Hacking Labs

137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.

// domain

New to hacking? Start with a Learning Path.

open academy

13 domains·137 labs·6 career tracks·capstone exams·real CVEs

open academy

// filter by

Semgrep Rule Authoring

Write a Semgrep YAML rule that catches `eval($x)` in a sample codebase.

medium+40xp

devsecopsINTERACTIVEmedium+40 XP

SBOM Generation & Verification

Generate a CycloneDX SBOM for a container, spot the one package with a known critical CVE.

medium+45xp

devsecopsINTERACTIVEmedium+45 XP

STRIDE Threat-Model Drill

Map 6 sample threats to STRIDE letters. Get all 6 right.

easy+30xp

devsecopsINTERACTIVEeasy+30 XP

CodeQL Query

Write a CodeQL-ish query that finds every SQL-injection in a 6-file mini codebase.

medium+45xp

devsecopsINTERACTIVEmedium+45 XP

Terraform IaC Audit

Audit a small Terraform module. Find the resource with a public-IP misconfig and patch it.

medium+45xp

devsecopsINTERACTIVEmedium+45 XP

Container Escape via /proc

A privileged Docker container can read host /proc. Find the host's `/etc/shadow` content.

hard+55xp

devsecopsINTERACTIVEhard+55 XPPRO

GitHub Actions Pipeline Audit

Spot the three classic CI/CD mistakes in a YAML workflow before they ship.

easy+35xp

devsecopsINTERACTIVEeasy+35 XP

Risk Triage with CVSS + Business Impact

Score 5 findings and rank the one that must ship first.

easy+35xp

devsecopsINTERACTIVEeasy+35 XP

ZAP API Scan — Tune for an OpenAPI Spec

Feed an OpenAPI spec to ZAP, add auth headers, kill the noisy rules. Read the resulting report.

medium+45xp

devsecopsINTERACTIVEmedium+45 XP

Dependency Vulnerability Triage

5 SCA findings. Decide which need a patch this sprint vs which can wait.

easy+35xp

devsecopsINTERACTIVEeasy+35 XP

Sigstore Keyless Image Signing

Sign a container image with Cosign keyless OIDC, then verify the chain back to your GitHub identity.

medium+45xp

devsecopsINTERACTIVEmedium+45 XP

Detect a Supply-Chain Attack in CI Logs

A CI run shows one extra outbound DNS request. Find the suspicious dependency.

medium+50xp

devsecopsINTERACTIVEmedium+50 XP