HackerDNA's cybersecurity labs are hands-on hacking environments that run on real, isolated virtual machines - not simulations. Each lab drops you into a deliberately vulnerable target where you practise web exploitation, privilege escalation, password cracking, network attacks and more, then capture a flag to prove you solved it.
Whether you are preparing for the OSCP, building a career in penetration testing, or learning ethical hacking from scratch, the labs are graded from Very Easy to Hard so you can start where you are and level up. Create a free account to launch your first machine, track your progress and climb the global leaderboard.
Lab
XP
Success Rate
Players
Very Easy
Capture the Flag 101: Find and Submit Your First Flag
Find your first flag, copy it and submit it to score points.
Security Fundamentals
Capture The Flag CTF CTF Basics
Very Easy
Secrets in Source: View Source Code to Find the Flag
Open the page source and find the secret left in a comment.
Web & API Security
View Source Code HTML Browser DevTools
Very Easy
Quick win
Secrets in Source 2: Bypass Security Through Obscurity
Beat the blocks on right-click and dev tools to read the source.
Web & API Security
Client-Side Security Security Through Obscurity Browser DevTools
Very Easy
Hack the Login
Open the browser tools, find what the page checks and log straight in.
Web & API Security
Authentication Bypass Broken Authentication Client-Side Security
Very Easy
Hack the Cookie: Cookie Poisoning Attack
Decode your session cookie, change your role and become the admin.
Web & API Security
Cookie Poisoning Session Tampering Base64 Encoding
Very Easy
Boss
Nmap Commands Lab: Port Scanning to Privilege Escalation
Scan the ports, log into a weak service, and climb to root.
Network & Infrastructure
Nmap Nmap Commands Telnet
Easy
Boss
Infiltrator
Forge a login token, slip inside, and work your way to root.
Web & API Security
JWT Manipulation SSH Exploitation Log Injection
Easy
Include me
Bend a page's file loader into reading files it should not.
Web & API Security
PHP LFI
Easy
Quick win
Anonymous
Log into a file server as a guest and grab what you find.
Network & Infrastructure
FTP
Easy
Spoof!
Fake your IP in a header and walk past the access check.
Network & Infrastructure
IP SPOOFING
Easy
Cronpocalypse
Hijack a job that runs on a timer and climb to root.
Privilege Escalation & Post-Exploitation
SSH
Easy
Password Cracking - Custom Wordlist Attack
Build a wordlist from a target's own pages and crack their file.
Cryptography
Password Cracking Custom Wordlist Wordlist Generation
Easy
Scheduled Sabotage
Log in over SSH, find the job the system runs as root, and hijack it.
Network & Infrastructure
Linux SSH File Enumeration
Easy
Quick win
Packet Pursuit
Open a traffic capture and follow the packets to the secret.
Digital Forensics & IR
Network Analysis Packet Capture Wireshark
Easy
Anonymous 2
Trip the hidden backdoor in an FTP server and get a shell.
Network & Infrastructure
FTP Exploitation Backdoor Detection Network Services
Easy
Boss
FiPloit
Sneak a web shell past the upload filter and run it.
Digital Forensics & IR
Local File Inclusion File Upload Bypass PHP Security
Medium
Boss
SSRF Attack: Steal Cloud Metadata Credentials
Trick the server into fetching cloud keys, then read a secret.
Cloud Security
SSRF Cloud Penetration Testing AWS IMDS
Medium
Reverse Engineering: License Key Crackme
Read the assembly, crack the license check, write a keygen.
Reverse Engineering & Binary Exploitation
Reverse Engineering Binary Analysis Crackme
Medium
Boss
Mythos Leak - Headless CMS Draft Exposure
Dig up a deleted draft, then steal its token to become an admin.
Web & API Security
Web Exploitation Headless CMS API Enumeration
Medium
Pickle Jar
Upload a booby-trapped pickle file, run code on the box, then get root.
Web & API Security
Python Pickle Deserialization RCE
Medium
Quick win
ClearDesk
Swap an ID, read files you should not see, and climb to admin.
Web & API Security
IDOR API Security Path Traversal
Medium
Host Hijack
Forge a header to poison a reset link, then climb to root.
Web & API Security
Host Header Injection Password Reset Poisoning Command Injection
Medium
Hidden CMS Breach
Dig up a forgotten CMS, log in, run code and take over the server.
