[OSCP](https://hackindex.io/learn/oscp-pen-200-study-path) · Practice machines

## OSCP Practice Machines

Our curated list of machines that train the same skills as the OSCP syllabus, mapped to the module they fit best. Techniques are hidden behind spoilers, and machines whose platform forbids public solutions only show a name and link.

339 machines 38 with a HackIndex.io writeup

Machines completed 0/339

| Done | Machine | OS | Difficulty | Module | Writeup |
| --- | --- | --- | --- | --- | --- |
| | [Access](https://app.hackthebox.com/machines/Access?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers anonymous-ftp mdb-database-analysis zip-password-cracking pst-file-analysis telnet runas-savecred | Windows | Easy | [Windows Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/windows-privilege-escalation) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/03/02/htb-access.html) |
| | [Active](https://app.hackthebox.com/machines/Active?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration gpp-password kerberoasting | Windows | Easy | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/12/08/htb-active.html) |
| | [Admirer](https://app.hackthebox.com/machines/Admirer?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers adminer-arbitrary-file-read rogue-mysql-server credential-harvesting python-library-hijacking sudo-setenv | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/09/26/htb-admirer.html) |
| | [Blocky](https://app.hackthebox.com/machines/Blocky?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers wordpress-enumeration jar-decompilation hardcoded-credentials credential-reuse ssh sudo-misconfiguration | Linux | Easy | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [HackIndex.io](https://hackindex.io/writeups/blocky) |
| | [Buff](https://app.hackthebox.com/machines/Buff?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers gym-management-rce file-upload webshell chisel-port-forwarding cloudme-buffer-overflow | Windows | Easy | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/11/21/htb-buff.html) |
| | [Cascade](https://app.hackthebox.com/machines/Cascade?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ldap-enumeration smb-enumeration tightvnc-password-decryption reverse-engineering aes-decryption ad-recycle-bin-abuse password-reuse | Windows | Medium | [Active Directory Enumeration](https://hackindex.io/learn/oscp-pen-200-study-path/active-directory-introduction-and-enumeration) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/07/25/htb-cascade.html) |
| | [Forest](https://app.hackthebox.com/machines/Forest?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers rpc-enumeration as-rep-roasting winrm bloodhound acl-abuse dcsync | Windows | Easy | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/03/21/htb-forest.html) |
| | [Nest](https://app.hackthebox.com/machines/Nest?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration credential-hunting config-file-passwords alternate-data-streams dotnet-decompilation password-decryption | Windows | Easy | [Active Information Gathering](https://hackindex.io/learn/oscp-pen-200-study-path/active-information-gathering) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/06/06/htb-nest.html) |
| | [Hepet](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Client-Side Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/client-side-attacks) | Not allowed |
| | [Alfred](https://tryhackme.com/room/alfred) TryHackMe Show spoilers jenkins default-credentials command-execution reverse-shell token-impersonation seimpersonateprivilege | Windows | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.aldeid.com](https://www.aldeid.com/wiki/TryHackMe-Alfred) |
| | [Game Zone](https://tryhackme.com/room/gamezone) TryHackMe Show spoilers sql-injection-login-bypass sqlmap hash-cracking ssh-port-forwarding webmin-cve-2019-15107 | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | – |
| | [Alfa 1](https://www.vulnhub.com/entry/alfa-1,655/) Vulnhub Show spoilers anonymous-ftp brainfuck-decoding wordlist-generation ssh-brute-force ssh-tunneling vnc-authentication | Linux | Easy | [Password Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/password-attacks) | [github.com](https://github.com/eMVee-NL/eMVee-NL.github.io/blob/d3255a17b6d88c831d67682b27583858981267b8/_posts/2023-04-10-Vulnhub-Writeup-Alfa.md) |
| | [Bastion](https://app.hackthebox.com/machines/Bastion?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration vhd-mount sam-dump hash-cracking mremoteng-password-decryption | Windows | Easy | [Windows Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/windows-privilege-escalation) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/09/07/htb-bastion.html) |
| | [Brainfuck](https://app.hackthebox.com/machines/Brainfuck?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers wordpress-plugin-exploit vigenere-cipher rsa-key-recovery email-enumeration ssh-key-recovery | Linux | Insane | [Active Information Gathering](https://hackindex.io/learn/oscp-pen-200-study-path/active-information-gathering) | [HackIndex.io](https://hackindex.io/writeups/brainfuck) |
| | [Heist](https://app.hackthebox.com/machines/Heist?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers cisco-type7-cracking password-reuse firefox-credential-dump procdump-lsass evil-winrm | Windows | Easy | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/11/30/htb-heist.html) |
| | [Ypuffy](https://app.hackthebox.com/machines/Ypuffy?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ldap-enumeration ssh-key-authentication doas-abuse signify-signing | OpenBSD | Medium | [Active Directory Enumeration](https://hackindex.io/learn/oscp-pen-200-study-path/active-directory-introduction-and-enumeration) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/02/09/htb-ypuffy.html) |
| | [Algernon](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Agent Sudo](https://tryhackme.com/room/agentsudoctf) TryHackMe Show spoilers user-agent-manipulation ftp-brute-force steganography password-cracking cve-2019-14287 sudo-misconfiguration | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [www.aldeid.com](https://www.aldeid.com/wiki/TryHackMe-Agent-Sudo) |
| | [Anthem](https://tryhackme.com/room/anthem) TryHackMe Show spoilers web-enumeration osint credential-disclosure rdp hidden-files | Windows | Easy | [Password Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/password-attacks) | [www.aldeid.com](https://www.aldeid.com/wiki/TryHackMe-Anthem) |
| | [Brooklyn Nine Nine](https://tryhackme.com/room/brooklynninenine) TryHackMe Show spoilers ftp-anonymous ssh-brute-force steganography sudo-misconfiguration gtfobins-less | Linux | Easy | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [www.aldeid.com](https://www.aldeid.com/wiki/TryHackMe-Brooklyn-Nine-Nine) |
| | [Buffer Overflow Prep (OSCP BOF room, Tib3rius)](https://tryhackme.com/room/bufferoverflowprep) TryHackMe Show spoilers buffer-overflow stack-based-buffer-overflow eip-overwrite bad-character-analysis jmp-esp shellcode-injection egg-hunter | Windows | Easy | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | – |
| | [Corp](https://tryhackme.com/room/corp) TryHackMe Show spoilers kerberoasting applocker-bypass hashcat powerup unattended-install-credentials | Windows | Easy | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [steflan-security.com](https://steflan-security.com/tryhackme-corp-walkthrough/) |
| | [Hackme 1](https://www.vulnhub.com/entry/hackme-1,330/) Vulnhub Show spoilers sql-injection hash-cracking file-upload suid | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/hackme-1-vulnhub-walkthrough/) |
| | [Arctic](https://app.hackthebox.com/machines/Arctic?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers coldfusion directory-traversal hash-cracking jsp-webshell scheduled-task-abuse ms10-059 kernel-exploit | Windows | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/05/19/htb-arctic.html) |
| | [Armageddon](https://app.hackthebox.com/machines/Armageddon?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers drupalgeddon2 cve-2018-7600 hash-cracking snap-install dirty-sock sudo-misconfiguration | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [HackIndex.io](https://hackindex.io/writeups/armageddon) |
| | [Cicada](https://app.hackthebox.com/machines/Cicada?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-guest-enumeration password-in-share rid-brute password-spray sebackupprivilege sam-hive-dump | Windows | Easy | [Windows Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/windows-privilege-escalation) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2025/02/15/htb-cicada.html) |
| | [Delivery](https://app.hackthebox.com/machines/Delivery?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers osticket-abuse mattermost-registration credential-harvesting hash-cracking hashcat-rules password-reuse | Linux | Easy | [Password Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/password-attacks) | [HackIndex.io](https://hackindex.io/writeups/delivery) |
| | [Dog](https://app.hackthebox.com/machines/Dog?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers exposed-git-directory backdrop-cms-credentials authenticated-module-upload-rce sudo-bee-gtfobins | Linux | Easy | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2025/07/12/htb-dog.html) |
