancliffe hard windows ✓ ▶ LFI / path traversal (foothold) Directory brute forcing LFI / path traversal Server-Side Template Injection Public CVE exploitation Saved credentials / DPAPI +4
Haze hard windows ✓ ▶ LFI / path traversal (foothold) Domain LDAP/RPC enumeration LFI / path traversal Public CVE exploitation Password spraying and valid users Credentials in files +5
Proper hard windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Remote file inclusion (RFI) SQL injection NTLM capture and relay Race condition +2
Reel2 hard windows ✓ ▶ LFI / path traversal (root) Phishing and malicious documents NTLM capture and relay Password spraying and valid users Hash cracking Credentials in the registry and history +3
Bighead insane windows ✓ ▶ LFI / path traversal (root) Vhost and subdomain fuzzing Stack buffer overflow Credentials in the registry and history Internal services and port forwarding LFI / path traversal +1
Ghost insane windows ✓ ▶ LFI / path traversal (foothold) Vhost and subdomain fuzzing LDAP injection LFI / path traversal gMSA accounts NTLM capture and relay +5
Mist insane windows ✓ ▶ LFI / path traversal (foothold) LFI / path traversal Public CVE exploitation AV and EDR evasion Hash cracking Phishing and malicious documents +7