Web & API Security
Web Enumeration Web Security Authentication
Medium
TechNova Infiltration
Find the exposed mistake, crack a login, and escalate to root.
Web & API Security
Web Enumeration SSH Password Cracking
Medium
Alpwned
Bypass the login with a crafted query, then climb from shell to root.
Web & API Security
SQL Injection Authentication Bypass SSH
Medium
Beyond Echo
Turn a simple PHP page into a way to run commands on the server.
Web & API Security
PHP RCE
Medium
Boss
Query Quake
Break the database with a crafted query and run your own code.
Web & API Security
MYSQLI RCE
Medium
Quick win
Traversed
Dig through a repo's history to recover a deleted file.
Digital Forensics & IR
GIT
Medium
Quick win
Compromised 1
Log in with factory settings, deploy a web shell, then abuse sudo for root.
Web & API Security
Apache Tomcat Web Application Security WAR Deployment
Medium
Boss
AlVault
Find the hidden tool, read a blocked file, and climb to root over SSH.
Web & API Security
WEB
Medium
RCE Playground
Slip past the input filters and run commands on the server.
Web & API Security
Command Injection Input Validation Bypass Remote Code Execution
Medium
Quick win
Matsudo
Scan for SSH, crack a weak password, then abuse sudo to get root.
Network & Infrastructure
SSH Brute Force Privilege Escalation
Hard
Prompt Injection: Jailbreak an AI Assistant
Slip a hidden command into the chat and hijack its replies.
AI Security
Prompt Injection LLM Security AI Red Teaming
Hard
Pwnify - Web Application Penetration Testing
Break into the app, crack the hashes, and get root.
Web & API Security
Web Application Security Mass Assignment Command Injection
Hard
Boss
Hack the Box
Break in through the web app, then overflow a binary for root.
Reverse Engineering & Binary Exploitation
Directory Fuzzing X-Forwarded-For Spoofing Bruteforce
Hard
WP Ultimate
Chain a weak plugin into full admin control of the site.
Web & API Security
WP
Hard
FortiPy
Exploit a template bug in a Python app and crack your way to root.
Web & API Security
Web Application Security SSTI Flask Security
Hard
Broken Chain
Chain several web bugs together to take over the whole system.
Web & API Security
IDOR Exploitation Zip Slip Vulnerability Server-Side Template Injection
Hard
Compromised 2
Reverse the mobile app to find a way into the control system.
Mobile Security
Advanced Reconnaissance Android Reverse Engineering SCADA Exploitation
Hard
Internal
Inject a command for a shell, then abuse a capability for root.
Web & API Security
Command Injection Linux Capabilities Privilege Escalation
Challenge
XOR Reuse
Guess how the message starts and use it to recover the repeating XOR key.
Cryptography
Cryptography XOR Known-Plaintext Attack
Challenge
Token Trust
Grab leaked OAuth secrets and mint yourself an admin token.
Web & API Security
OAuth 2.0 API Security JWT
Challenge
Quick win
Fine Print
Change how the page renders and read the memo hidden in the CSS.
Digital Forensics & IR
CSS Media Queries Web Forensics
Challenge
Phantom Text
Reveal invisible Unicode characters hidden in an ordinary blog post.
Digital Forensics & IR
Unicode Steganography Web Forensics
Challenge
Quick win
Linux Fundamentals Practice
Navigate directories, grep and find your way to hidden files.
Security Fundamentals
Linux Command Line File System Navigation
Challenge
Shadow Cracker
Crack stolen Linux password hashes with a wordlist and recover the logins.
Cryptography
Password Cracking Linux Security John the Ripper
Challenge
Windows Password Cracker
Crack a batch of NTLM password hashes using a wordlist.
Cryptography
Password Cracking Windows Security NTLM
Challenge
Office Password Cracker
Pull the hash from a locked document and crack it offline.
Cryptography
Password Cracking Office Security Hash Extraction
Challenge
Regex Bypass to SQLi
Slip past a weak input filter and pull data with a UNION query.
Web & API Security
SQL Injection Regex Bypass Input Validation
Challenge
Git Exposed
Download the leaked repo and bring deleted files back to life.
Digital Forensics & IR
Git Version Control Source Code Analysis
Challenge
Backup Hunter
Find the backup file a careless admin left lying on the web server.
