HackerDNA's cybersecurity labs are hands-on hacking environments that run on real, isolated virtual machines - not simulations. Each lab drops you into a deliberately vulnerable target where you practise web exploitation, privilege escalation, password cracking, network attacks and more, then capture a flag to prove you solved it.
Whether you are preparing for the OSCP, building a career in penetration testing, or learning ethical hacking from scratch, the labs are graded from Very Easy to Hard so you can start where you are and level up. Create a free account to launch your first machine, track your progress and climb the global leaderboard.
Lab
XP
Success Rate
Players
Medium
Boss
SSRF Attack: Steal Cloud Metadata Credentials
Trick the server into fetching cloud keys, then read a secret.
Cloud Security
SSRF Cloud Penetration Testing AWS IMDS
Medium
Reverse Engineering: License Key Crackme
Read the assembly, crack the license check, write a keygen.
Reverse Engineering & Binary Exploitation
Reverse Engineering Binary Analysis Crackme
Medium
Boss
Mythos Leak - Headless CMS Draft Exposure
Dig up a deleted draft, then steal its token to become an admin.
Web & API Security
Web Exploitation Headless CMS API Enumeration
Medium
Pickle Jar
Upload a booby-trapped pickle file, run code on the box, then get root.
Web & API Security
Python Pickle Deserialization RCE
Medium
Quick win
ClearDesk
Swap an ID, read files you should not see, and climb to admin.
Web & API Security
IDOR API Security Path Traversal
Medium
Host Hijack
Forge a header to poison a reset link, then climb to root.
Web & API Security
Host Header Injection Password Reset Poisoning Command Injection
Medium
Hidden CMS Breach
Dig up a forgotten CMS, log in, run code and take over the server.
Web & API Security
Web Enumeration Web Security Authentication
Medium
TechNova Infiltration
Find the exposed mistake, crack a login, and escalate to root.
Web & API Security
Web Enumeration SSH Password Cracking
Medium
Alpwned
Bypass the login with a crafted query, then climb from shell to root.
Web & API Security
SQL Injection Authentication Bypass SSH
Medium
Beyond Echo
Turn a simple PHP page into a way to run commands on the server.
Web & API Security
PHP RCE
Medium
Boss
Query Quake
Break the database with a crafted query and run your own code.
Web & API Security
MYSQLI RCE
Medium
Quick win
Traversed
Dig through a repo's history to recover a deleted file.
Digital Forensics & IR
GIT
Medium
Quick win
Compromised 1
Log in with factory settings, deploy a web shell, then abuse sudo for root.
Web & API Security
Apache Tomcat Web Application Security WAR Deployment
Medium
Boss
AlVault
Find the hidden tool, read a blocked file, and climb to root over SSH.
Web & API Security
WEB
Medium
RCE Playground
Slip past the input filters and run commands on the server.
Web & API Security
Command Injection Input Validation Bypass Remote Code Execution
Medium
Quick win
Matsudo
Scan for SSH, crack a weak password, then abuse sudo to get root.
Network & Infrastructure
SSH Brute Force Privilege Escalation
No labs match these filters.
Clear filters
Show more