| | [EscapeTwo](https://app.hackthebox.com/machines/EscapeTwo?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers mssql-access spreadsheet-credential-leak bloodhound writeowner-abuse adcs-esc4 certificate-abuse | Windows | Easy | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2025/05/24/htb-escapetwo.html) |
| | [Object](https://app.hackthebox.com/machines/Object?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers jenkins-abuse firewall-bypass bloodhound forcechangepassword-acl writeowner-acl dpapi-credential-decrypt | Windows | Hard | [Active Directory Enumeration](https://hackindex.io/learn/oscp-pen-200-study-path/active-directory-introduction-and-enumeration) | [HackIndex.io](https://hackindex.io/writeups/object) |
| | [Return](https://app.hackthebox.com/machines/Return?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ldap-passback credential-capture winrm server-operators-group service-abuse | Windows | Easy | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/05/05/htb-return.html) |
| | [Hawat](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | Not allowed |
| | [Infosec Prep: OSCP Box](https://www.vulnhub.com/entry/infosec-prep-oscp,508/) Vulnhub Show spoilers information-disclosure base64-decoding ssh-private-key suid-bash lxd-privilege-escalation | Linux | Easy | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [redteamtutorials.com](https://redteamtutorials.com/2020/08/09/infosec-prep-oscp-walkthrough/) |
| | [Pikaboo](https://app.hackthebox.com/machines/Pikaboo?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers nginx-off-by-slash lfi log-poisoning ldap-enumeration perl-diamond-operator-injection cron-job | Linux | Hard | [Active Directory Enumeration](https://hackindex.io/learn/oscp-pen-200-study-path/active-directory-introduction-and-enumeration) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/12/04/htb-pikaboo.html) |
| | [Sauna](https://app.hackthebox.com/machines/Sauna?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers user-enumeration as-rep-roasting autologon-credentials bloodhound dcsync | Windows | Easy | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/07/18/htb-sauna.html) |
| | [Timelapse](https://app.hackthebox.com/machines/Timelapse?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration zip-cracking pfx-cracking evil-winrm powershell-history laps | Windows | Easy | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/08/20/htb-timelapse.html) |
| | [Astronaut](https://portal.offsec.com/machine/astronaut-49479/overview) Proving Grounds | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/astronaut) |
| | [Extplorer](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Password Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/password-attacks) | Not allowed |
| | [Squid](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Easy | [Windows Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/windows-privilege-escalation) | Not allowed |
| | [dostackbufferoverflowgood (Justin Steven)](https://github.com/justinsteven/dostackbufferoverflowgood) Standalone Show spoilers buffer-overflow stack-based-buffer-overflow eip-overwrite jmp-esp shellcode-injection bad-character-analysis | Windows | Easy | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [github.com](https://github.com/justinsteven/dostackbufferoverflowgood) |
| | [Blaster](https://tryhackme.com/room/blaster) TryHackMe Show spoilers web-enumeration directory-fuzzing credential-discovery rdp-access cve-2019-1388 uac-bypass | Windows | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [www.aldeid.com](https://www.aldeid.com/wiki/TryHackMe-Blaster) |
| | [Kenobi](https://tryhackme.com/room/kenobi) TryHackMe Show spoilers smb-enumeration proftpd-mod-copy nfs-mount ssh-private-key-theft suid path-hijacking | Linux | Easy | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [HackIndex.io](https://hackindex.io/writeups/kenobi) |
| | [Healthcare 1](https://www.vulnhub.com/entry/healthcare-1,522/) Vulnhub Show spoilers openemr-exploit sql-injection sqlmap webshell-upload suid path-hijacking | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/healthcare-1-vulnhub-walkthrough/) |
| | [Bank](https://app.hackthebox.com/machines/Bank?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers dns-vhost-enumeration htaccess-upload-filter-bypass php-webshell credentials-in-config suid-abuse | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/bank) |
| | [Blue](https://app.hackthebox.com/machines/Blue?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration ms17-010 eternalblue smbv1-rce | Windows | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/05/11/htb-blue.html) |
| | [Frolic](https://app.hackthebox.com/machines/Frolic?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers robots-txt esoteric-encoding base64-decoding playsms-rce file-upload buffer-overflow | Linux | Easy | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [HackIndex.io](https://hackindex.io/writeups/frolic) |
| | [Help](https://app.hackthebox.com/machines/Help?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers graphql-enumeration helpdeskz-sqli arbitrary-file-upload kernel-exploit-privesc | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/06/08/htb-help.html) |
| | [Reel](https://app.hackthebox.com/machines/Reel?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers anonymous-ftp phishing cve-2017-0199 rtf-exploit bloodhound writeowner writedacl | Windows | Hard | [Active Directory Enumeration](https://hackindex.io/learn/oscp-pen-200-study-path/active-directory-introduction-and-enumeration) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/11/10/htb-reel.html) |
| | [Support](https://app.hackthebox.com/machines/Support?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration reverse-engineering ldap-enumeration resource-based-constrained-delegation dcsync | Windows | Easy | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [HackIndex.io](https://hackindex.io/writeups/support) |
| | [Hokkaido](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | Not allowed |
| | [Jacko](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Windows Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/windows-privilege-escalation) | Not allowed |
| | [Postfish](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Password Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/password-attacks) | Not allowed |
| | [Lin.Security](https://www.vulnhub.com/entry/linsecurity-1,244/) Vulnhub Show spoilers sudo-misconfiguration gtfobins cron-job nfs-no-root-squash suid | Linux | Easy | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [in.security](https://in.security/lin-security-practise-your-linux-privilege-escalation-foo/) |
| | [Atom](https://app.hackthebox.com/machines/Atom?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers electron-updater-abuse smb-writable-share malicious-update-payload redis portable-kanban-decryption credential-reuse | Windows | Medium | [Password Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/password-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/07/10/htb-atom.html) |
| | [Bashed](https://app.hackthebox.com/machines/Bashed?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers directory-enumeration phpbash web-shell sudo-misconfiguration cron-job | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/04/29/htb-bashed.html) |
| | [Grandpa](https://app.hackthebox.com/machines/Grandpa?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers iis-webdav cve-2017-7269 buffer-overflow churrasco token-impersonation | Windows | Easy | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/05/28/htb-grandpa.html) |
| | [Mirai](https://app.hackthebox.com/machines/Mirai?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers default-credentials ssh sudo-misconfiguration file-recovery forensics | Linux | Easy | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/05/18/htb-mirai.html) |
| | [Tally](https://app.hackthebox.com/machines/Tally?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sharepoint-enumeration keepass-cracking mssql-xp-cmdshell seimpersonate scheduled-task-abuse juicypotato | Windows | Hard | [Windows Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/windows-privilege-escalation) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/04/11/htb-tally.html) |
| | [Access](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | Not allowed |
| | [Hutch](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | Not allowed |
| | [Blue](https://tryhackme.com/room/blue) TryHackMe Show spoilers eternalblue ms17-010 smb-exploitation metasploit hash-dumping password-cracking | Windows | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [steflan-security.com](https://steflan-security.com/tryhackme-blue-walkthrough/) |
| | [Kioptrix: Level 1.1 (#2)](https://www.vulnhub.com/entry/kioptrix-level-11-2,23/) Vulnhub Show spoilers sql-injection command-injection reverse-shell kernel-exploit privilege-escalation | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [blog.g0tmi1k.com](https://blog.g0tmi1k.com/2011/02/kioptrix-level-2-injection/) |
| | [Administrator](https://app.hackthebox.com/machines/Administrator?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers bloodhound targeted-kerberoast dacl-abuse genericall password-safe-dump dcsync | Windows | Medium | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2025/04/19/htb-administrator.html) |
