Malekith Online
✦ Legend ✦
Live Ranking
#3
Best: #2
Total Points
912
Total Earned
Labs Completed
108
110 User • 15 Root
Modules
37
Validated
First Bloods
15
First to Complete
Best Streak
69
Days
Skills Acquired
Technical skills practiced through completed labs
Password CrackingOffice SecurityHash ExtractionJohn the RipperHashcatSQL InjectionRegex BypassInput ValidationWeb Application SecuritySQLiteUNION-Based SQLiGitVersion ControlSource Code AnalysisReconnaissanceWeb SecurityWeb EnumerationFile DiscoveryInformation GatheringPHPType JugglingAuthentication BypassHash AnalysisCryptographyHash CrackingPassword AnalysisSecurity ToolsDatabase SecurityPenetration TestingJavaScriptDeobfuscationClient-Side SecurityBrowser DevToolsCode AnalysisHTTP ProtocolRequest SmugglingNetwork ForensicsTraffic AnalysisPacket AnalysisEmail ForensicsHeader AnalysisPhishing DetectionBase64 DecodingOSINTDigital InvestigationSSRFURL ManipulationInternal Network AccessProtocol BypassSSTIFlask SecuritySSH Brute ForceDatabase EnumerationPrivilege EscalationSteganographyClassical CiphersImage AnalysisPolyalphabetic CiphersDirectory TraversalPath InjectionFile System SecurityPath ManipulationFile AccessYAML DeserializationPyYAML ExploitationConfiguration InjectionPython SecurityUnsafe DeserializationRemote Code ExecutionFile Processing SecurityWebDAV ExploitationFile UploadRemote File AccessHTTP MethodsWeb Server SecurityFile System EnumerationPrototype PollutionNode.js SecurityAPI SecurityJavaScript ExploitationObject ManipulationInput Validation BypassModern Web VulnerabilitiesRace ConditionsTiming AttacksConcurrent ExploitationIDORParameter ManipulationAuthorization BypassHTTP HeadersSecurity BypassClient-Side ManipulationDirectory EnumerationWeb ReconnaissanceAdministrative Panel DiscoverySecurity AssessmentLocal File InclusionFilter BypassApache AuthenticationJWTCookie ManipulationDOM ManipulationGraphQLSchema IntrospectionInjectionDNS AnalysisData ExfiltrationFrequency AnalysisPattern RecognitionDocker Registry APIContainer SecurityAPI ManipulationRegistry ExploitationSUID BinariesCommand InjectionLinux SecurityBinary ExploitationNoSQL InjectionMongoDBDocument DatabasesCRLF InjectionRedis Command InjectionCache PoisoningProtocol ManipulationLDAP InjectionDirectory ServicesEnterprise SecurityFilter EvasionJWT ManipulationSSH ExploitationLog InjectionServer-Side Template InjectionJinja2 ExploitationIP SpoofingAccess Control BypassWireless SecurityWEP CrackingRC4 AnalysisCryptographic AttacksLegacy Protocol ExploitationDigital ForensicsWindows RegistryPersistence AnalysisIncident ResponseMalware AnalysisWiFi SecurityWPA CrackingDictionary AttacksWireless Penetration TestingNetwork SecurityHistorical CryptanalysisMD5 CrackingPassword AttacksGit ForensicsVersion Control SecurityRepository AnalysisSecret RecoveryPython PickleEnterprise DeserializationCorporate Backup SystemsDisaster Recovery ExploitationConfiguration Import AttacksZIP Password CrackingfcrackzipBrute ForceArchive SecurityKeePass 4.x SecurityDirect Brute ForcePassword Manager AssessmentModern CryptographySecurity Tool LimitationsJinja2Web Application TestingCode InjectionPDF SecurityDocument SecurityBrute Force AttacksShell CommandsSystem AdministrationHTTP Parameter ManipulationWPUser-Agent Log PoisoningApache SecurityLog AnalysisAdvanced ReconnaissanceAndroid Reverse EngineeringSCADA ExploitationCVE ExploitationIDOR ExploitationZip Slip VulnerabilityInternal Service DiscoveryBackup Service ExploitationSudo Vim ExploitationVisibility ControlsSecurity TestingOperator ExploitationWeb HackingLogic