Hacking Labs

137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.

// domain

New to hacking? Start with a Learning Path.

open academy

13 domains·137 labs·6 career tracks·capstone exams·real CVEs

open academy

// filter by

Nmap Service Recon

Scan a target subnet, identify open ports, then probe the one running an old vulnerable service.

easy+25xp

networkINTERACTIVEeasy+25 XP

Shodan Recon Drill

Query a mock Shodan API to find exposed services for a target org.

easy+30xp

networkINTERACTIVEeasy+30 XP

ARP Spoof & MITM

Poison the ARP table of a target host so its traffic flows through you.

medium+45xp

networkINTERACTIVEmedium+45 XP

WPA2 Handshake Crack

Capture a WPA2 4-way handshake, crack the PSK with a small wordlist.

medium+45xp

networkINTERACTIVEmedium+45 XP

Router Firmware Unpack & String Hunt

binwalk a router firmware blob, find the hardcoded debug credentials.

medium+45xp

networkINTERACTIVEmedium+45 XP

DNS Rebinding Attack

Bypass same-origin protection by binding a domain alternately to attacker + victim IPs.

medium+45xp

networkINTERACTIVEmedium+45 XP

Service Fingerprinting

Banner-grab three open ports on a target and identify the outdated SSH daemon's exact version.

easy+30xp

networkINTERACTIVEeasy+30 XP

SSH Dynamic Forwarding (SOCKS pivot)

Pivot through a bastion to reach an internal MySQL via dynamic (SOCKS) forwarding.

medium+45xp

networkINTERACTIVEmedium+45 XP

Evil-Twin AP + Captive Portal

Clone a victim AP, run a captive portal, harvest the WPA2 PSK someone types in.

hard+55xp

networkINTERACTIVEhard+55 XPPRO

Proxychains Pivot via Compromised Host

Use a compromised mid-tier server as a SOCKS proxy to reach a target you can't otherwise touch.

medium+45xp

networkINTERACTIVEmedium+45 XP

UART Console Discovery

Probe 4 unlabeled pads on a PCB, find TX/RX/GND, get a root shell.

hard+55xp

networkINTERACTIVEhard+55 XPPRO

JTAG Flash Dump via OpenOCD

Identify the JTAG TAPs via BSDL, configure OpenOCD, dump the boot flash.

hard+60xp

networkINTERACTIVEhard+60 XPPRO