| | [Beep](https://app.hackthebox.com/machines/Beep?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers lfi elastix cve-2012-4869 credential-disclosure password-reuse sudo-nmap | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/beep) |
| | [BoardLight](https://app.hackthebox.com/machines/BoardLight?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers dolibarr-cve-2023-30253 default-credentials config-credential-reuse enlightenment-cve-2022-37706-suid | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/09/28/htb-boardlight.html) |
| | [Fuse](https://app.hackthebox.com/machines/Fuse?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers print-job-enumeration wordlist-generation password-spray rpc-password-change seloaddriverprivilege | Windows | Medium | [Password Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/password-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/10/31/htb-fuse.html) |
| | [Vault](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Hard | [Windows Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/windows-privilege-escalation) | Not allowed |
| | [IMF](https://www.vulnhub.com/entry/imf-1,162/) Vulnhub Show spoilers information-disclosure php-type-juggling sql-injection file-upload htaccess-bypass buffer-overflow | Linux | Easy | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [g0blin.co.uk](https://g0blin.co.uk/imf-vulnhub-writeup/) |
| | [Kioptrix: Level 1.2 (#3)](https://www.vulnhub.com/entry/kioptrix-level-12-3,24/) Vulnhub Show spoilers lotuscms-rce sql-injection password-cracking credential-reuse sudo-misconfiguration | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [jhalon.github.io](https://jhalon.github.io/vulnhub-kioptrix3/) |
| | [Lord of the Root 1.0.1](https://www.vulnhub.com/entry/lord-of-the-root-101,129/) Vulnhub Show spoilers port-knocking sql-injection sqlmap credential-dumping mysql-udf-exploit | Linux | Intermediate | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [highon.coffee](https://highon.coffee/blog/lord-of-the-root-walkthrough/) |
| | [Mr-Robot 1](https://www.vulnhub.com/entry/mr-robot-1,151/) Vulnhub Show spoilers wordpress-enumeration robots-txt password-brute-force reverse-shell hash-cracking nmap-suid | Linux | Easy | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [jhalon.github.io](https://jhalon.github.io/vulnhub-mr-robot1/) |
| | [Authority](https://app.hackthebox.com/machines/Authority?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ansible-vault-cracking pwm-ldap-abuse responder adcs-esc1 certificate-abuse | Windows | Medium | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/12/09/htb-authority.html) |
| | [Blunder](https://app.hackthebox.com/machines/Blunder?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers bludit-bruteforce-bypass bludit-file-upload-rce cve-2019-16113 password-cracking sudo-cve-2019-14287 | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/10/17/htb-blunder.html) |
| | [Broker](https://app.hackthebox.com/machines/Broker?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers activemq-cve-2023-46604 rce sudo-nginx-privesc config-abuse | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/11/09/htb-broker.html) |
| | [Sunday](https://app.hackthebox.com/machines/Sunday?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers finger-user-enumeration ssh-brute-force password-cracking backup-file-disclosure sudo-wget sudo-misconfiguration | Solaris | Easy | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/09/29/htb-sunday.html) |
| | [Kevin](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Easy | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | Not allowed |
| | [Nickel](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | Not allowed |
| | [Kioptrix: Level 1.3 (#4)](https://www.vulnhub.com/entry/kioptrix-level-13-4,25/) Vulnhub Show spoilers smb-enumeration sql-injection authentication-bypass restricted-shell-escape mysql-udf | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [jhalon.github.io](https://jhalon.github.io/vulnhub-kioptrix4/) |
| | [Tommy Boy 1](https://www.vulnhub.com/entry/tommy-boy-1,157/) Vulnhub Show spoilers web-enumeration ftp-anonymous wordpress-enumeration steganography hash-cracking truecrypt | Linux | Medium | [Password Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/password-attacks) | [g0blin.co.uk](https://g0blin.co.uk/tommy-vulnhub-writeup/) |
| | [Intelligence](https://app.hackthebox.com/machines/Intelligence?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers pdf-metadata-enumeration password-spraying dns-record-injection responder-ntlm-capture gmsa-password-read constrained-delegation kerberos-s4u | Windows | Medium | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [HackIndex.io](https://hackindex.io/writeups/intelligence) |
| | [Resourced](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | Not allowed |
| | [Bob 1.0.1](https://www.vulnhub.com/entry/bob-101,226/) Vulnhub Show spoilers information-disclosure command-injection gpg-decryption password-cracking sudo | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [github.com](https://github.com/yufongg/writeups/blob/master/Vulnhub/Linux/Bob%201.0.1/Bob%201.0.1.md) |
| | [BSides Vancouver 2018](https://www.vulnhub.com/entry/bsides-vancouver-2018-workshop,231/) Vulnhub Show spoilers anonymous-ftp robots-txt wordpress wpscan-brute-force plugin-edit-rce cron-job writable-script sudo-misconfiguration | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [github.com](https://github.com/7h3rAm/writeups/blob/master/vulnhub.bsidesvancouver2018workshop/writeup.md) |
| | [Kioptrix: Level 1 (#1)](https://www.vulnhub.com/entry/kioptrix-level-1-1,22/) Vulnhub Show spoilers smb-enumeration apache-mod-ssl-openfuck cve-2002-0082 samba-trans2open-overflow remote-buffer-overflow | Linux | Easy | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [blog.g0tmi1k.com](https://blog.g0tmi1k.com/2011/02/kioptrix-level-1-modssl/) |
| | [Moria](https://www.vulnhub.com/entry/moria-11,187/) Vulnhub Show spoilers directory-brute-force port-knocking ftp-enumeration salted-md5-cracking ssh-private-key | Linux | Hard | [Password Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/password-attacks) | [github.com](https://github.com/Hamza-Megahed/CTFs/blob/master/moria/README) |
| | [NullByte](https://www.vulnhub.com/entry/nullbyte-1,126/) Vulnhub Show spoilers steganography directory-bruteforce hydra-bruteforce sql-injection hash-cracking suid path-hijacking | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [g0blin.co.uk](https://g0blin.co.uk/nullbyte-1-vulnhub-writeup/) |
| | [Toppo 1](https://www.vulnhub.com/entry/toppo-1,245/) Vulnhub Show spoilers directory-enumeration information-disclosure weak-credentials suid python-suid mawk-suid | Linux | Easy | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [www.hackingarticles.in](https://www.hackingarticles.in/hack-the-toppo1-vm-ctf-challenges/) |
| | [Bounty](https://app.hackthebox.com/machines/Bounty?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers file-upload web-config-upload asp-code-execution seimpersonateprivilege juicy-potato token-impersonation | Windows | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/bounty) |
| | [Curling](https://app.hackthebox.com/machines/Curling?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers joomla-admin-access template-php-backdoor password-reuse cron-abuse tar-wildcard-injection curl-config-file-abuse | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/03/30/htb-curling.html) |
| | [Legacy](https://app.hackthebox.com/machines/Legacy?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration ms08-067 ms17-010 eternalblue buffer-overflow | Windows | Easy | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [HackIndex.io](https://hackindex.io/writeups/legacy) |
| | [Manager](https://app.hackthebox.com/machines/Manager?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ad-user-enumeration mssql-access backup-zip-disclosure web-config-credentials adcs-esc7 | Windows | Medium | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/03/16/htb-manager.html) |
| | [Pandora](https://app.hackthebox.com/machines/Pandora?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers snmp-enumeration credential-harvesting sql-injection pandora-fms file-upload suid path-hijacking | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/05/21/htb-pandora.html) |
| | [Attacktive Directory](https://tryhackme.com/room/attacktivedirectory) TryHackMe Show spoilers kerberos-username-enumeration as-rep-roasting hashcat smb-enumeration credential-disclosure dcsync pass-the-hash | Windows | Medium | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [steflan-security.com](https://steflan-security.com/tryhackme-attacktive-directory-walkthrough/) |
| | [Tr0ll 1](https://www.vulnhub.com/entry/tr0ll-1,100/) Vulnhub Show spoilers anonymous-ftp pcap-analysis ssh-brute-force cron-job writable-script kernel-exploit | Linux | Easy | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [highon.coffee](https://highon.coffee/blog/tr0ll-1-walkthrough/) |
| | [Certified](https://app.hackthebox.com/machines/Certified?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers bloodhound-enumeration acl-abuse writeowner genericwrite shadow-credentials adcs-esc9 pass-the-hash | Windows | Medium | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2025/03/15/htb-certified.html) |
