Hacking Labs

137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.

// domain

New to hacking? Start with a Learning Path.

open academy

13 domains·137 labs·6 career tracks·capstone exams·real CVEs

open academy

// filter by

License Crack-Me (Reverse the Check)

A 'licensed' endpoint runs a deterministic check against your key. Reverse the algorithm.

easy+35xp

reverseINTERACTIVEeasy+35 XP

Format String %n Write-What-Where

A printf-style logger trusts user input. Use %n to flip a privilege byte.

hard+50xp

reverseINTERACTIVEhard+50 XP

GDB Stack Smash Drill

A buffer overflow lets you overwrite a return address. Pick the right offset + payload.

medium+45xp

reverseINTERACTIVEmedium+45 XP

Build a ROP Chain

Build a minimal ROP chain to call execve('/bin/sh', 0, 0).

hard+60xp

reverseINTERACTIVEhard+60 XPPRO

Static String Hunt

A binary embeds the password verbatim. `strings | grep` would solve it. Do the equivalent.

easy+25xp

reverseINTERACTIVEeasy+25 XP

Dynamic Debugging — Patch Run-Time Check

Set a breakpoint at the license-check CALL, flip the ZF, watch the program let you in.

easy+30xp

reverseINTERACTIVEeasy+30 XP

Manual UPX Unpack — Find OEP

Walk through a UPX-packed binary's stages: PUSHAD → unpack loop → JMP to OEP.

medium+45xp

reverseINTERACTIVEmedium+45 XP

Defeat IsDebuggerPresent

The binary calls `kernel32!IsDebuggerPresent`. Patch it to always return 0.

medium+45xp

reverseINTERACTIVEmedium+45 XP

Anti-VM Detection Bypass

A binary refuses to run inside VMs. Patch out the 3 most common VM-detection checks.

medium+45xp

reverseINTERACTIVEmedium+45 XP

YARA Family Rule — Catch 50 Variants

Write a YARA rule that flags every variant of a family without false-positives on benign samples.

hard+55xp

reverseINTERACTIVEhard+55 XPPRO

Unpack a Real Ransomware Sample

Trace 3 unpacking stages, dump the final payload, identify the RSA pubkey it embeds.

hard+60xp

reverseINTERACTIVEhard+60 XPPRO

Reverse a C2 Protocol

Three captured packets follow a custom C2 framing. Decode the command + parameter.

hard+60xp

reverseINTERACTIVEhard+60 XPPRO