Description: This lab showcases a PHP backdoor which allows RCE. Phase 1: Recon ❯ sudo nmap -T4 -A -p80 10.48.160.174 PORT STATE SERVICE VERSION 80/tcp open http ...

SUMMARY: Corridor is a web based, IDOR lab where initial recon on the website shows an interactive corridor and the corrosponding hashes to each door. There are 13 doors in total with the first has...

“Hack into a Mr. Robot themed Windows machine. Use metasploit for initial access, utilise powershell for Windows privilege escalation enumeration and learn a new technique to get Administrator acce...

This challenge revolves around subdomain enumeration. If you’re still abit “FUZZY” on url’s, i’ve got a breakdown below. Phase 1: Information Gathering Standard port & service scan yielde...

You’ve been asked to run a vulnerability test on a production environment. Phase 1: Information Gathering Standard scanning and enumeration yeilded: PORT STATE SERVICE VERSION 80/tcp ...

Check out our new cloud service, Authentication Anywhere. Can you find other user’s secrets? This room is all about insecure direct object references or (IDOR). Running initial fast scan to ide...

Many of the walkthroughs out there for the wreath network are very large, cover alot of different approaches, and may be confusing for people. Here i’ve tried to boil it down so you can root the ne...

Web application with markdown to PDF conversion functionality vulnerable to SSRF. Embedded iframe pointing to localhost admin panel in markdown input, forcing server to request restricted resource ...

Windows Active Directory box. Enumerated users via RID brute force with guest access, password sprayed to gain initial foothold, kerberoasted service account, and used pass-the-hash with extracted ...

Linux box with audio steganography hiding a Vigenère cipher key. Exploited command injection in a cron job to gain shell as secondary user, then decoded multi-layer encrypted credentials for root a...