Hacking Labs

137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.

// domain

New to hacking? Start with a Learning Path.

open academy

13 domains·137 labs·6 career tracks·capstone exams·real CVEs

open academy

// filter by

Weak XOR Crypto

A ciphertext is base64-encoded and XOR-encrypted with a single ASCII byte. Recover the plaintext.

easy+25xp

cryptoINTERACTIVEeasy+25 XP

CBC Padding Oracle

Decrypt an AES-CBC ciphertext using only a padding-validation oracle.

hard+60xp

cryptoINTERACTIVEhard+60 XPPRO

MD5 Collision Drill

Find two different inputs whose MD5 hashes collide. (Hint: prefix-collision attack is well-known.)

easy+30xp

cryptoINTERACTIVEeasy+30 XP

Hash Length Extension

A naive MAC = MD5(secret || message) is forgeable via length extension. Forge `admin=true`.

medium+45xp

cryptoINTERACTIVEmedium+45 XP

ECB Code-Book Attack (Block Recovery)

Server encrypts `user || PADDING || SECRET` with AES-ECB. Recover SECRET byte-by-byte.

medium+40xp

cryptoINTERACTIVEmedium+40 XP

RSA Wiener Attack

An RSA keypair was generated with a tiny private exponent. Continued-fraction your way to `d`.

hard+60xp

cryptoINTERACTIVEhard+60 XPPRO

AES-CTR IV Reuse

Two ciphertexts encrypted with the same key + same IV → XOR them, recover plaintext.

medium+45xp

cryptoINTERACTIVEmedium+45 XP

RSA Common Modulus Attack

Two ciphertexts encrypted with the same N but different coprime e values. Recover m.

hard+55xp

cryptoINTERACTIVEhard+55 XPPRO

ECDSA Nonce Reuse

Two ECDSA signatures with the same nonce k → recover the private key.

hard+55xp

cryptoINTERACTIVEhard+55 XPPRO

Lattice Attack on Bad RSA

Coppersmith / LLL recovers a small private exponent or partial-key disclosure.

hard+60xp

cryptoINTERACTIVEhard+60 XPPRO

Timing Side-Channel on 4-Digit PIN

A login endpoint compares the PIN byte-by-byte and returns *after* the first mismatch.

medium+45xp

cryptoINTERACTIVEmedium+45 XP

Post-Quantum Crypto Migration Audit

Inventory a codebase's crypto. Find every quantum-vulnerable construct + the right PQC replacement.

hard+55xp

cryptoINTERACTIVEhard+55 XP