| | [Horizontall](https://app.hackthebox.com/machines/Horizontall?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers strapi-cve-2019-18818 strapi-rce-cve-2019-19609 port-forwarding laravel-ignition-rce cve-2021-3129 | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [HackIndex.io](https://hackindex.io/writeups/horizontall) |
| | [Querier](https://app.hackthebox.com/machines/Querier?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration macro-analysis mssql-enumeration xp-dirtree-ntlm-capture responder hash-cracking xp-cmdshell gpp-password | Windows | Medium | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/06/22/htb-querier.html) |
| | [Safe](https://app.hackthebox.com/machines/Safe?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers buffer-overflow return-oriented-programming ret2system keepass-cracking password-cracking | Linux | Easy | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/10/26/htb-safe.html) |
| | [Soccer](https://app.hackthebox.com/machines/Soccer?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers tiny-file-manager-default-creds file-upload-webshell websocket-sql-injection doas-dstat-privesc | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/06/10/htb-soccer.html) |
| | [Bratarina](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Tr0ll 3](https://www.vulnhub.com/entry/tr0ll-3,340/) Vulnhub Show spoilers wpa-handshake-cracking password-reuse sudo-service-abuse user-agent-filter-bypass ssh-private-key viminfo-credentials sudo-binary-replacement | Linux | Easy | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [www.codewrecks.com](https://www.codewrecks.com/post/old/2019/10/vulnhub-tr0ll3-walktrough/) |
| | [Busqueda](https://app.hackthebox.com/machines/Busqueda?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers searchor-command-injection-cve-2023-43364 git-config-credentials docker-enumeration sudo-script-path-hijack | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/08/12/htb-busqueda.html) |
| | [Escape](https://app.hackthebox.com/machines/Escape?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration mssql xp-dirtree net-ntlmv2-capture password-cracking adcs-esc1 pass-the-hash | Windows | Medium | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/06/17/htb-escape.html) |
| | [StreamIO](https://app.hackthebox.com/machines/StreamIO?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection password-cracking lfi rfi firefox-credential-theft acl-abuse laps | Windows | Medium | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/09/17/htb-streamio.html) |
| | [Swagshop](https://app.hackthebox.com/machines/Swagshop?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers magento-exploit sql-injection php-object-injection remote-code-execution sudo-misconfiguration gtfobins | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/09/28/htb-swagshop.html) |
| | [Ice](https://tryhackme.com/room/ice) TryHackMe Show spoilers icecast-exploit cve-2004-1561 metasploit insecure-service-permissions service-binary-hijack hash-dumping | Windows | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [HackIndex.io](https://hackindex.io/writeups/ice) |
| | [Billy Madison](https://www.vulnhub.com/entry/billy-madison-11,161/) Vulnhub Show spoilers port-knocking smb-enumeration packet-capture-analysis wpa-cracking password-brute-force suid cron-job | Linux | Intermediate | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [g0blin.co.uk](https://g0blin.co.uk/billy-madison-1-vulnhub-writeup/) |
| | [Brainpan 1](https://www.vulnhub.com/entry/brainpan-1,51/) Vulnhub Show spoilers buffer-overflow fuzzing jmp-esp reverse-shell sudo-misconfiguration man-pager-escape | Linux | Medium | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [github.com](https://github.com/amirr0r/thm/blob/38ee4a69b3c03a58c47136f56bb21c09015acabd/brainpan/README.md) |
| | [Blackfield](https://app.hackthebox.com/machines/Blackfield?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration as-rep-roasting password-cracking rpc-password-reset lsass-dump ntds-dit-extraction sebackupprivilege | Windows | Hard | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [HackIndex.io](https://hackindex.io/writeups/blackfield) |
| | [Titanic](https://app.hackthebox.com/machines/Titanic?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers local-file-inclusion gitea-config-disclosure sqlite-database-dump hash-cracking imagemagick-cve-2024-41817 | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2025/06/21/htb-titanic.html) |
| | [ClamAV](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Fail](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | Not allowed |
| | [Brainstorm](https://tryhackme.com/room/brainstorm) TryHackMe Show spoilers ftp-anonymous-access reverse-engineering buffer-overflow stack-based-buffer-overflow jmp-esp shellcode-injection | Windows | Medium | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [steflan-security.com](https://steflan-security.com/tryhackme-brainstorm-walkthrough/) |
| | [Gatekeeper](https://tryhackme.com/room/gatekeeper) TryHackMe Show spoilers smb-enumeration buffer-overflow stack-based-buffer-overflow jmp-esp firefox-credential-dumping password-decryption | Windows | Medium | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [steflan-security.com](https://steflan-security.com/tryhackme-gatekeeper-walkthrough/) |
| | [Ignite](https://tryhackme.com/room/ignite) TryHackMe Show spoilers web-enumeration fuel-cms-rce cve-2018-16763 remote-code-execution cleartext-credentials credential-reuse | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [HackIndex.io](https://hackindex.io/writeups/ignite) |
| | [Chatterbox](https://app.hackthebox.com/machines/Chatterbox?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers achat-exploit seh-buffer-overflow public-exploit-modification credential-reuse registry-autologon-creds | Windows | Medium | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [HackIndex.io](https://hackindex.io/writeups/chatterbox) |
| | [CozyHosting](https://app.hackthebox.com/machines/CozyHosting?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers spring-boot-actuator session-hijack command-injection postgresql-credential-dump hash-cracking ssh-sudo-gtfobins | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/03/02/htb-cozyhosting.html) |
| | [Flight](https://app.hackthebox.com/machines/Flight?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers lfi-vhost responder-ntlm-capture password-spray kerberoast iis-webshell dll-hijack | Windows | Hard | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/05/06/htb-flight.html) |
| | [Giddy](https://app.hackthebox.com/machines/Giddy?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection net-ntlmv2-capture responder hash-cracking winrm unifi-video-privesc | Windows | Medium | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/02/16/htb-giddy.html) |
| | [Internal](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | Not allowed |
| | [HackLAB: Vulnix](https://www.vulnhub.com/entry/hacklab-vulnix,48/) Vulnhub Show spoilers smtp-user-enumeration ssh-brute-force nfs-misconfiguration sudo-misconfiguration | Linux | Intermediate | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [www.abatchy.com](http://www.abatchy.com/2016/10/walkthrough-vulnix-vulnhub-vm) |
| | [VulnOS 2](https://www.vulnhub.com/entry/vulnos-2,147/) Vulnhub Show spoilers sql-injection credential-disclosure password-cracking kernel-exploit | Linux | Easy | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [g0blin.co.uk](https://g0blin.co.uk/vulnos-2-vulnhub-writeup/) |
| | [Irked](https://app.hackthebox.com/machines/Irked?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers unrealircd-backdoor cve-2010-2075 steganography password-reuse suid | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/04/27/htb-irked.html) |
| | [Jeeves](https://app.hackthebox.com/machines/Jeeves?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers jenkins-script-console groovy-rce keepass-cracking pass-the-hash juicypotato token-impersonation alternate-data-streams | Windows | Medium | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/04/14/htb-jeeves.html) |
| | [Mantis](https://app.hackthebox.com/machines/Mantis?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers port-enumeration mssql-enumeration credential-disclosure ms14-068 kerberos-ticket-forgery goldenpac | Windows | Hard | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/09/03/htb-mantis.html) |
| | [Node](https://app.hackthebox.com/machines/Node?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers api-enumeration information-disclosure password-cracking mongodb buffer-overflow | Linux | Medium | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/06/08/htb-node.html) |
| | [Hetemit](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | Not allowed |
| | [/dev/random: scream](https://www.vulnhub.com/entry/devrandom-scream,47/) Vulnhub Show spoilers anonymous-ftp freesshd-authentication-bypass sql-injection file-upload web-shell | Windows XP | Intermediate | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [rgolebiowski.blogspot.com](https://rgolebiowski.blogspot.com/2016/07/scream-challenge.html) |
| | [DC 6](https://www.vulnhub.com/entry/dc-6,315/) Vulnhub Show spoilers wordpress-enumeration wpscan password-bruteforce command-injection plaintext-credentials sudo-misconfiguration nmap-gtfobins | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.aldeid.com](https://www.aldeid.com/wiki/VulnHub-DC-6) |
