Search

Preparation

Understand the Preparation phase of the Incident Response lifecycle.

easy

Cache Me Outside

Can you find this ex hacker turned outdoorsman?

medium

Free Challenge

Traffic Analysis Pitfalls

Learn about Visibility, Context, and Gaps in the traffic Analysis.

medium

SQL Injection Introduction

Learn how to detect and exploit SQL Injection vulnerabilities.

easy

Intro to Detection Engineering

Learn what Detection Engineering is, how it works in a SOC, and the mindset required to build effective detections.

easy

CVE-2026-42945: Nginx Rift

Exploit NGINX Rift, an unauthenticated heap overflow RCE in NGINX's rewrite module since 2008.

easy

CVE-2026-46300: Fragnesia

Exploit Fragnesia, an LPE that surfaced due to dirtyfrag's patch.

easy

DevSecOps Basics

Learn about the story of DevSecOps, Software Development Models & Shifting Left.

medium

Forward

Now is the time to move forward in this AD challenge.

medium

Silent Monitor

Enumerate a running internal service, exploit a vulnerable web application, pivot through the system, and crack your way to root.

medium

Windows Jump

Use privilege escalation knowledge to jump from a guest user to SYSTEM.

medium

Operation Coldstart

Wake up the staging server everyone left behind.

easy

Operation Promotion

One engagement stands between you and your next title.

easy

Domino

Chain together vulnerabilities in a cascading attack, where every piece you find knocks over the next.

medium

LLM Pentesting

Learn to identify, fingerprint, and exploit LLM components during a penetration test engagement.

medium

Content Discovery

Discover hidden web content using manual techniques, OSINT, and Gobuster enumeration.

easy

Intro to AD Lateral Movement

Explore AD lateral movement and pivoting using PsExec, WinRM, PtH, and SSH tunnels.

medium

Threat Modeling for Pentesters

Learn about the different frameworks for threat modeling.

medium

Modern Web Stacks

Four web stacks, four CVEs: fingerprint MERN, Next.js, Django, and LAMP, then exploit each one.

easy

Exploitation and Weaponisation

Learn to exploit vulnerabilities, weaponise findings, and demonstrate real-world impact.

easy

Cloud Security Fundamentals

Learn cloud security fundamentals and walk a guided, cloud-agnostic attack chain end to end.

easy

Broken Authentication

Learn how to defeat logins and other authentication mechanisms to allow you access to unpermitted areas.

easy

Web Server Attacks - II

Attack IIS through fingerprinting, tilde enumeration, WebDAV shell upload, and learn automation.

medium

Re-Testing

Verify vulnerability remediations, spot incomplete fixes, and produce re-test reports for auditors.

medium