Blocky easy linux ✓ ▶ Reverse engineering (foothold) Directory brute forcing CMS exploitation Credentials in files Reverse engineering Password reuse +2
CozyHosting easy linux ✓ ▶ Reverse engineering (user) Directory brute forcing Authentication bypass Command injection Credentials in files Reverse engineering +2
Crafty easy windows ✓ ▶ Reverse engineering (root) Public CVE exploitation Credentials in files Remote execution (WinRM, PsExec, WMI) Reverse engineering
Irked easy linux ✓ ▶ Reverse engineering (root) Public CVE exploitation Steganography SUID binaries Reverse engineering
Nest easy windows ✓ ▶ Reverse engineering (user) SMB/NFS enumeration Password spraying and valid users Credentials in files Reverse engineering Remote execution (WinRM, PsExec, WMI)
RedPanda easy linux ✓ ▶ Reverse engineering (root) Server-Side Template Injection Metadata and OSINT XXE Cron jobs and processes Reverse engineering +1
RouterSpace easy linux ✓ ▶ Reverse engineering (foothold) Command injection Reverse engineering SSH keys Kernel or system exploit
Shoppy easy linux ✓ ▶ Reverse engineering (user) Authentication bypass NoSQL injection Vhost and subdomain fuzzing Reverse engineering Hash cracking +1
Support easy windows ✓ ▶ Reverse engineering (foothold) SMB/NFS enumeration Reverse engineering Traffic analysis (pcap) Domain LDAP/RPC enumeration ACL abuse (BloodHound) +2
Atom medium windows ✓ ▶ Reverse engineering (foothold) SMB/NFS enumeration Public CVE exploitation Reverse engineering Credentials in files Weak or homemade cryptography +2
Bitlab medium linux ✓ ▶ Reverse engineering (user) Directory brute forcing Malicious file upload Credentials in files Git history Reverse engineering +1
Cascade medium windows ✓ ▶ Reverse engineering (root) Domain LDAP/RPC enumeration SMB/NFS enumeration Credentials in the registry and history Remote execution (WinRM, PsExec, WMI) Weak or homemade cryptography +3
DevArea medium linux ✓ ▶ Reverse engineering (foothold) LFI / path traversal Public CVE exploitation Reverse engineering Command injection Cron jobs and processes +3
Enterprise medium linux ✓ ▶ Reverse engineering (root) CMS exploitation Public CVE exploitation SQL injection Container escape Reverse engineering +1
Gavel medium linux ✓ ▶ Reverse engineering (root) Exposed .git repository SQL injection Hash cracking Reverse engineering
Instant medium linux ✓ ▶ Reverse engineering (foothold) API enumeration LFI / path traversal Credentials in files Reverse engineering SSH keys +2
Investigation medium linux ✓ ▶ Reverse engineering (root) Directory brute forcing Malicious file upload Public CVE exploitation Log analysis Sudo abuse +2
JSON medium windows ✓ ▶ Reverse engineering (root) Default credentials Insecure deserialization SeImpersonate / Potatoes Internal services and port forwarding Reverse engineering
Ophiuchi medium linux ✓ ▶ Reverse engineering (root) Insecure deserialization Credentials in files Sudo abuse Reverse engineering
Overwatch medium windows ✓ ▶ Reverse engineering (foothold) SMB/NFS enumeration MSSQL abuse Reverse engineering NTLM capture and relay API enumeration
Retired medium linux ✓ ▶ Reverse engineering (foothold) Directory brute forcing LFI / path traversal Reverse engineering ROP / ret2libc Stack buffer overflow +4
Shared medium linux ✓ ▶ Reverse engineering (root) Vhost and subdomain fuzzing SQL injection Public CVE exploitation Cron jobs and processes Hash cracking +2
Socket medium linux ✓ ▶ Reverse engineering (foothold) SQL injection Reverse engineering Traffic analysis (pcap) Password reuse Sudo abuse
Undetected medium linux ✓ ▶ Reverse engineering (root) Directory brute forcing Vhost and subdomain fuzzing Public CVE exploitation Hash cracking Reverse engineering
Unicode medium linux ✓ ▶ Reverse engineering (root) JWT attacks LFI / path traversal Credentials in files SSH keys Sudo abuse +1
Wall medium linux ✓ ▶ Reverse engineering (user) API enumeration Directory brute forcing Authentication bypass Command injection Credentials in files +3
AppSanity hard windows ✓ ▶ Reverse engineering (user) Vhost and subdomain fuzzing IIS and ASP.NET Malicious file upload Mass assignment SSRF +4
Blazorized hard windows ✓ ▶ Reverse engineering (foothold) JWT attacks SQL injection MSSQL abuse Reverse engineering ACL abuse (BloodHound) +3
Breadcrumbs hard windows ✓ ▶ Reverse engineering (root) JWT attacks LFI / path traversal Malicious file upload AV and EDR evasion Cookie or session forging +6
Hancliffe hard windows ✓ ▶ Reverse engineering (root) Directory brute forcing LFI / path traversal Server-Side Template Injection Public CVE exploitation Saved credentials / DPAPI +4
Napper hard windows ✓ ▶ Reverse engineering (root) Vhost and subdomain fuzzing Credentials in files Internal services and port forwarding Remote execution (WinRM, PsExec, WMI) Reverse engineering +1
Proper hard windows ✓ ▶ Reverse engineering (root) LFI / path traversal Remote file inclusion (RFI) SQL injection NTLM capture and relay Race condition +2
Sharp hard windows ✓ ▶ Reverse engineering (foothold) SMB/NFS enumeration Reverse engineering Weak or homemade cryptography Insecure deserialization Password spraying and valid users +1
Coder insane windows ✓ ▶ Reverse engineering (foothold) SMB/NFS enumeration CI/CD and build abuse AV and EDR evasion Reverse engineering Weak or homemade cryptography +2
Fighter insane windows ✓ ▶ Reverse engineering (root) Vhost and subdomain fuzzing SQL injection MSSQL abuse Scheduled tasks and admin scripts AppLocker and Constrained Language Mode +3
Infiltrator insane windows ✓ ▶ Reverse engineering (user) AS-REP roasting Password spraying and valid users API enumeration Domain LDAP/RPC enumeration ACL abuse (BloodHound) +6
PivotAPI insane windows ✓ ▶ Reverse engineering (user) Metadata and OSINT SMB/NFS enumeration AS-REP roasting Hash cracking Internal services and port forwarding +6