Web & API Security
Web Enumeration File Discovery Reconnaissance
Challenge
Quick win
Type Juggling Bypass
Exploit loose PHP comparison to log in without a password.
Web & API Security
Web Security PHP Type Juggling
Challenge
Quick win
Crack SHA1 Hash
Feed a hash to a wordlist and recover the password behind it.
Cryptography
Cryptography Hash Cracking Password Analysis
Challenge
Free
SQL Injection Test
Slip SQL into a login form and sign in without knowing the password.
Web & API Security
SQL Injection Web Security Database Security
Challenge
Free
Hack This Site
Unscramble the page JavaScript and find the way past the login.
Reverse Engineering & Binary Exploitation
JavaScript Deobfuscation Client-Side Security
Challenge
Quick win
HTTP Smuggling
Read the captured traffic and spot the request hiding inside another.
Digital Forensics & IR
HTTP Protocol Request Smuggling Network Forensics
Challenge
Email Header Forensics
Read the hidden mail headers and trace where the phish began.
Digital Forensics & IR
Email Forensics Header Analysis Phishing Detection
Challenge
Quick win
SSRF Validator
Trick the server into fetching internal pages its URL filter should block.
Web & API Security
SSRF Web Security URL Manipulation
Challenge
Vigenere Stego Hunt
Find the key hidden in an image, then crack a classic cipher.
Digital Forensics & IR
Cryptography Steganography Classical Ciphers
Challenge
Quick win
Simple Directory Traversal
Climb out of the web folder with ../ and read files you should not see.
Web & API Security
Directory Traversal Path Injection File System Security
Challenge
YAML Bomb
Upload a booby-trapped YAML config and make the parser run your code.
Web & API Security
YAML Deserialization PyYAML Exploitation Configuration Injection
Challenge
Quick win
WebDAV Explorer
Upload your own file to a wide open server and take over.
Web & API Security
WebDAV Exploitation File Upload Directory Traversal
Challenge
Prototype Pollution Hunter
Poison a JavaScript object prototype and grant yourself new powers.
Web & API Security
Prototype Pollution Node.js Security API Security
Challenge
Race Condition Hunter
Fire requests in parallel and spend the same money twice.
Web & API Security
Race Conditions Timing Attacks Concurrent Exploitation
Challenge
Quick win
IDOR Explorer
Change one number in the link and open files that are not yours.
Web & API Security
IDOR Parameter Manipulation Web Application Security
Challenge
Quick win
Header Hijacker
Rewrite your request headers and walk past the access check.
Web & API Security
HTTP Headers Security Bypass Web Application Security
Challenge
Quick win
Corporate Directory Hunt
Dig through hidden folders to find the admin panel.
Web & API Security
Directory Enumeration Web Reconnaissance Administrative Panel Discovery
Challenge
File Include Bypass
Slip past the filter with LFI and read what is locked away.
Web & API Security
Local File Inclusion Filter Bypass Apache Authentication
Challenge
Cookie Forge
Tamper with your session token and log in as the admin.
Web & API Security
JWT Cookie Manipulation Authentication Bypass
Challenge
Button Activator
Open DevTools, wake up the disabled button and grab the flag.
Web & API Security
JavaScript Browser DevTools DOM Manipulation
Challenge
GraphQL Gateway
Ask the API to describe itself, then query what you should not see.
Web & API Security
GraphQL API Security Schema Introspection
Challenge
DNS Tunneling Detective
Spot the covert channel in the traffic and rebuild the stolen data.
Digital Forensics & IR
Network Forensics DNS Analysis Data Exfiltration
Challenge
Caesar Shift Decoder
Shift the alphabet until the scrambled text makes sense again.
Cryptography
Cryptography Classical Ciphers Frequency Analysis
Challenge
Quick win
Registry Hijacker
Bypass the login on a container registry and take over its images.
Cloud Security
Docker Registry API Authentication Bypass Container Security
Challenge
SUID Privilege Hunter
Spot a program with extra powers and ride it up to root.
Privilege Escalation & Post-Exploitation
SUID Binaries Privilege Escalation Command Injection
Challenge
Quick win
MongoDB Injector
Slip a query operator into the login form and skip the password.
