Hacking Labs

137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.

// domain

New to hacking? Start with a Learning Path.

open academy

13 domains·137 labs·6 career tracks·capstone exams·real CVEs

open academy

// filter by

Public S3 Bucket Hunt

Brute-force common bucket names against a target org. One bucket is left world-readable.

easy+30xp

cloudINTERACTIVEeasy+30 XP

IAM Policy Audit

Audit a real-looking AWS account's IAM policies. Find the over-privileged one and exploit it.

easy+25xp

cloudINTERACTIVEeasy+25 XP

OIDC Federation Abuse

A GitHub Actions OIDC trust policy is too permissive — assume a prod IAM role from a forked PR.

hard+55xp

cloudINTERACTIVEhard+55 XPPRO

Default Creds in Cloud

A cloud-hosted Jenkins runs with default `admin:admin`. Get a shell.

easy+30xp

cloudINTERACTIVEeasy+30 XP

Cross-Account sts:AssumeRole

An over-permissive trust policy lets you assume a role from your own AWS account.

medium+45xp

cloudINTERACTIVEmedium+45 XP

Privileged Pod → Host Escape

A privileged K8s pod with hostPID + hostPath mount of `/` reads host secrets.

hard+60xp

cloudINTERACTIVEhard+60 XPPRO

K8s NetworkPolicy Bypass

A misnamed namespace label lets you reach a 'private' service from your pod.

medium+50xp

cloudINTERACTIVEmedium+50 XP

Supply-Chain Pivot via Poisoned Dependency

A malicious npm package phones home from inside the build → CI runner → prod creds.

hard+60xp

cloudINTERACTIVEhard+60 XPPRO