Hacking Labs

Every lab is a real vulnerable machine, started just for you. Break in, find the flag, earn XP.

Start Hacking Free Free account. Nothing to install.

HackerDNA's cybersecurity labs are hands-on hacking environments that run on real, isolated virtual machines - not simulations. Each lab drops you into a deliberately vulnerable target where you practise web exploitation, privilege escalation, password cracking, network attacks and more, then capture a flag to prove you solved it.

Whether you are preparing for the OSCP, building a career in penetration testing, or learning ethical hacking from scratch, the labs are graded from Very Easy to Hard so you can start where you are and level up. Create a free account to launch your first machine, track your progress and climb the global leaderboard.

Start here

Category
Hard

PHP2Shell: Exploit PHP's Upload-Progress Memory Leak (CVE-2026-109618) Leak a live operator session from PHP's own memory, then take over the store.

Web & API Security PHP2ShellCVE-2026-109618Memory Disclosure
+700 XP 67% 6 Terminal Start LabStart
Hard

Prompt Injection: Jailbreak an AI Assistant Slip a hidden command into the chat and hijack its replies.

AI Security Prompt InjectionLLM SecurityAI Red Teaming
+700 XP 84% 19 Terminal Start LabStart
Hard

Pwnify - Web Application Penetration Testing Break into the app, crack the hashes, and get root.

Web & API Security Web Application SecurityMass AssignmentCommand Injection
+700 XP 39% 166 Terminal Start LabStart
Hard Boss

Hack the Box Break in through the web app, then overflow a binary for root.

Reverse Engineering & Binary Exploitation Directory FuzzingX-Forwarded-For SpoofingBruteforce
+700 XP 20% 284 Terminal Start LabStart
Hard

WP Ultimate Chain a weak plugin into full admin control of the site.

Web & API Security WP
+700 XP 37% 163 Terminal Start LabStart
Hard

FortiPy Exploit a template bug in a Python app and crack your way to root.

Web & API Security Web Application SecuritySSTIFlask Security
+700 XP 45% 130 Terminal Start LabStart
Hard

Broken Chain Chain several web bugs together to take over the whole system.

Web & API Security IDOR ExploitationZip Slip VulnerabilityServer-Side Template Injection
+700 XP 21% 164 Terminal Start LabStart
Hard

Compromised 2 Reverse the mobile app to find a way into the control system.

Mobile Security Advanced ReconnaissanceAndroid Reverse EngineeringSCADA Exploitation
+700 XP 42% 60 Terminal Start LabStart
Hard

Internal Inject a command for a shell, then abuse a capability for root.

Web & API Security Command InjectionLinux CapabilitiesPrivilege Escalation
+700 XP 44% 93 Terminal Start LabStart
37,000+ Hackers Real labs Free
Start Hacking Free or solve today's hack, no account needed