Web & API Security
NoSQL Injection MongoDB Authentication Bypass
Challenge
Redis Cache Poisoner
Inject line breaks into a note and send your own commands to the cache.
Web & API Security
CRLF Injection Redis Command Injection Cache Poisoning
Challenge
Quick win
LDAP Injector
Inject an LDAP filter and log in as the admin without a password.
Web & API Security
LDAP Injection Authentication Bypass Directory Services
Challenge
Template Injector
Break a search box and turn its template engine into a shell.
Web & API Security
Server-Side Template Injection Flask Security Jinja2 Exploitation
Challenge
IP Spoofing Admin
Make the portal think you connect from inside and get admin access.
Web & API Security
Web Security HTTP Headers IP Spoofing
Challenge
WEP Cracker
Gather enough wireless packets and let the math reveal the key.
Digital Forensics & IR
Wireless Security WEP Cracking RC4 Analysis
Challenge
Quick win
Registry Hunter
Trace how malware survives reboots on Windows and decode what it hides.
Reverse Engineering & Binary Exploitation
Digital Forensics Windows Registry Persistence Analysis
Challenge
WiFi Password Cracker
Capture the handshake and run a wordlist to crack the WiFi password.
Digital Forensics & IR
WiFi Security WPA Cracking Dictionary Attacks
Challenge
Book Cipher Challenge
Match numbers to words in a text and read the hidden message.
Cryptography
Cryptography Classical Ciphers Pattern Recognition
Challenge
Quick win
Admin Portal Breach
Dig through the page source, crack an MD5 hash, and log in as admin.
Web & API Security
Client-Side Security MD5 Cracking Source Code Analysis
Challenge
Git Secrets Hunter
Dig through old commits until a leaked secret turns up.
Digital Forensics & IR
Git Forensics Version Control Security Repository Analysis
Challenge
Corporate Backup Deserializer
Craft a pickle payload and run your code through a backup import.
Web & API Security
Python Pickle Enterprise Deserialization Corporate Backup Systems
Challenge
ZIP Cracker
Run a wordlist against a locked archive until it opens.
Cryptography
ZIP Password Cracking John the Ripper fcrackzip
Challenge
KeePass Breaker
Brute force a password vault when the usual cracking tools fall short.
Cryptography
KeePass 4.x Security Direct Brute Force Password Manager Assessment
Challenge
Template Injection
Slip code into a template and make the server run it for you.
Web & API Security
Server-Side Template Injection Jinja2 Flask Security
Challenge
PDF Password Cracker
Run a wordlist against a locked PDF until it opens.
Cryptography
PDF Security Password Cracking Dictionary Attacks
Challenge
Shell Command Scanner
Slip your own shell command into a scan tool and read the server files.
Web & API Security
Command Injection Web Security Shell Commands
Challenge
LFI Log Poison
Hide a payload in your user agent, then include the log to execute it.
Digital Forensics & IR
Local File Inclusion User-Agent Log Poisoning Remote Code Execution
Challenge
NoSQL Injection
Twist a database filter with operators to reveal hidden records.
Web & API Security
NoSQL Injection MongoDB Visibility Controls
Challenge
File Upload Bypass
Disguise a web shell as an image and run commands on the server.
Web & API Security
File Upload Web Security Bypass Techniques
Challenge
Quick win
URL Scanner
Trick a URL fetcher into handing you cloud credentials.
Cloud Security
SSRF Server-Side Request Forgery AWS Metadata
Challenge
CSRF Bank Transfer
Build a hidden form and make a victim send money for you.
Web & API Security
CSRF Cross-Site Request Forgery Session Security
Challenge
XSS Playground
Slip a script into the page and steal another user's session.
Web & API Security
XSS Cross-Site Scripting Stored XSS
Challenge
JWT Claims Manipulation
Crack the token secret, rewrite your role and expiry, then sign it again.
Web & API Security
JWT Claims Manipulation Privilege Escalation
Challenge
SQL Injection
Ask the database yes or no questions and rebuild its secrets one by one.
Web & API Security
SQL Injection Database Security Web Security
Challenge
XXE Exposed
Craft an XML entity that makes the server hand over its own files.
Web & API Security
XXE XML Security File Disclosure
Challenge
JWT Algo Confusion
Switch the token algorithm and sign it with the server's public key.
