Hacking Labs

137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.

// domain

New to hacking? Start with a Learning Path.

open academy

13 domains·137 labs·6 career tracks·capstone exams·real CVEs

open academy

// filter by

Find the Solidity Bug in 30 LOC

Static-analysis warm-up: find the vulnerability in a tiny token contract.

easy+30xp

blockchainINTERACTIVEeasy+30 XP

Drain a Vault via Reentrancy

Classic checks-effects-interactions violation in a `withdraw()` function. Drain the whole vault.

medium+50xp

blockchainINTERACTIVEmedium+50 XP

Take Over via Missing onlyOwner

The `setOwner()` function forgot its modifier. Become owner. Drain the contract.

easy+30xp

blockchainINTERACTIVEeasy+30 XP

Flash-Loan Oracle Manipulation

Take a 10M USDC flash loan, pump a DEX's spot-oracle price, drain a lender that uses it.

hard+60xp

blockchainINTERACTIVEhard+60 XPPRO

AMM Off-by-One

A CFMM rounded `(x*y)` the wrong way. Find a swap path that profits per round-trip.

hard+55xp

blockchainINTERACTIVEhard+55 XPPRO

Forge a Cross-Chain Bridge Proof

Bridge's merkle-proof verifier accepts the wrong leaf encoding. Mint coins out of thin air.

hard+65xp

blockchainINTERACTIVEhard+65 XPPRO

ZK Circuit Underconstraint Bug

A circom circuit forgot a `<==` (constraint). Find the witness that proves a false statement.

hard+65xp

blockchainINTERACTIVEhard+65 XPPRO