Hacking Labs

137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.

// domain

New to hacking? Start with a Learning Path.

open academy

13 domains·137 labs·6 career tracks·capstone exams·real CVEs

open academy

// filter by

BloodHound Path Discovery

Query a mock LDAP graph to find the shortest path from a kerberoastable user to Domain Admin.

easy+30xp

adINTERACTIVEeasy+30 XP

SMB Null-Session Enumeration

A misconfigured DC allows anonymous SMB sessions. Enumerate shares, users, and dump LSA secrets.

easy+25xp

adINTERACTIVEeasy+25 XP

AS-REProasting

A service account has Kerberos pre-auth disabled. Request an AS-REP, crack the RC4 hash offline.

medium+45xp

adINTERACTIVEmedium+45 XP

Pass-the-Hash

Authenticate to a remote SMB share using only an NT hash — no plaintext password needed.

medium+50xp

adINTERACTIVEmedium+50 XPPRO

DCSync Replication Abuse

An over-privileged account has DS-Replication rights. Pull the krbtgt NTLM hash.

hard+55xp

adINTERACTIVEhard+55 XPPRO

AD ACL Privilege Escalation

BloodHound shows a 'GenericAll' edge from a low user to a high group. Force-add yourself.

hard+50xp

adINTERACTIVEhard+50 XPPRO

Golden Ticket Forgery

You have the krbtgt NTLM hash. Forge a TGT with arbitrary group membership.

hard+60xp

adINTERACTIVEhard+60 XPPRO

NTLM Relay Attack

Coerce a victim into authenticating, relay the NTLM challenge to a high-value target.

hard+55xp

adINTERACTIVEhard+55 XPPRO

ADCS ESC1 Exploit

An ADCS template lets low-priv users specify SAN. Request a cert as Domain Admin.

hard+60xp

adINTERACTIVEhard+60 XPPRO

Shadow Credentials (msDS-KeyCredentialLink)

Add a key-credential to a target user, then PKINIT-auth as them.

hard+55xp

adINTERACTIVEhard+55 XPPRO