FlawsToken ManipulationBase64 EncodingMemory ForensicsBinary AnalysisTool UsageData RecoveryROT13 EncodingJenkinsCI/CDDevOpsPentestAutomationPath TraversalCGILogic FlawAudio AnalysisLSBForensicsPythonBypass TechniquesWeb ShellsSocial EngineeringPost ExploitationLinux CapabilitiesReverse ShellSystem EnumerationNetwork ReconnaissanceServer-Side Request ForgeryAWS MetadataCloud SecurityIAM CredentialsAWS EC2MYSQLIRCESSHLinux Privilege EscalationFile PermissionsCSRFCross-Site Request ForgerySession SecurityForm SecurityHTTP SecurityState ManagementXSSCross-Site ScriptingStored XSSSession HijackingClaims ManipulationTime-Based AttacksSignature CrackingBlind SQLiTime-based SQLiBoolean-based SQLiVulnerability AssessmentLinuxSudoApache TomcatWAR DeploymentDefault CredentialsXXEXML SecurityFile DisclosureExternal EntityAlgorithm ConfusionRS256HS256Token ForgeryToken AuthenticationWeb ExploitationService DiscoveryCommand Line ToolsAttack DetectionFlaskDebug ModeMemory AnalysisTransposition CipherRail FencePDF ForensicsFile AnalysisMetadataHidden DataForensic ToolsBlockchain AnalysisBitcoinOP_RETURNHex DecodingData ExtractionForensic AnalysisLFIFile InclusionNetwork AnalysisDNSCryptanalysisClassical CryptoData EncodingSession ManagementAuthenticationDatabase ForensicsCLI UsageBase64Hex EncodingRedisQR Code AnalysisWEBWeb InspectionHTML AnalysisHex EditorsData StructuresReverse EngineeringMD5Rainbow TablesWeb DevelopmentPacket CaptureWiresharkProtocol AnalysisWebCTF BasicsHexadecimalFile Upload BypassPHP SecurityWeb Shell ExploitationGITFTP ExploitationBackdoor DetectionNetwork ServicesRemote ShellSystem ExploitationIP SPOOFINGFTPTELNETLearning PathNetworkingCommand LineWeb ServicesHTMLJS
Completed Modules
Educational modules successfully validated
Nmap Mastery: Dominate Network Scanning
4 modulesInstalling Nmap
Advanced Techniques
Introduction to Nmap
Essential Nmap Scanning
HTTP Header Manipulation: IP Spoofing
3 modulesRemediate
Techniques for IP Spoofing in HTTP Headers
Manipulating Headers
Password Cracking: Advanced Techniques for Security Assessment
6 modulesRainbow Tables and Precomputed Attacks
PDF Password Cracking and Document Security
ZIP Archive Password Recovery
Brute Force and Hybrid Attack Techniques
Password Security Fundamentals
Dictionary Attacks and Wordlist Optimization
HDNA Ethical Hacking Course
5 modules1. Legal & Compliance
2. Network Protocols and Security
4. Network Scanning
3. Reconnaissance
Course Summary
Web Application Security: Exploitation and Defense
12 modulesCross-Site Request Forgery
XML External Entity Injection
Server-Side Request Forgery
Local and Remote File Inclusion
Course Introduction
Server-Side Template Injection
Deserialization Attacks
File Upload Exploitation
Cross-Site Scripting
Authentication Bypass
SQL Injection
Command Injection
JWT Ethical Hacking: Token Takeover Tactics
4 modulesIntroduction to JWT Tokens
Claims Manipulation and Time-Based Attacks
Secret Key Brute Forcing
Algorithm Confusion Exploits
Remote Code Execution (RCE)
3 modulesShellshock (CVE-2014-6271)
RCE: Introduction
RCE in PHP
Completed Labs & Challenges
Hands-on cybersecurity challenges successfully completed
Office Password Cracker
Challenge
Password CrackingOffice SecurityHash ExtractionJohn the RipperHashcat
Regex Bypass to SQLi
Challenge
SQL InjectionRegex BypassInput ValidationWeb Application SecuritySQLiteUNION-Based SQLi
Git Exposed
Challenge
GitVersion ControlSource Code AnalysisReconnaissanceWeb Security
Backup Hunter
Challenge
Web EnumerationFile DiscoveryReconnaissanceInformation Gathering
Type Juggling Bypass