| | [Keeper](https://app.hackthebox.com/machines/Keeper?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers request-tracker-default-creds keepass-dump-cve-2023-32784 putty-key-conversion ssh-key-auth | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/02/10/htb-keeper.html) |
| | [Monteverde](https://app.hackthebox.com/machines/Monteverde?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers user-enumeration password-spraying smb-enumeration credentials-in-share winrm azure-ad-connect-abuse dcsync | Windows | Medium | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/06/13/htb-monteverde.html) |
| | [October](https://app.hackthebox.com/machines/October?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers file-upload blacklist-bypass webshell buffer-overflow suid | Linux | Medium | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/03/26/htb-october.html) |
| | [Search](https://app.hackthebox.com/machines/Search?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers credential-disclosure kerberoasting password-spraying gmsa-abuse acl-abuse pfx-certificate-auth powershell-web-access | Windows | Hard | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/04/30/htb-search.html) |
| | [Hunit](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | Not allowed |
| | [Breach 3.0.1](https://www.vulnhub.com/entry/breach-301,177/) Vulnhub Show spoilers web-enumeration sql-injection shellshock port-knocking sudo-misconfiguration pivoting | Linux | Intermediate | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | – |
| | [DEFCON Toronto Galahad](https://www.vulnhub.com/entry/defcon-toronto-galahad,194/) Vulnhub Show spoilers javascript-deobfuscation robots-txt steganography http-header-spoofing python-bytecode-decompilation port-knocking | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [github.com](https://github.com/sfape/LabRecord/blob/master/VulnHub/DEFCON%20TORONTO%20GALAHAD.md) |
| | [APT](https://app.hackthebox.com/machines/APT?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ipv6-enumeration ms-rpc-registry-dump ntlm-hash-cracking responder ntlm-relay | Windows | Insane | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [HackIndex.io](https://hackindex.io/writeups/apt) |
| | [Knife](https://app.hackthebox.com/machines/Knife?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers php-8.1.0-dev-backdoor user-agentt-header-rce reverse-shell sudo-misconfiguration chef-knife-privesc | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/08/28/htb-knife.html) |
| | [Resolute](https://app.hackthebox.com/machines/Resolute?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers rpc-enumeration password-spraying winrm powershell-transcript dnsadmins-abuse dll-injection | Windows | Medium | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/05/30/htb-resolute.html) |
| | [Sneaky](https://app.hackthebox.com/machines/Sneaky?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection snmp-enumeration ipv6-pivot suid-buffer-overflow | Linux | Medium | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/03/02/htb-sneaky.html) |
| | [Cockpit](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | Not allowed |
| | [Sorcerer](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | Not allowed |
| | [DerpNStink 1](https://www.vulnhub.com/entry/derpnstink-1,221/) Vulnhub Show spoilers wordpress-enumeration default-credentials plugin-file-upload hash-cracking pcap-analysis sudo-wildcard privilege-escalation | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | – |
| | [Devel](https://app.hackthebox.com/machines/Devel?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers anonymous-ftp file-upload aspx-webshell kernel-exploit ms11-046 | Windows | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/devel) |
| | [Laboratory](https://app.hackthebox.com/machines/Laboratory?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers gitlab-cve-2020-10977 arbitrary-file-read-to-rce path-hijack suid-abuse docker | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/04/17/htb-laboratory.html) |
| | [Multimaster](https://app.hackthebox.com/machines/Multimaster?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection waf-bypass password-cracking vscode-cef-debug dll-reversing as-rep-roasting generic-write-abuse server-operators-abuse | Windows | Insane | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/09/19/htb-multimaster.html) |
| | [Scrambled](https://app.hackthebox.com/machines/Scrambled?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers kerberos-only-auth kerberoasting silver-ticket mssql reverse-engineering dotnet-deserialization | Windows | Medium | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/10/01/htb-scrambled.html) |
| | [Pebbles](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | Not allowed |
| | [Tr0ll 2](https://www.vulnhub.com/entry/tr0ll-2,107/) Vulnhub Show spoilers anonymous-ftp steganography zip-password-cracking rbash-escape buffer-overflow suid | Linux | Medium | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [highon.coffee](https://highon.coffee/blog/tr0ll-2-walkthrough/) |
| | [W34kn3ss 1](https://www.vulnhub.com/entry/w34kn3ss-1,270/) Vulnhub Show spoilers ssl-certificate-enumeration weak-openssl-key ssh-key-cracking python-decompilation hardcoded-credentials sudo | Linux | Intermediate | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [www.hackingarticles.in](https://www.hackingarticles.in/w34kn3ss-1-vulnhub-lab-walkthrough/) |
| | [Doctor](https://app.hackthebox.com/machines/Doctor?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ssti jinja2-template-injection log-analysis splunk-universal-forwarder splunkwhisperer2 | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/doctor) |
| | [Silo](https://app.hackthebox.com/machines/Silo?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers oracle-tns-enumeration sid-guessing credential-bruteforce odat-webshell-upload memory-dump-analysis pass-the-hash | Windows | Medium | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | [HackIndex.io](https://hackindex.io/writeups/silo) |
| | [Sizzle](https://app.hackthebox.com/machines/Sizzle?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration scf-file-attack responder-ntlm-capture adcs-certificate-abuse kerberoasting applocker-bypass dcsync | Windows | Insane | [Active Directory Authentication Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/attacking-active-directory-authentication) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/06/01/htb-sizzle.html) |
| | [Levram](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | Not allowed |
| | [Brainpan](https://www.vulnhub.com/entry/brainpan-1,51/) Vulnhub Show spoilers buffer-overflow stack-based-buffer-overflow jmp-esp wine sudo-misconfiguration shell-escape gtfobins | Linux | Hard | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [steflan-security.com](https://steflan-security.com/vulnhub-brainpan-1-walkthrough/) |
| | [Digitalworld.local (Development)](https://www.vulnhub.com/entry/digitalworldlocal-development,280/) Vulnhub Show spoilers web-enumeration exposed-credentials hash-cracking lshell-escape password-reuse sudo-vim gtfobins | Linux | Medium | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [benheater.com](https://benheater.com/vulnhub-digitalworld-dev/) |
| | [pWnOS 2.0](https://www.vulnhub.com/entry/pwnos-20-pre-release,34/) Vulnhub Show spoilers sql-injection union-based-sql-injection into-outfile-webshell php-reverse-shell credential-reuse | Linux | Intermediate | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [blog.g0tmi1k.com](https://blog.g0tmi1k.com/2012/09/pwnos-2-sql-injection/) |
| | [Editorial](https://app.hackthebox.com/machines/Editorial?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ssrf-image-upload internal-api-leak git-log-credential-hunt python-library-hijack sudo-git-abuse | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/10/19/htb-editorial.html) |
| | [Ellingson](https://app.hackthebox.com/machines/Ellingson?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers python-debug-console-rce hash-cracking suid-buffer-overflow rop-exploitation aslr-bypass | Linux | Hard | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/10/19/htb-ellingson.html) |
| | [Lightweight](https://app.hackthebox.com/machines/Lightweight?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ldap-sniffing packet-capture password-cracking linux-capabilities credential-harvesting | Linux | Medium | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/05/11/htb-lightweight.html) |
| | [LinkVortex](https://app.hackthebox.com/machines/LinkVortex?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers exposed-git-directory ghost-cms-cve-2023-40028 symlink-arbitrary-file-read sudo-script-symlink-abuse | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2025/04/12/htb-linkvortex.html) |
| | [Craft](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Hard | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | Not allowed |
| | [QuackerJack](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | Not allowed |
| | [Omni](https://app.hackthebox.com/machines/Omni?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers windows-iot-core sirep-rat remote-code-execution registry-dump windows-device-portal powershell-credential-decryption | Windows | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/01/09/htb-omni.html) |
