Hacking Labs

137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.

// domain

New to hacking? Start with a Learning Path.

open academy

13 domains·137 labs·6 career tracks·capstone exams·real CVEs

open academy

// filter by

Subdomain Enumeration via CT Logs

Query a mock Certificate Transparency log to find subdomains. One is staging — that's your way in.

easy+30xp

osintINTERACTIVEeasy+30 XP

Username Pivoting

An exposed forum profile leaks a username. Pivot to find linked accounts.

easy+30xp

osintINTERACTIVEeasy+30 XP

Geolocate from Photo (EXIF)

An image's EXIF reveals its GPS location. Decode the lat/lon, identify the city.

easy+35xp

osintINTERACTIVEeasy+35 XP

Hidden-Metadata Pivoting

A PDF brochure ships with author + GPS metadata. Pivot to identify the author's institution.

easy+30xp

osintINTERACTIVEeasy+30 XP

Breach-Data Cross-Reference

A target email appears in multiple breach corpora. Pivot to find their reused password.

easy+30xp

osintINTERACTIVEeasy+30 XP

ASN-to-IP Mapping

Pivot from an org name → ASN → all owned CIDR blocks → total IP count.

easy+30xp

osintINTERACTIVEeasy+30 XP

Passive DNS Pivot

Pivot from one domain → historical IP → other domains that ever resolved to that IP.

easy+30xp

osintINTERACTIVEeasy+30 XP

Geo-OSINT via Satellite Imagery

Pin a vessel's location from 3 sequential satellite passes and tracker AIS gaps.

medium+45xp

osintINTERACTIVEmedium+45 XP

Threat Actor Attribution via OPSEC Fails

Three campaigns share infra fragments. Tie them to a single actor.

hard+50xp

osintINTERACTIVEhard+50 XP

Dark-Web Forum Crawl

Crawl a ransomware forum's index. Pivot from a single handle to find its other handles + TTPs.

medium+45xp

osintINTERACTIVEmedium+45 XP

Leak-Site Monitoring Feed

Build a feed that detects new ransomware victim posts on 3 leak sites.

medium+45xp

osintINTERACTIVEmedium+45 XP