Hacking Labs
151 hands-on labs across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain and more. Capture the flag, earn XP.
Classic UNION-based SQL Injection
A search endpoint glues user input straight into a SQL query. Extract the admin flag from the `secrets` table.
Reflected XSS Sandbox
A search endpoint reflects user input straight into the response HTML. Craft a payload that proves you can execute JS.
JWT alg=none
A login endpoint mints JWTs but trusts the `alg` header. Forge an admin token and read the flag.
Path Traversal
A file-fetch endpoint blocks `..` only at the front. Read the flag stored at `/etc/hc/flag.txt` in the virtual FS.
Server-Side Request Forgery
A URL-fetch endpoint blocks `localhost`/`127.0.0.1`. Reach the internal admin service anyway.
Insecure Direct Object Reference
A profile endpoint trusts the `user_id` query param with no auth check. Read someone else's profile.
Race Condition
A one-time coupon endpoint has no lock. Send concurrent requests to claim it twice.
Prototype Pollution (JS-style)
A naive JSON deep-merge taints object prototypes. Promote yourself to admin.
Cross-Site Request Forgery
A money-transfer endpoint checks the Origin header — but only if it's present.
Weak XOR Crypto
A ciphertext is base64-encoded and XOR-encrypted with a single ASCII byte. Recover the plaintext.
Cookie Forgery via Missing Signature
The session cookie is base64(JSON). Tamper your role to admin — and the server forgets to verify the signature.
Box: Legacy Admin Panel (chained)
Three chained vulns: info-disclosure → SQLi on /admin-old → path traversal to /root/flag. Persistent VFS per user.
Box: Cloud Misconfig (S3 + IAM + SSRF)
SSRF the instance metadata service for IAM creds, then list a misconfigured S3 bucket to grab the flag.
Box: GraphQL + Mass Assignment
Introspect a GraphQL schema, find a mutation that mass-assigns role=admin, claim the flag.
Box: Active Directory — Kerberoasting
Enumerate SPNs, request a TGS, crack the offline hash, recover the service-account password.
Box: Mobile — Deeplink + JWT Replay
Abuse a permissive deep-link scheme to leak a stale JWT, then replay it to access the admin endpoint.
Box: Pwn-the-Pipe (CI/CD secret leak)
Inject into a build YAML, exfiltrate the env, then use the leaked token to read the prod registry.
Box: AWS Lambda Privilege Escalation
Discover an over-privileged Lambda, invoke it via its API Gateway URL, escalate to read prod secrets.
Box: Kubernetes RBAC Escape
Steal the service-account token from a sidecar, then list cluster-wide secrets via the API server.
Box: iOS — Sideloaded Replay
An IPA leaks an embedded refresh-token. Replay it against the API to mint an admin access-token.
BloodHound Path Discovery
Query a mock LDAP graph to find the shortest path from a kerberoastable user to Domain Admin.
SMB Null-Session Enumeration
A misconfigured DC allows anonymous SMB sessions. Enumerate shares, users, and dump LSA secrets.
AS-REProasting
A service account has Kerberos pre-auth disabled. Request an AS-REP, crack the RC4 hash offline.
Pass-the-Hash
Authenticate to a remote SMB share using only an NT hash — no plaintext password needed.