Challenge
Web SecurityPHPType JugglingAuthentication BypassHash Analysis
Crack SHA1 Hash
Challenge
CryptographyHash CrackingPassword AnalysisSecurity Tools
SQL Injection Test
Challenge
SQL InjectionWeb SecurityDatabase SecurityAuthentication BypassInput ValidationPenetration Testing
Hack This Site
Challenge
JavaScriptDeobfuscationClient-Side SecurityBrowser DevToolsCode AnalysisAuthentication Bypass
HTTP Smuggling
Challenge
HTTP ProtocolRequest SmugglingNetwork ForensicsTraffic AnalysisWeb SecurityPacket Analysis
Email Header Forensics
Challenge
Email ForensicsHeader AnalysisPhishing DetectionBase64 DecodingOSINTDigital Investigation
SSRF Validator
Challenge
SSRFWeb SecurityURL ManipulationInternal Network AccessProtocol Bypass
FortiPy
Hard
Web Application SecuritySSTIFlask SecuritySSH Brute ForceDatabase EnumerationHash CrackingPrivilege Escalation
Vigenere Stego Hunt
Challenge
CryptographySteganographyClassical CiphersImage AnalysisPolyalphabetic Ciphers
Simple Directory Traversal
Challenge
Directory TraversalPath InjectionFile System SecurityWeb SecurityInput ValidationPath ManipulationFile Access
YAML Bomb
Challenge
YAML DeserializationPyYAML ExploitationConfiguration InjectionPython SecurityUnsafe DeserializationRemote Code ExecutionFile Processing Security
WebDAV Explorer
Challenge
WebDAV ExploitationFile UploadDirectory TraversalRemote File AccessHTTP MethodsWeb Server SecurityFile System Enumeration
Prototype Pollution Hunter
Challenge
Prototype PollutionNode.js SecurityAPI SecurityJavaScript ExploitationObject ManipulationInput Validation BypassModern Web Vulnerabilities
Race Condition Hunter
Challenge
Race ConditionsTiming AttacksConcurrent ExploitationWeb Application Security
IDOR Explorer
Challenge
IDORParameter ManipulationWeb Application SecurityAuthorization Bypass
Header Hijacker
Challenge
HTTP HeadersSecurity BypassWeb Application SecurityClient-Side Manipulation
Corporate Directory Hunt
Challenge
Directory EnumerationWeb ReconnaissanceAdministrative Panel DiscoverySecurity Assessment
File Include Bypass
Challenge
Local File InclusionFilter BypassApache AuthenticationPassword Cracking
Cookie Forge
Challenge
JWTCookie ManipulationAuthentication BypassPrivilege Escalation
Button Activator
Challenge
JavaScriptBrowser DevToolsDOM ManipulationClient-Side Security
GraphQL Gateway
Challenge
GraphQLAPI SecuritySchema IntrospectionAuthorization BypassInjection
DNS Tunneling Detective
Challenge
Network ForensicsDNS AnalysisData ExfiltrationTraffic Analysis
Caesar Shift Decoder
Challenge
CryptographyClassical CiphersFrequency AnalysisPattern Recognition
Registry Hijacker
Challenge
Docker Registry APIAuthentication BypassContainer SecurityAPI ManipulationRegistry Exploitation
SUID Privilege Hunter
Challenge
SUID BinariesPrivilege EscalationCommand InjectionLinux SecurityBinary Exploitation
MongoDB Injector
Challenge
NoSQL InjectionMongoDBAuthentication BypassDocument DatabasesWeb Security
Redis Cache Poisoner
Challenge
CRLF InjectionRedis Command InjectionCache PoisoningProtocol ManipulationWeb Security
LDAP Injector
Challenge
LDAP InjectionAuthentication BypassDirectory ServicesEnterprise SecurityWeb Security
RCE Playground
Medium
Command InjectionInput Validation BypassRemote Code ExecutionFilter EvasionWeb Security
Infiltrator
Easy
JWT ManipulationSSH ExploitationLog InjectionPrivilege EscalationWeb SecurityLinux Security
Template Injector
Challenge
Server-Side Template InjectionFlask SecurityJinja2 ExploitationRemote Code ExecutionWeb Security
IP Spoofing Admin
Challenge
Web SecurityHTTP HeadersIP SpoofingAccess Control BypassInformation Gathering
