Hacking Labs

Every lab is a real vulnerable machine, started just for you. Break in, find the flag, earn XP.

Start Hacking Free Free account. Nothing to install.

HackerDNA's cybersecurity labs are hands-on hacking environments that run on real, isolated virtual machines - not simulations. Each lab drops you into a deliberately vulnerable target where you practise web exploitation, privilege escalation, password cracking, network attacks and more, then capture a flag to prove you solved it.

Whether you are preparing for the OSCP, building a career in penetration testing, or learning ethical hacking from scratch, the labs are graded from Very Easy to Hard so you can start where you are and level up. Create a free account to launch your first machine, track your progress and climb the global leaderboard.

Start here

Category
Hard

Prompt Injection: Jailbreak an AI Assistant Slip a hidden command into the chat and hijack its replies.

AI Security Prompt InjectionLLM SecurityAI Red Teaming
+700 XP 82% 17 Terminal Start LabStart
Hard

Pwnify - Web Application Penetration Testing Break into the app, crack the hashes, and get root.

Web & API Security Web Application SecurityMass AssignmentCommand Injection
+700 XP 38% 148 Terminal Start LabStart
Hard Boss

Hack the Box Break in through the web app, then overflow a binary for root.

Reverse Engineering & Binary Exploitation Directory FuzzingX-Forwarded-For SpoofingBruteforce
+700 XP 19% 266 Terminal Start LabStart
Hard

WP Ultimate Chain a weak plugin into full admin control of the site.

Web & API Security WP
+700 XP 34% 152 Terminal Start LabStart
Hard

FortiPy Exploit a template bug in a Python app and crack your way to root.

Web & API Security Web Application SecuritySSTIFlask Security
+700 XP 45% 130 Terminal Start LabStart
Hard

Broken Chain Chain several web bugs together to take over the whole system.

Web & API Security IDOR ExploitationZip Slip VulnerabilityServer-Side Template Injection
+700 XP 21% 164 Terminal Start LabStart
Hard

Compromised 2 Reverse the mobile app to find a way into the control system.

Mobile Security Advanced ReconnaissanceAndroid Reverse EngineeringSCADA Exploitation
+700 XP 42% 60 Terminal Start LabStart
Hard

Internal Inject a command for a shell, then abuse a capability for root.

Web & API Security Command InjectionLinux CapabilitiesPrivilege Escalation
+700 XP 44% 93 Terminal Start LabStart
34,000+ Hackers Real labs Free
Start Hacking Free or solve today's hack, no account needed