Web & API Security
JWT Algorithm Confusion RS256
Challenge
JWT Bypass
Tweak a login token so the server trusts you without a valid signature.
Web & API Security
JWT Web Security Token Authentication
Challenge
Free
Auth Bypass
Slip a SQL injection into the login form and enter without a password.
Web & API Security
SQL Injection Authentication Bypass Web Security
Challenge
Free
Ping Pwn
Slip a shell command into a ping tool and make the server run it.
Web & API Security
Command Injection Web Exploitation Service Discovery
Challenge
Free
Log Hunter
Search raw HTTP logs for the one request that gives the attacker away.
Digital Forensics & IR
Log Analysis Web Security Incident Response
Challenge
API Logic Flaw
Change one value in a request and slip past the login check of the API.
Web & API Security
API Security Logic Flaw Authentication Bypass
Challenge
Free
Path Traversal
Climb out of the web folder and read files you should never see.
Web & API Security
Path Traversal CGI Web Security
Challenge
Quick win
Flask Error
Trigger a crash and use the debug page to dig out the secret.
Web & API Security
Flask Debug Mode Python
Challenge
Quick win
Rail Fence
Undo a zigzag transposition cipher and read the scrambled message.
Cryptography
Cryptography Transposition Cipher Rail Fence
Challenge
Sonic Cipher
Pull a hidden message from the lowest bits of an audio file.
Digital Forensics & IR
Steganography Audio Analysis LSB
Challenge
Pixel Puzzler
Pull a hidden message out of the lowest bits of an image's pixels.
Digital Forensics & IR
Steganography Image Analysis LSB
Challenge
Quick win
PDF Trap
Dig through a PDF's metadata and hidden layers to find its secret.
Digital Forensics & IR
PDF Forensics File Analysis Metadata
Challenge
Quick win
Blockchain Secrets
Trace a Bitcoin transaction and decode the message stored inside it.
Digital Forensics & IR
Blockchain Analysis Bitcoin OP_RETURN
Challenge
Corporate Breach 2
Bend the file path past the filter and read what is blocked.
Web & API Security
Web Security PHP LFI
Challenge
Corporate Breach
Read a hidden file with LFI, crack the password, and log in.
Web & API Security
Web Security PHP LFI
Challenge
Quick win
DNS Exfil
Read the domain lookups in a capture and decode the stolen data.
Digital Forensics & IR
Network Analysis DNS Packet Analysis
Challenge
Crypto Cipher
Break the old-school code and read the hidden message.
Cryptography
Cryptanalysis Classical Crypto Pattern Recognition
Challenge
Session Switch
Tamper with your session and get the app to treat you as an admin.
Web & API Security
Web Security Session Management Authentication
Challenge
Snapchat Exposed
Find an open build server and make it run your commands for you.
Web & API Security
Jenkins CI/CD DevOps
Challenge
Red is Dead
Find an exposed Redis server and decode the data left inside.
Digital Forensics & IR
Network Reconnaissance Service Discovery Database Forensics
Challenge
Memory Forensics
Carve strings out of a memory dump and undo a ROT13 disguise.
Reverse Engineering & Binary Exploitation
Memory Forensics Binary Analysis Digital Forensics
Challenge
API Breaker
Decode your Base64 token, change your role, and call the API as admin.
Web & API Security
API Security Web Hacking Logic Flaws
Challenge
QR Code Quest
Decode QR codes hidden in images and pull out the secret data.
Digital Forensics & IR
QR Code Analysis Image Analysis Data Extraction
Challenge
Base64 Detective
Dig through the page source and decode the Base64 hiding in plain sight.
Web & API Security
Base64 Web Inspection Browser DevTools
Challenge
Quick win
Binary Secrets
Open the file in a hex editor and read what the bytes are hiding.
Reverse Engineering & Binary Exploitation
Binary Analysis Hex Editors Data Structures
Challenge
Get the Password
Find the hash in the page script and crack it back to a password.
Cryptography
JavaScript MD5 Rainbow Tables
Challenge
Quick win
Stego Hunt
Pull a hidden message out of an ordinary looking image file.
Digital Forensics & IR
Steganography Image Analysis Web
Challenge
Quick win
Hex Hunt
Spot the hex string in the page code and decode it into the flag.
Web & API Security
JavaScript Web Development Hexadecimal
No labs match these filters.
Clear filters
Show more