WEP Cracker
Challenge
Wireless SecurityWEP CrackingRC4 AnalysisPacket AnalysisCryptographic AttacksLegacy Protocol Exploitation
Registry Hunter
Challenge
Digital ForensicsWindows RegistryPersistence AnalysisBase64 DecodingIncident ResponseMalware Analysis
WiFi Password Cracker
Challenge
WiFi SecurityWPA CrackingDictionary AttacksWireless Penetration TestingNetwork SecurityPacket Analysis
Book Cipher Challenge
Challenge
CryptographyClassical CiphersPattern RecognitionHistorical Cryptanalysis
Admin Portal Breach
Challenge
Client-Side SecurityMD5 CrackingSource Code AnalysisWeb Application SecurityPassword AttacksAuthentication Bypass
Git Secrets Hunter
Challenge
Git ForensicsVersion Control SecurityRepository AnalysisPenetration TestingSecret RecoveryOSINT
Corporate Backup Deserializer
Challenge
Python PickleEnterprise DeserializationCorporate Backup SystemsDisaster Recovery ExploitationConfiguration Import AttacksEnterprise Security
ZIP Cracker
Challenge
ZIP Password CrackingJohn the RipperfcrackzipDictionary AttacksBrute ForceArchive Security
KeePass Breaker
Challenge
KeePass 4.x SecurityDirect Brute ForcePassword Manager AssessmentModern CryptographySecurity Tool Limitations
Template Injection
Challenge
Server-Side Template InjectionJinja2Flask SecurityWeb Application TestingCode InjectionPrivilege Escalation
PDF Password Cracker
Challenge
PDF SecurityPassword CrackingDictionary AttacksDigital ForensicsDocument SecurityBrute Force Attacks
Shell Command Scanner
Challenge
Command InjectionWeb SecurityShell CommandsSystem AdministrationHTTP Parameter ManipulationSecurity Assessment
WP Ultimate
Hard
WP
LFI Log Poison
Challenge
Local File InclusionUser-Agent Log PoisoningRemote Code ExecutionDirectory TraversalWeb SecurityApache SecuritySystem AdministrationLog Analysis
Compromised 2
Hard
Advanced ReconnaissanceAndroid Reverse EngineeringSCADA ExploitationCVE ExploitationAuthentication BypassPrivilege Escalation
Broken Chain
Hard
IDOR ExploitationZip Slip VulnerabilityServer-Side Template InjectionInternal Service DiscoveryBackup Service ExploitationPrivilege EscalationSudo Vim Exploitation
NoSQL Injection
Challenge
NoSQL InjectionMongoDBVisibility ControlsAccess Control BypassSecurity TestingOperator Exploitation
API Breaker
Challenge
API SecurityWeb HackingLogic FlawsPrivilege EscalationToken ManipulationBase64 EncodingAuthorization Bypass
Memory Forensics
Challenge
Memory ForensicsBinary AnalysisDigital ForensicsPattern RecognitionIncident ResponseTool UsageData RecoveryROT13 Encoding
Snapchat Exposed
Challenge
JenkinsCI/CDDevOpsWeb SecurityPentestAutomation
Path Traversal
Challenge
Path TraversalCGIWeb SecurityFile AccessDirectory TraversalInput Validation
API Logic Flaw
Challenge
API SecurityLogic FlawAuthentication BypassParameter ManipulationPHPWeb Security
Sonic Cipher
Challenge
SteganographyAudio AnalysisLSBForensicsPython
File Upload Bypass
Challenge
File UploadWeb SecurityBypass TechniquesPHPWeb ShellsInput ValidationSocial EngineeringPost Exploitation
Internal
Hard
Command InjectionLinux CapabilitiesPrivilege EscalationReverse ShellWeb Application SecuritySystem EnumerationNetwork Reconnaissance
URL Scanner
Challenge
SSRFServer-Side Request ForgeryAWS MetadataCloud SecurityIAM CredentialsNetwork SecurityWeb SecurityAWS EC2
Query Quake
Medium
MYSQLIRCE
Alpwned
Medium
SQL InjectionAuthentication BypassSSHLinux Privilege EscalationFile PermissionsWeb Application Security
CSRF Bank Transfer
Challenge
CSRFCross-Site Request ForgerySession SecurityWeb SecuritySocial EngineeringForm SecurityHTTP SecurityState Management
