Hacking Labs

137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.

// domain

New to hacking? Start with a Learning Path.

open academy

13 domains·137 labs·6 career tracks·capstone exams·real CVEs

open academy

// filter by

Direct Prompt Injection

Coax a customer-support bot to leak its system prompt — no jailbreak fluff, the actual prompt-injection mechanic.

easy+30xp

aiINTERACTIVEeasy+30 XP

Image Evasion Attack (FGSM)

Adversarial pixel-level noise on a 3-class classifier flips the prediction without the human noticing.

medium+45xp

aiINTERACTIVEmedium+45 XP

Backdoor via Data Poisoning

Inject mislabeled training samples to plant a backdoor that activates on a trigger pattern.

medium+45xp

aiINTERACTIVEmedium+45 XP

Indirect Prompt Injection (RAG)

A poisoned document in the retrieval corpus exfiltrates user data via the assistant's output.

hard+55xp

aiINTERACTIVEhard+55 XPPRO

RAG Source Poisoning

Inject a malicious chunk into a vector store so semantic-search retrieves YOUR text on the victim's query.

hard+55xp

aiINTERACTIVEhard+55 XPPRO

Model Extraction via Query Oracle

Steal a classifier by querying its API enough times to fit a surrogate of equal accuracy.

hard+55xp

aiINTERACTIVEhard+55 XPPRO

Jailbreak a Tool-Using Agent

An LLM agent with shell tool access has a denylist. Find the prompt that bypasses it.

hard+60xp

aiINTERACTIVEhard+60 XPPRO