Read the brief. Open a terminal.
Capture the flag.
Every room here runs against a real, always-on target — not a simulation. You get a terminal, a live recon panel, and one objective per task.
Web Recon Fundamentals
Start here: map a target's attack surface before you ever try to break anything.
Map the Site
Use a real terminal against a live target to enumerate directories and build a site map before touching anything else.
Find the Hidden Page
Use a real directory scanner against a live target to find a page that should not be publicly accessible.
Exploit a Login Form
Apply what you know about recon to find a login page, then use a simple brute-force technique to gain access.
Linux Basics
Learn to navigate and interact with Linux — the OS that runs almost every server you will ever hack.
Navigate the File System
Learn the essential Linux commands for moving around a file system — the foundation of everything you will do on a target server.
Find the Hidden File
Use the find command to search an entire file system for files you cannot see with a normal directory listing.
Read Restricted Files
Learn about Linux file permissions and how misconfigured permissions can expose sensitive data.
Network Scanning
Discover what is running on a network before you try to exploit anything.
Your First Nmap Scan
Learn to use nmap — the most important network reconnaissance tool — to discover what is running on a target.
Port Discovery
Go beyond the default nmap scan and discover services running on non-standard ports.
Service Fingerprinting
Identify exact software versions running on open ports — the information needed to search for known vulnerabilities.
Web Vulnerabilities
Learn the most common web application vulnerabilities and how attackers exploit them.
What is SQL Injection
Understand what SQL injection is, why it works, and how to recognize it — no exploitation required yet.
Bypass a Login
Use a basic SQL injection payload to bypass a login form that is vulnerable to the attack you learned about.
Extract the Database
Go beyond login bypass and use SQL injection to dump data from the database — the technique attackers use to steal credentials.