Hacks - bite-sized hacking challenges

How Hacks work

1
A new one every day A fresh Hack goes live every day at 00:00 UTC. Solve it the day it drops to keep your streak alive.
2
Solved in minutes, in your browser No VM and no setup - each one is a self-contained puzzle you crack right here on the page.
3
Earn XP across every skill Every Hack rewards XP and drills a different skill - web, crypto, forensics and more. Build a streak and climb the ranks.

Hacks are bite-sized, hands-on hacking challenges built to sharpen one skill at a time. Each is a self-contained puzzle - crack a password, decode a cipher, spot the flaw in a request - solved right in your browser in a couple of minutes, with no setup and no virtual machine to spin up.

A brand-new Hack is released every day, and the full library stays open so you can practice at your own pace. Solve them to earn XP, keep a daily streak going, and cover the whole spectrum of offensive security - web, cryptography, forensics, OSINT and more.

49 Hacks

0 Categories

Every Hack so far

2026-06

2026-07

2026-08

All Hacks

#49 Today SSRF the cloud metadata Cloud Security ~5 min Play #48 Aug 03 Loot the instance role Cloud Security ~7 min Write-up #47 Aug 02 Same handle everywhere OSINT ~3 min Write-up #46 Aug 01 CloudTrail anomaly Cloud Security ~7 min Write-up #45 Jul 31 Vigenere then base64 Cryptography ~5 min Write-up #44 Jul 30 Read the JWT claim Mobile Security ~3 min Write-up #43 Jul 29 Find the hardcoded API key Mobile Security ~5 min Write-up #42 Jul 28 The GPG blob Cryptography ~5 min Write-up #41 Jul 27 Hex back to text Security Fundamentals ~3 min Write-up #40 Jul 26 The hidden link Security Fundamentals ~2 min Write-up #39 Jul 25 Flip the debug flag AI Security ~3 min Write-up #38 Jul 24 Read the shell history Privilege Escalation & Post-Exploitation ~3 min Write-up #37 Jul 23 Geolocate the photo OSINT ~3 min Write-up #36 Jul 22 Trace the port scan Network & Infrastructure ~5 min Write-up #35 Jul 21 Unwrap the C2 beacon Network & Infrastructure ~7 min Write-up #34 Jul 20 Forge the tier AI Security ~5 min Write-up #33 Jul 19 Extract the XOR key Reverse Engineering & Binary Exploitation ~5 min Write-up #32 Jul 18 The DEX header Mobile Security ~5 min Write-up #31 Jul 17 The hidden system prompt AI Security ~3 min Write-up #30 Jul 16 Unshift the letters Security Fundamentals ~2 min Write-up #29 Jul 15 Mass assign yourself admin Privilege Escalation & Post-Exploitation ~3 min Write-up #28 Jul 14 Pivot three hops to the vault Network & Infrastructure ~10 min Write-up #27 Jul 13 Dox the domain owner OSINT ~5 min Write-up #26 Jul 12 Spot the exfil Digital Forensics & IR ~3 min Write-up #25 Jul 11 Decode the calldata Cryptocurrency & Blockchain Security ~7 min Write-up #24 Jul 10 The none algorithm Web & API Security ~5 min Write-up #23 Jul 09 Find the SQL injection sink Web & API Security ~3 min Write-up #22 Jul 08 ZIP in disguise Digital Forensics & IR ~5 min Write-up #21 Jul 07 The comment leak Web & API Security ~3 min Write-up #20 Jul 06 One tap of base64 Reverse Engineering & Binary Exploitation ~2 min Write-up #19 Jul 05 Pay your own price Web & API Security ~3 min Write-up #18 Jul 04 Leak the app admin token Web & API Security ~5 min Write-up #17 Jul 03 Check the history Privilege Escalation & Post-Exploitation ~3 min Write-up #16 Jul 02 Trace the phish OSINT ~3 min Write-up #15 Jul 01 Find the break-in Digital Forensics & IR ~3 min Write-up #14 Jun 30 Two-layer classic Cryptography ~3 min Write-up #13 Jun 29 Unwrap the config blob Reverse Engineering & Binary Exploitation ~3 min Write-up #12 Jun 28 Tamper the token Web & API Security ~3 min Write-up #11 Jun 27 Find the RCE sink Web & API Security ~3 min Write-up #10 Jun 26 Pivot to the database Network & Infrastructure ~10 min Write-up #9 Jun 25 Find the hidden admin page Security Fundamentals ~2 min Write-up #8 Jun 24 Forge the admin role Privilege Escalation & Post-Exploitation ~3 min Write-up #7 Jun 23 Reach the internal service Web & API Security ~7 min Write-up #6 Jun 22 Crack the reset token Cryptography ~3 min Write-up #5 Jun 21 Tamper the invoice ID Web & API Security ~1 min Write-up #4 Jun 20 What file is this, really? Digital Forensics & IR ~1 min Write-up #3 Jun 19 Peel the encoding Cryptography ~3 min Write-up #2 Jun 18 Spot the leak in the page Security Fundamentals ~1 min Write-up #1 Jun 17 Find the database password Privilege Escalation & Post-Exploitation ~3 min Write-up