Hacking Labs

137 hands-on labs + 75 AI-generated puzzles across 13 domains — web, AD, cloud, mobile, network, crypto, forensics, OSINT, RE, DevSecOps, AI/ML, hardware & blockchain. Capture the flag, earn XP.

// domain

New to hacking? Start with a Learning Path.

open academy

13 domains·137 labs·6 career tracks·capstone exams·real CVEs

open academy

// filter by

Classic UNION-based SQL Injection

A search endpoint glues user input straight into a SQL query. Extract the admin flag from the `secrets` table.

easy+25xp

webINTERACTIVEeasy+25 XP

Reflected XSS Sandbox

A search endpoint reflects user input straight into the response HTML. Craft a payload that proves you can execute JS.

easy+25xp

1 solvedwebINTERACTIVEeasy+25 XP

Path Traversal

A file-fetch endpoint blocks `..` only at the front. Read the flag stored at `/etc/hc/flag.txt` in the virtual FS.

easy+25xp

webINTERACTIVEeasy+25 XP

Server-Side Request Forgery

A URL-fetch endpoint blocks `localhost`/`127.0.0.1`. Reach the internal admin service anyway.

medium+35xp

1 solvedwebINTERACTIVEmedium+35 XP

Prototype Pollution (JS-style)

A naive JSON deep-merge taints object prototypes. Promote yourself to admin.

medium+40xp

webINTERACTIVEmedium+40 XP

Cross-Site Request Forgery

A money-transfer endpoint checks the Origin header — but only if it's present.

easy+30xp

webINTERACTIVEeasy+30 XP