| | [Heist](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Hard | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | Not allowed |
| | [EVM 1](https://www.vulnhub.com/entry/evm-1,391/) Vulnhub Show spoilers wordpress-enumeration wpscan password-bruteforce wp-admin-shell-upload credential-disclosure password-reuse | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/evm-1-vulnhub-walkthrough/) |
| | [Node 1](https://www.vulnhub.com/entry/node-1,252/) Vulnhub Show spoilers exposed-api information-disclosure hash-cracking zip-password-cracking source-code-review suid-binary-abuse kernel-exploit | Linux | Medium | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [maysec.github.io](https://maysec.github.io/Node-1-Walkthrough/) |
| | [Pinkys Palace v1](https://www.vulnhub.com/entry/pinkys-palace-v1,225/) Vulnhub Show spoilers squid-proxy-pivoting sql-injection hash-cracking ssh-private-key suid buffer-overflow | Linux | Hard | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [www.hackingarticles.in](https://www.hackingarticles.in/hack-the-pinkypalace-vm-ctf-challenge/) |
| | [SkyTower 1](https://www.vulnhub.com/entry/skytower-1,96/) Vulnhub Show spoilers sql-injection waf-bypass squid-proxy-pivot credentials-in-config sudo-misconfiguration | Linux | Intermediate | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [highon.coffee](https://highon.coffee/blog/skytower-walkthrough/) |
| | [Cache](https://app.hackthebox.com/machines/Cache?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers openemr-sqli auth-bypass-rce memcached-credential-dump docker-group-privesc | Linux | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/10/10/htb-cache.html) |
| | [OpenAdmin](https://app.hackthebox.com/machines/OpenAdmin?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers opennetadmin-rce credential-reuse ssh-key-cracking sudo-nano gtfobins | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [HackIndex.io](https://hackindex.io/writeups/openadmin) |
| | [Exfiltrated](https://portal.offsec.com/machine/exfiltrated-17398/overview) Proving Grounds | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/exfiltrated) |
| | [Nagoya](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Hard | [Active Directory Lateral Movement](https://hackindex.io/learn/oscp-pen-200-study-path/lateral-movement-in-active-directory) | Not allowed |
| | [Shrek](https://tryhackme.com/room/shrek) TryHackMe Show spoilers king-of-the-hill robots-txt-disclosure ssh-private-key information-disclosure sgid-binary gdb-exploitation | Linux | Medium | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [oscp.cyberdefendersprogram.com](https://oscp.cyberdefendersprogram.com/write-ups/vw-shrek) |
| | [Pinkys Palace v2](https://www.vulnhub.com/entry/pinkys-palace-v2,229/) Vulnhub Show spoilers port-knocking sql-injection lfi credential-cracking buffer-overflow suid | Linux | Hard | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [www.infosecinstitute.com](https://www.infosecinstitute.com/topic/pinkys-palace-v2-vulnhub-ctf-walkthrough/) |
| | [Cronos](https://app.hackthebox.com/machines/Cronos?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers dns-zone-transfer vhost-enumeration sql-injection command-injection cron-job | Linux | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/04/14/htb-cronos.html) |
| | [Optimum](https://app.hackthebox.com/machines/Optimum?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers hfs-rce cve-2014-6287 kernel-exploit ms16-032 token-impersonation | Windows | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/03/17/htb-optimum.html) |
| | [SolidState](https://app.hackthebox.com/machines/SolidState?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers apache-james-exploit default-credentials pop3-enumeration rbash-escape cron-job | Linux | Medium | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/04/30/htb-solidstate.html) |
| | [Fanatastic](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Pinkys Palace v4](https://www.vulnhub.com/entry/pinkys-palace-v4,265/) Vulnhub Show spoilers information-disclosure directory-traversal buffer-overflow ret2libc rop-chain kernel-module-exploitation | Linux | Hard | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [devl00p.github.io](https://devl00p.github.io/posts/Solution-du-CTF-Pinky-Palace-v4-de-VulnHub/) |
| | [Bankrobber](https://app.hackthebox.com/machines/Bankrobber?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers xss sql-injection cookie-theft command-injection port-forwarding buffer-overflow | Windows | Insane | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/03/07/htb-bankrobber.html) |
| | [FriendZone](https://app.hackthebox.com/machines/FriendZone?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers dns-zone-transfer smb-enumeration local-file-inclusion credential-reuse python-library-hijacking cron-job | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/friendzone) |
| | [Postman](https://app.hackthebox.com/machines/Postman?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers redis-exploitation ssh-key-injection ssh-key-cracking webmin-rce cve-2019-12840 password-reuse | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/03/14/htb-postman.html) |
| | [UpDown](https://app.hackthebox.com/machines/UpDown?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers exposed-git-directory dev-vhost-discovery php-filter-wrapper special-test-header-bypass easy_install-sudo-gtfobins suid-abuse | Linux | Medium | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/01/21/htb-updown.html) |
| | [DC 9](https://www.vulnhub.com/entry/dc-9,412/) Vulnhub Show spoilers sql-injection hash-cracking local-file-inclusion port-knocking ssh-bruteforce sudo-misconfiguration etc-passwd-write | Linux | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/dc-9-vulnhub-walkthrough/) |
| | [Jail](https://app.hackthebox.com/machines/Jail?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers buffer-overflow selinux-sandbox-escape nfs-no-root-squash rvim-escape rar-cracking rsa-key-recovery | Linux | Insane | [Adapting Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/fixing-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/05/23/htb-jail.html) |
| | [Remote](https://app.hackthebox.com/machines/Remote?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers nfs-mount hash-cracking umbraco-rce teamviewer-password-decryption | Windows | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/09/05/htb-remote.html) |
| | [Peppo](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Hard | [Linux Privilege Escalation](https://hackindex.io/learn/oscp-pen-200-study-path/linux-privilege-escalation) | Not allowed |
| | [DevGuru 1](https://www.vulnhub.com/entry/devguru-1,620/) Vulnhub Show spoilers git-source-disclosure october-cms-rce database-credential-reuse gitea-git-hooks-rce cve-2019-14287 sudo-sqlite3 | Linux | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/devguru-1-vulnhub-walkthrough/) |
| | [FristiLeaks 1.3](https://www.vulnhub.com/entry/fristileaks-13,133/) Vulnhub Show spoilers directory-enumeration base64-decoding file-upload cron-job sudo-misconfiguration | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/hack-fristileaks-vm-ctf-challenge/) |
| | [Granny](https://app.hackthebox.com/machines/Granny?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers iis-webdav webdav-put http-move aspx-webshell churrasco token-impersonation | Windows | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/03/06/htb-granny.html) |
| | [Jarvis](https://app.hackthebox.com/machines/Jarvis?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection waf-bypass phpmyadmin-rce command-injection sudo-misconfiguration systemctl-gtfobins | Linux | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [HackIndex.io](https://hackindex.io/writeups/jarvis) |
| | [Shocker](https://app.hackthebox.com/machines/Shocker?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers directory-enumeration cgi-bin shellshock cve-2014-6271 sudo-perl | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/05/25/htb-shocker.html) |
| | [Magic](https://app.hackthebox.com/machines/Magic?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection file-upload php-webshell credential-reuse path-hijacking suid | Linux | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [HackIndex.io](https://hackindex.io/writeups/magic) |
| | [Tomghost](https://tryhackme.com/room/tomghost) TryHackMe Show spoilers ghostcat-cve-2020-1938 tomcat-file-read credential-disclosure gpg-decryption sudo-zip-gtfobins | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | – |
| | [Hack Me Please](https://www.vulnhub.com/entry/hack-me-please-1,731/) Vulnhub Show spoilers seeddms-exploitation config-file-disclosure mysql-enumeration file-upload credential-reuse sudo-misconfiguration | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [github.com](https://github.com/igmunv/pentest-writeups/blob/b0c9d6fb155ae1195e4b900e6c7fbccbfdca57d0/vulnhub/Hack-Me-Please-1.md) |
| | [Mango](https://app.hackthebox.com/machines/Mango?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers nosql-injection mongodb credential-extraction password-reuse jjs-suid | Linux | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [HackIndex.io](https://hackindex.io/writeups/mango) |