XSS Playground
Challenge
XSSCross-Site ScriptingStored XSSSession HijackingJavaScriptWeb SecurityClient-Side SecurityDOM Manipulation
JWT Claims Manipulation
Challenge
JWTClaims ManipulationPrivilege EscalationAuthentication BypassTime-Based AttacksSignature Cracking
SQL Injection
Challenge
SQL InjectionDatabase SecurityWeb SecurityBlind SQLiTime-based SQLiBoolean-based SQLiDatabase EnumerationVulnerability Assessment
Matsudo
Medium
SSHBrute ForcePrivilege EscalationLinuxSudoNetwork ReconnaissancePenetration Testing
Compromised 1
Medium
Apache TomcatWeb Application SecurityWAR DeploymentDefault CredentialsPrivilege EscalationLinuxSudoWeb Shells
XXE Exposed
Challenge
XXEXML SecurityFile DisclosureExternal EntityWeb SecurityVulnerability Assessment
JWT Algo Confusion
Challenge
JWTAlgorithm ConfusionRS256HS256Token ForgeryWeb Security
JWT Bypass
Challenge
JWTWeb SecurityToken AuthenticationCryptography
Beyond Echo
Medium
PHPRCE
Auth Bypass
Challenge
SQL InjectionAuthentication BypassWeb SecurityDatabase Security
Ping Pwn
Challenge
Command InjectionWeb ExploitationService DiscoveryNetwork Security
Log Hunter
Challenge
Log AnalysisWeb SecurityIncident ResponsePattern RecognitionFile DiscoveryCommand Line ToolsForensicsHTTP ProtocolAttack DetectionSecurity Assessment
Flask Error
Challenge
FlaskDebug ModePythonWeb SecurityMemory Analysis
Rail Fence
Challenge
CryptographyTransposition CipherRail FencePattern RecognitionPython
Pixel Puzzler
Challenge
SteganographyImage AnalysisLSBForensicsPython
PDF Trap
Challenge
PDF ForensicsFile AnalysisMetadataHidden DataForensic Tools
Blockchain Secrets
Challenge
Blockchain AnalysisBitcoinOP_RETURNHex DecodingData ExtractionForensic Analysis
Corporate Breach 2
Challenge
Web SecurityPHPLFIPath ManipulationFile Inclusion
Corporate Breach
Challenge
Web SecurityPHPLFIPassword CrackingAuthentication BypassDirectory Traversal
DNS Exfil
Challenge
Network AnalysisDNSPacket AnalysisData ExfiltrationBase64 Decoding
Crypto Cipher
Challenge
CryptanalysisClassical CryptoPattern RecognitionData Encoding
Session Switch
Challenge
Web SecuritySession ManagementAuthenticationPrivilege EscalationPHP
Red is Dead
Challenge
Network ReconnaissanceService DiscoveryDatabase ForensicsData EncodingCLI UsageData RecoveryIncident ResponseBase64Hex EncodingRedis
QR Code Quest
Challenge
QR Code AnalysisImage AnalysisData ExtractionSteganographyDigital Forensics
AlVault
Medium
WEB
Base64 Detective
Challenge
Base64Web InspectionBrowser DevToolsData EncodingHTML Analysis
Binary Secrets
Challenge
Binary AnalysisHex EditorsData StructuresReverse EngineeringFile Analysis
Get the Password
Challenge
JavaScriptMD5Rainbow TablesWeb DevelopmentBrowser DevTools
Packet Pursuit
Challenge
Network AnalysisPacket CaptureWiresharkProtocol Analysis
Stego Hunt
Challenge
SteganographyImage AnalysisWebCTF Basics
Hex Hunt
Challenge
JavaScriptWeb DevelopmentHexadecimalBrowser DevTools
FiPloit
Easy
Local File InclusionFile Upload BypassPHP SecurityDirectory TraversalWeb Shell ExploitationPrivilege EscalationLog Analysis
Traversed
Medium
GIT
Cronpocalypse
Easy
SSH
Anonymous 2
Easy
FTP ExploitationBackdoor DetectionNetwork ServicesRemote ShellSystem Exploitation
Spoof!
Easy
IP SPOOFING
Anonymous
Easy
FTP
Include me
Easy
PHPLFI
Nmap Lab 102
Very Easy
TELNETLearning Path
Hack the Cookie
Very Easy
WEBLearning Path
Learning Lab 101
Very Easy
NetworkingReconnaissanceCommand LineWeb ServicesLearning Path
Secrets in Source
Very Easy
HTMLLearning Path
Hack the Login
Very Easy
JSLearning Path
Courses Progress
Your learning paths and modules