Hacking Labs
137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.
Box: Legacy Admin Panel (chained)
Three chained vulns: info-disclosure → SQLi on /admin-old → path traversal to /root/flag. Persistent VFS per user.
Box: Cloud Misconfig (S3 + IAM + SSRF)
SSRF the instance metadata service for IAM creds, then list a misconfigured S3 bucket to grab the flag.
Box: GraphQL + Mass Assignment
Introspect a GraphQL schema, find a mutation that mass-assigns role=admin, claim the flag.
Box: Active Directory — Kerberoasting
Enumerate SPNs, request a TGS, crack the offline hash, recover the service-account password.
Box: Mobile — Deeplink + JWT Replay
Abuse a permissive deep-link scheme to leak a stale JWT, then replay it to access the admin endpoint.
Box: Pwn-the-Pipe (CI/CD secret leak)
Inject into a build YAML, exfiltrate the env, then use the leaked token to read the prod registry.
Box: AWS Lambda Privilege Escalation
Discover an over-privileged Lambda, invoke it via its API Gateway URL, escalate to read prod secrets.
Box: Kubernetes RBAC Escape
Steal the service-account token from a sidecar, then list cluster-wide secrets via the API server.
Box: iOS — Sideloaded Replay
An IPA leaks an embedded refresh-token. Replay it against the API to mint an admin access-token.