| | [Traverxec](https://app.hackthebox.com/machines/Traverxec?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers nostromo-rce cve-2019-16278 ssh-key-cracking sudo-journalctl gtfobins privilege-escalation | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/04/11/htb-traverxec.html) |
| | [Helpdesk](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Jerry](https://app.hackthebox.com/machines/Jerry?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers tomcat-manager default-credentials war-file-upload reverse-shell | Windows | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/jerry) |
| | [Monitored](https://app.hackthebox.com/machines/Monitored?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers snmp-credential-leak nagios-xi-api-abuse sql-injection sudo-service-privesc | Linux | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/05/11/htb-monitored.html) |
| | [Twiggy](https://portal.offsec.com/machine/twiggy-244/overview) Proving Grounds | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [HackIndex.io](https://hackindex.io/writeups/twiggy) |
| | [Lame](https://app.hackthebox.com/machines/Lame?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration cve-2007-2447 samba-usermap-script command-injection distcc | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/04/07/htb-lame.html) |
| | [Valentine](https://app.hackthebox.com/machines/Valentine?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers heartbleed cve-2014-0160 ssh-key tmux-hijack dirtycow | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/07/28/htb-valentine.html) |
| | [OZ](https://www.vulnhub.com/entry/oz-1,317/) Vulnhub Show spoilers sql-injection hash-cracking server-side-template-injection port-knocking portainer-abuse docker-escape | Linux | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [maysec.github.io](https://maysec.github.io/Oz-Walkthrough/) |
| | [Wombo](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | Not allowed |
| | [LemonSqueezy](https://www.vulnhub.com/entry/lemonsqueezy-1,473/) Vulnhub Show spoilers wordpress-enumeration password-brute-force phpmyadmin-rce webshell-upload cron-job writable-file | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/lemonsqueezy1-vulnhub-walkthrough/) |
| | [Readme 1](https://www.vulnhub.com/entry/readme-1,336/) Vulnhub Show spoilers adminer-file-read cve-2021-43008 mysql-load-data-local sql-injection credential-disclosure sudo-misconfiguration | Linux | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [github.com](https://github.com/sfape/LabRecord/blob/main/VulnHub/ReadMe%201.md) |
| | [Love](https://app.hackthebox.com/machines/Love?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ssrf voting-system-rce file-upload alwaysinstallelevated malicious-msi | Windows | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/love) |
| | [SecNotes](https://app.hackthebox.com/machines/SecNotes?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers second-order-sql-injection csrf smb-share-write php-webshell credential-reuse wsl-bash-history | Windows | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [HackIndex.io](https://hackindex.io/writeups/secnotes) |
| | [Year of the Rabbit](https://tryhackme.com/room/yearoftherabbit) TryHackMe Show spoilers ftp-enumeration steganography brainfuck-decoding sudo-vi-version-bypass sudo-cve-2019-14287 | Linux | Easy | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | – |
| | [Luanne](https://app.hackthebox.com/machines/Luanne?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers lua-command-injection os-command-injection ssh-key-access doas-privesc netpgp-decryption backup-file-cracking | NetBSD | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/03/27/htb-luanne.html) |
| | [Unattended](https://app.hackthebox.com/machines/Unattended?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers nginx-sql-injection local-file-inclusion php-session-poisoning initramfs-privesc | Linux | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/08/24/htb-unattended.html) |
| | [Billyboss](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | Not allowed |
| | [Writer](https://app.hackthebox.com/machines/Writer?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection authentication-bypass command-injection hash-cracking postfix-filter-injection apt-config-injection | Linux | Medium | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/12/11/htb-writer.html) |
| | [Bullybox](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | Not allowed |
| | [Misdirection 1](https://www.vulnhub.com/entry/misdirection-1,371/) Vulnhub Show spoilers directory-bruteforce web-shell sudo-misconfiguration writable-etc-passwd privilege-escalation | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/misdirection-1-vulnhub-walkthrough/) |
| | [Breadcrumbs](https://app.hackthebox.com/machines/Breadcrumbs?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers directory-traversal cookie-forgery jwt-forgery file-upload sql-injection sticky-notes-decryption credential-hunting | Windows | Hard | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/07/17/htb-breadcrumbs.html) |
| | [Netmon](https://app.hackthebox.com/machines/Netmon?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ftp-anonymous prtg-network-monitor credential-reuse command-injection | Windows | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/06/29/htb-netmon.html) |
| | [Flu](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | Not allowed |
| | [Control](https://app.hackthebox.com/machines/Control?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers http-header-spoofing sql-injection webshell-upload hash-cracking weak-service-permissions service-registry-abuse | Windows | Hard | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/04/25/htb-control.html) |
| | [Networked](https://app.hackthebox.com/machines/Networked?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers file-upload-bypass double-extension command-injection cron-job sudo-misconfiguration ifcfg-injection | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/11/16/htb-networked.html) |
| | [LaVita](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | Not allowed |
| | [Nibbles](https://app.hackthebox.com/machines/Nibbles?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers nibbleblog default-credentials file-upload cve-2015-6967 sudo-misconfiguration | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/06/30/htb-nibbles.html) |
| | [Marketing](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | Not allowed |
| | [Daily Bugle](https://tryhackme.com/room/dailybugle) TryHackMe Show spoilers joomla-sqli-cve-2017-8917 hash-cracking password-reuse yum-sudo-gtfobins | Linux | Hard | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | – |
| | [Falafel](https://app.hackthebox.com/machines/Falafel?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection php-type-juggling file-upload video-group-framebuffer disk-group-abuse | Linux | Hard | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/06/23/htb-falafel.html) |
| | [Paper](https://app.hackthebox.com/machines/Paper?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers wordpress-secret-disclosure cve-2019-17671 rocketchat-bot path-traversal polkit-cve-2021-3560 | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/06/18/htb-paper.html) |
| | [Metasploitable 3](https://github.com/rapid7/metasploitable3) Vulnhub Show spoilers elasticsearch-rce jenkins-script-console-rce glassfish-war-deployment weak-credentials wordpress-exploitation token-impersonation | Windows | Intermediate | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [github.com](https://github.com/rapid7/metasploitable3/wiki/Vulnerabilities) |
| | [Monitors](https://app.hackthebox.com/machines/Monitors?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers wordpress-plugin-lfi cacti-sql-injection cacti-rce apache-solr-rce privileged-container-escape kernel-module-loading | Linux | Hard | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/10/09/htb-monitors.html) |
| | [PyLoader](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | Not allowed |
| | [Photographer 1](https://www.vulnhub.com/entry/photographer-1,519/) Vulnhub Show spoilers smb-enumeration koken-cms-file-upload webshell-upload suid gtfobins-php | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/photographer-1-vulnhub-walkthrough/) |
| | [Previse](https://app.hackthebox.com/machines/Previse?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers broken-access-control execute-after-redirect command-injection password-cracking path-hijacking sudo-misconfiguration | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/01/08/htb-previse.html) |
| | [Seventeen](https://app.hackthebox.com/machines/Seventeen?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers boolean-based-sql-injection vhost-enumeration file-upload-rce roundcube-lfi npm-registry-credentials malicious-npm-package sudo-misconfiguration | Linux | Hard | [SQL Injection Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/sql-injection-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/09/24/htb-seventeen.html) |
| | [Sybaris](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | Not allowed |
| | [ZenPhoto](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | Not allowed |
