WEBLive machineFree
Challenge
Cipher Lounge
A members-only club with a rushed launch left its staging build exposed. Get off the floor, past the velvet rope, and into the keeper's vault.
Medium200 pts 15 min
Rooms
Guided lessons and hands-on challenges with real machines. Read, practise, answer and earn points.
Category
Difficulty
Access
Machine
Type
Featured
New rooms
Penetration TestingLive machinePremium
Lesson + challenge
Launch Day — Premium room
A full boot-to-root against a startup's rushed deploy: a command-injection web foothold, a reused DB password that is also the ops SSH password (lateral move), and a writable root job for the final escalation. Multi-stage, per-instance secrets.
Hard450 pts 75 min
Linux Privilege EscalationLive machineFree
Lesson + challenge
Root of the Problem
You're handed a low-privilege SSH foothold. Enumerate the box, find a world-writable script that a root maintenance job executes on a schedule, hijack it, and escalate to real in-container root to read the flag.
Medium225 pts 40 min
CloudLive machinePremium
Lesson + challenge
The Leaky Tenant — Premium room
A startup's public CDN bucket is a little too public. Enumerate it anonymously, find a backup export that leaks over-privileged access keys, and use them to reach a restricted vault bucket and its flag — all against a real, self-contained S3-compatible store.
Medium275 pts 40 min
CryptographyLive machinePremium
Lesson + challenge
The Padded Room — Premium room
A perfect cipher, broken by one leaked bit. Use an AES-CBC padding oracle to recover a block's intermediate value and forge an 'admin' token (CBC-R) — no key required — then open the vault and read the flag.
Medium300 pts 60 min
All rooms
25 rooms
Penetration TestingLive machinePremium
Lesson + challenge
Launch Day — Premium room
A full boot-to-root against a startup's rushed deploy: a command-injection web foothold, a reused DB password that is also the ops SSH password (lateral move), and a writable root job for the final escalation. Multi-stage, per-instance secrets.
Hard450 pts 75 min
Linux Privilege EscalationLive machineFree
Lesson + challenge
Root of the Problem
You're handed a low-privilege SSH foothold. Enumerate the box, find a world-writable script that a root maintenance job executes on a schedule, hijack it, and escalate to real in-container root to read the flag.
Medium225 pts 40 min
CloudLive machinePremium
Lesson + challenge
The Leaky Tenant — Premium room
A startup's public CDN bucket is a little too public. Enumerate it anonymously, find a backup export that leaks over-privileged access keys, and use them to reach a restricted vault bucket and its flag — all against a real, self-contained S3-compatible store.
Medium275 pts 40 min
CryptographyLive machinePremium
Lesson + challenge
The Padded Room — Premium room
A perfect cipher, broken by one leaked bit. Use an AES-CBC padding oracle to recover a block's intermediate value and forge an 'admin' token (CBC-R) — no key required — then open the vault and read the flag.
Medium300 pts 60 min
Binary ExploitationLive machineFree
Lesson + challenge
Ghost in the Stack
A step up from ret2win: there is no win() function. Use a libc pointer the service leaks to defeat ASLR, then build a ret2libc ROP chain (pop rdi; /bin/sh; system) to pop a shell and read the flag. The binary and its libc are provided.
Medium275 pts 60 min
Binary ExploitationLive machineFree
Lesson + challenge
Return to Sender
The classic first step into binary exploitation: overflow a stack buffer on a tiny TCP service and overwrite the saved return address to call a win() function that prints the flag. The binary is yours to analyse.
Easy150 pts 45 min
OSINT & ReconnaissanceLive machineFree
Lesson + challenge
The Vanishing Intern
A summer intern left NimbusForge Robotics — and left a few things running. Pivot across the company site, the intern's profile, and a photo's metadata to find a service they forgot to switch off.
Medium250 pts 45 min
NetworkingFree
Lesson + challenge
Crossed Wires
A workstation on the finance VLAN uploaded something it shouldn't have. You have the capture. Reassemble the TCP stream, pull the exfiltrated object back off the wire, and read what left the building.
Medium225 pts 40 min
ForensicsFree
Lesson + challenge
The Last Login
A public web host fired an alert for a rogue root cron job. Work a real triage archive — auth logs, shell history, cron drop-ins, SSH keys — rebuild the intrusion timeline, and recover the token the attacker's persistence left behind.
Medium150 pts 40 min
SteganographyFree
Challenge
The Polyglot
A staff ID badge image hides more than it shows. Learn to spot a polyglot file, carve the archive appended to an innocent-looking PNG, and decode what's inside.
Easy125 pts 20 min
MiscLive machineFree
Lesson + challenge
Jail Break-in
A sandbox that runs your Python — as long as it can't tell what you're really doing.
Medium280 pts 35 min
ForensicsLive machineFree
Lesson + challenge
Silent Witness
A quiet web host that started whispering to a stranger — listen to what it left behind.
Medium250 pts 35 min
WEBLive machineFree
Lesson + challenge
GraphQL Labyrinth
A SecOps GraphQL API that maps itself for you — then trusts the wrong resolver.
Medium220 pts 30 min
WEBLive machinePremium
Lesson + challenge
Template Trap — Premium room
A quarterly-report studio with one field too clever — and a firewall that only watches the front door.
Hard350 pts 40 min
WEBLive machinePremium
Lesson + challenge
Deserialized Dreams — Premium room
A dreamy little journaling app with one URL too many — follow the loopback into its unguarded inner life.
Hard400 pts 45 min
WEBLive machineFree
Lesson + challenge
JWT Mirage
Two algorithms, one key — and the verifier cannot tell the difference.
Medium200 pts 30 min
WEBLive machineFree
Lesson + challenge
Broken Ledger
invoice holds an internal reconciliation token you were never meant to see.
Easy150 pts 20 min
ForensicsLive machineFree
Challenge
Memory of a Ghost
The SOC flagged this Linux host after anomalous outbound traffic and pulled it offline for you.
Medium250 pts 30 min
Reverse EngineeringPremium
Challenge
VM Whisperer — Premium room
The flag check doesn't run on your CPU — it runs on a tiny virtual machine hidden inside this binary, executing its own bytecode. Decode the machine's instruction set, lift its program, and make it whisper.
Hard550 pts 75 min
Reverse EngineeringPremium
Challenge
License to Krackle — Premium room
"Krackle Synth v3.1" is nagware — it wants a license key before it hands over your reward. There's exactly one serial it will accept, and it's hiding in plain sight inside the binary. Don't just patch the check; it won't be enough.
Medium300 pts 35 min
NetworkingPremium
Challenge
Exfil Over DNS — Premium room
Our EDR flagged strange DNS from a workstation and grabbed a capture. Something is sneaking data out over the one protocol nobody blocks. Follow the queries and rebuild what left the network.
Medium275 pts 25 min
SteganographyFree
Challenge
Spectrogram Secrets
We intercepted a transmission. Played back it's just hiss — but the sender didn't hide the message in what you hear. Look at it the right way.
Easy100 pts 10 min
ForensicsFree
Challenge
Deleted Diaries
A thumb drive from case 4471. The owner insists it was wiped — but the last diary entry, which hides a deposit-box combination, was only deleted. Recover what was thrown away.
Easy100 pts 20 min
CryptographyFree
Challenge
XOR Café
An intercepted log from the XOR Café, where every secret is "protected" with the same short roast, poured again and again. One regular left a tip under the saucer. message.enc holds the hex ciphertext — recover the plaintext and read what they left behind.
Easy75 pts 15 min