Basic Port Scanning
EasyFind a service nmap's default scan doesn't show you
Reconnaissance & Networking Fundamentals
Map a target before you touch it. Port scanning, service fingerprinting, and subnet sweeps with real nmap output, not a quiz about it.
Banner Grabbing & Service Versions
MediumFingerprint an outdated service by its version banner
Subnet & Host Discovery
HardSweep a /28 to find the one host that matters
UDP Scanning
MadScan the transport protocol most tools skip
Full Network Recon
CapstoneChain TCP and UDP recon into one full sweep
Web Application Security
The bugs that show up in every real pentest report. Injection, broken auth, and a six-vulnerability marketplace app built to be taken apart.
SQLi Login Bypass
EasyBypass authentication with a single crafted login
Advanced UNION-based SQLi
MediumExtract hidden data past a keyword filter
Blind Boolean-based SQLi
HardPull data out one true/false answer at a time
Time-based Blind SQLi
MadRead the database through response delays alone
CSRF: Silent Account Takeover
Medium*Force an admin's browser to act without their consent
SSRF: Reach the Internal Network
Hard*Turn a URL fetcher into a pivot to internal services
JWT Algorithm Confusion
Mad*Forge an admin token by abusing a signing mix-up
Exposed .git Folder
Easy*Recover deleted secrets straight from commit history
Marketplace: Stored XSS
Medium*Hijack an admin session through a product review
Marketplace: IDOR
Easy*Read another shopper's order history by changing an ID
Marketplace: Price Manipulation
Medium*Checkout with a price the server never agreed to
Marketplace: Privilege Escalation
Hard*Grant yourself admin through an unprotected field
Marketplace: Path Traversal
Hard*Escape the uploads folder to read arbitrary files
Marketplace: Open Redirect
Easy*Weaponize a trusted domain's own login flow
Password Attacks
Cracking and spraying, the way they actually happen: wordlists, offline hashes, lockout-aware attacks, and credential reuse across systems.
Basic Dictionary Attack
EasyAutomate a wordlist attack against a live FTP login
Hash Cracking Basics
MediumIdentify and crack a leaked password hash offline
Password Spraying
HardBeat a lockout policy by inverting the usual attack
Weak Salting Exploitation
MadBreak a homemade salting scheme with the right tool
Crack, Then Reuse
CapstoneTurn one cracked password into a second system breach
Cloud Security Attacks
Real aws-cli, pointed at purpose-built AWS-shaped targets. Public buckets, metadata theft, IAM privilege escalation, and a four-stage kill chain.
Misconfigured S3 Bucket
EasyPull data from a bucket that needed no credentials
SSRF to Cloud Metadata
MediumSteal instance credentials through a server-side fetch
IAM Privilege Escalation
HardAttach an admin policy to your own low-priv user
Serverless Function Exploitation
MadTurn command injection into a stolen execution role
Full Cloud Kill Chain
CapstoneBucket to SSRF to IAM to serverless, in one sitting
API Security
The OWASP API Top 10, built as things you actually break: raw responses, swapped IDs, extra JSON fields, and endpoints nobody gated.
Excessive Data Exposure
EasyFind what the raw API response leaks past the UI
BOLA / IDOR
MediumRead someone else's private messages by swapping an ID
Mass Assignment
HardGrant yourself a role the form was never meant to expose
Broken Function-Level Authorization
MadCall an admin endpoint your account was never checked against
Full API Compromise Chain
CapstoneChain exposure, IDOR, and escalation into full compromise
Digital Forensics & Incident Response
No live target to exploit — real evidence to read. Logs, packet captures, and a suspicious file, the way an actual investigation runs.
Log Analysis
EasyIsolate a brute-force attacker from 200 lines of noise
Alert Triage
MediumFind the one real alert among five explainable false positives
Network Traffic Analysis
HardFollow a TCP stream to catch data leaving the network
Malware/File Analysis
MadUnmask a file that isn't what its extension claims
Full Incident Investigation
CapstoneRun a complete investigation, start to finish
Multi-Source Log Correlation
HardProve an intrusion by correlating two separate logs
No challenges match your search. Try a different term or clear the filter.