Hacking Labs

137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.

// domain

New to hacking? Start with a Learning Path.

open academy

13 domains·137 labs·6 career tracks·capstone exams·real CVEs

open academy

// filter by

APK Decompilation & String Recon

Decompile a sample APK, find the hardcoded API key in the smali, and use it.

easy+30xp

mobileINTERACTIVEeasy+30 XP

AndroidManifest Audit

A misconfigured AndroidManifest.xml exports an activity that grants admin via intent extras.

easy+30xp

mobileINTERACTIVEeasy+30 XP

SSL-Pinning Bypass

A mobile app pins certificates. Frida-hook the verifier to bypass it and read the API.

medium+45xp

mobileINTERACTIVEmedium+45 XP

Insecure Storage Audit

Dump the app's /data/data/ dir and find the SharedPreferences XML with cleartext creds.

easy+35xp

mobileINTERACTIVEeasy+35 XP

WebView JS-Bridge Abuse

A WebView exposes `@JavascriptInterface` to all origins. Inject JS to call the native bridge.

medium+50xp

mobileINTERACTIVEmedium+50 XPPRO

Frida Dynamic Hook

Hook a native function with Frida to leak a secret it generates at runtime.

medium+45xp

mobileINTERACTIVEmedium+45 XP

Deobfuscate Proguard Strings

A Proguard-obfuscated APK ships strings encoded with a simple XOR loop. Recover the key.

hard+50xp

mobileINTERACTIVEhard+50 XPPRO

OAuth Refresh-Token Replay

A leaked refresh-token cache lets you mint fresh access-tokens long after the user logged out.

easy+35xp

mobileINTERACTIVEeasy+35 XP

PKCE `plain` Method Bypass

The server accepts `code_challenge_method=plain` and skips the verifier check entirely.

medium+45xp

mobileINTERACTIVEmedium+45 XP

RASP & Anti-debug Bypass

Bypass an Android RASP check that scans for Frida + roots, using two-stage Frida injection.

hard+55xp

mobileINTERACTIVEhard+55 XPPRO