| | [RickdiculouslyEasy 1](https://www.vulnhub.com/entry/rickdiculouslyeasy-1,207/) Vulnhub Show spoilers ftp-anonymous information-disclosure command-injection zip-password-cracking ssh sudo-privilege-escalation | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | – |
| | [Bastard](https://app.hackthebox.com/machines/Bastard?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers drupal-enumeration drupalgeddon2 cve-2018-7600 unauthenticated-rce ms15-051 kernel-exploit | Windows | Medium | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [HackIndex.io](https://hackindex.io/writeups/bastard) |
| | [Sar 1](https://www.vulnhub.com/entry/sar-1,425/) Vulnhub Show spoilers directory-enumeration sar2html-rce command-injection cron-job writable-script | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/sar-vulnhub-walkthrough/) |
| | [Builder](https://app.hackthebox.com/machines/Builder?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers jenkins-cve-2024-23897 arbitrary-file-read jenkins-credential-decrypt ssh-key-abuse | Linux | Medium | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/02/12/htb-builder.html) |
| | [Sau](https://app.hackthebox.com/machines/Sau?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers request-baskets-ssrf-cve-2023-27163 maltrail-command-injection systemctl-sudo-gtfobins | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/01/06/htb-sau.html) |
| | [ScriptKiddie](https://app.hackthebox.com/machines/ScriptKiddie?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers msfvenom-apk-template-injection cve-2020-7384 command-injection sudo-msfconsole sudo-misconfiguration | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/06/05/htb-scriptkiddie.html) |
| | [Election 1](https://www.vulnhub.com/entry/election-1,503/) Vulnhub Show spoilers web-enumeration directory-brute-force log-file-credential-leak ssh-login suid cve-2019-12181 | Linux | Medium | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [www.hackingarticles.in](https://www.hackingarticles.in/election-1-vulnhub-walkthorugh/) |
| | [Hawk](https://app.hackthebox.com/machines/Hawk?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers anonymous-ftp openssl-decryption drupal password-reuse h2-database-rce | Linux | Medium | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/11/30/htb-hawk.html) |
| | [Sense](https://app.hackthebox.com/machines/Sense?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers directory-enumeration default-credentials pfsense command-injection cve-2014-4688 | FreeBSD | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/03/11/htb-sense.html) |
| | [Meta](https://app.hackthebox.com/machines/Meta?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers exiftool-rce imagemagick-exploit cron-job-abuse sudo-env-keep neofetch-privesc | Linux | Medium | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/06/11/htb-meta.html) |
| | [Servmon](https://app.hackthebox.com/machines/Servmon?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ftp-anonymous nvms-1000-lfi directory-traversal ssh port-forwarding nsclient-privilege-escalation | Windows | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/06/20/htb-servmon.html) |
| | [Shibboleth](https://app.hackthebox.com/machines/Shibboleth?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ipmi-enumeration ipmi-hash-dump hash-cracking zabbix-agent-rce password-reuse mariadb-udf-privesc | Linux | Medium | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/04/02/htb-shibboleth.html) |
| | [Tabby](https://app.hackthebox.com/machines/Tabby?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers lfi tomcat-manager-upload war-deployment zip-password-cracking lxd-privilege-escalation | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/11/07/htb-tabby.html) |
| | [Steel Mountain](https://tryhackme.com/room/steelmountain) TryHackMe Show spoilers osint rejetto-hfs cve-2014-6287 unquoted-service-path powerup service-exploitation | Windows | Medium | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [www.aldeid.com](https://www.aldeid.com/wiki/TryHackMe-Steel-Mountain) |
| | [Thompson](https://tryhackme.com/room/bsidesgtthompson) TryHackMe Show spoilers tomcat-manager default-credentials war-file-upload reverse-shell cron-job writable-script | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.aldeid.com](https://www.aldeid.com/wiki/TryHackMe-Thompson) |
| | [Teacher](https://app.hackthebox.com/machines/Teacher?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers moodle-rce-cve-2018-1133 mysql-credential-dump hash-cracking cron-backup-abuse | Linux | Medium | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/04/20/htb-teacher.html) |
| | [Tiki 1](https://www.vulnhub.com/entry/tiki-1,525/) Vulnhub Show spoilers tikiwiki-cms cve-2020-15906 authentication-bypass information-disclosure sudo-misconfiguration | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [github.com](https://github.com/jib1337/writeups_public/blob/dee2cd4391e12eaa7c309660f1820d432b7d7277/VulnHub/VHB_Tiki/README.md) |
| | [Vulnversity](https://tryhackme.com/room/vulnversity) TryHackMe Show spoilers directory-brute-force file-upload-bypass php-reverse-shell suid systemctl-privesc | Linux | Easy | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.aldeid.com](https://www.aldeid.com/wiki/TryHackMe-Vulnversity) |
| | [Vulnerable Docker 1](https://www.vulnhub.com/entry/vulnerable-docker-1,208/) Vulnhub Show spoilers shellshock wordpress-rce exposed-docker-api docker-socket-mount chroot-escape container-escape | Linux | Medium | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [www.notsosecure.com](https://www.notsosecure.com/vulnerable-docker-vm/) |
| | [Apex](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Web Developer 1](https://www.vulnhub.com/entry/web-developer-1,288/) Vulnhub Show spoilers pcap-analysis wordpress theme-editor-rce credential-reuse tcpdump-sudo sudo-misconfiguration | Linux | Medium | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | – |
| | [AuthBy](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Internal](https://tryhackme.com/room/internal) TryHackMe Show spoilers wordpress-brute-force wp-admin-theme-rce jenkins-pivot ssh-tunneling docker-privesc | Linux | Hard | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | – |
| | [Boolean](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Pinkys Palace v3](https://www.vulnhub.com/entry/pinkys-palace-v3,237/) Vulnhub Show spoilers drupalgeddon2 bind-shell hydra-bruteforce port-knocking suid-binary tar-wildcard-injection cron-job | Linux | Hard | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [devl00p.github.io](https://devl00p.github.io/posts/Solution-du-CTF-Pinky-Palace-v3-de-VulnHub/) |
| | [Quick](https://app.hackthebox.com/machines/Quick?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers http3-quic esi-injection xslt-rce symlink-race-condition credential-reuse | Linux | Hard | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/08/29/htb-quick.html) |
| | [Breach 2.1](https://www.vulnhub.com/entry/breach-21,159/) Vulnhub Show spoilers stored-xss browser-exploitation ssh-forcecommand-bypass local-file-inclusion sudo-misconfiguration tcpdump-privilege-escalation | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [g0blin.co.uk](https://g0blin.co.uk/breach-2.1-vulnhub-writeup/) |
| | [DVR4](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Retro](https://tryhackme.com/room/retro) TryHackMe Show spoilers wordpress-enumeration hidden-directory rdp-access cve-2017-0213-com-elevation credential-reuse | Windows | Hard | [Finding and Evaluating Public Exploits](https://hackindex.io/learn/oscp-pen-200-study-path/locating-public-exploits) | – |
| | [GoldenEye 1](https://www.vulnhub.com/entry/goldeneye-1,240/) Vulnhub Show spoilers pop3-enumeration hydra-bruteforce credential-decoding moodle-rce aspell-command-injection steganography kernel-exploit | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [motasem-notes.net](https://motasem-notes.net/linux-privilege-escalation-goldeneye-vulnhub-ctf-walkthrough-oscp-machine/) |
| | [Kioptrix: 2014](https://www.vulnhub.com/entry/kioptrix-2014-5,62/) Vulnhub Show spoilers pchart-path-traversal user-agent-bypass phptax-rce kernel-exploit | FreeBSD | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [jhalon.github.io](https://jhalon.github.io/vulnhub-kioptrix5/) |
| | [Marshalled](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [MedJed](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Mzeeav](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Nibbles](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Nukem](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Ochima](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Payday](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [PC](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Pelican](https://portal.offsec.com/machine/pelican-440/overview) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/pelican) |
| | [PwnLab: init](https://www.vulnhub.com/entry/pwnlab-init,158/) Vulnhub Show spoilers lfi php-filter file-upload credentials-in-config path-hijacking command-injection | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.abatchy.com](http://www.abatchy.com/2016/11/pwnlab-init-walkthrough-vulnhub.html) |
| | [Readys](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Roquefort](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Shenzi](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [SickOs 1.2](https://www.vulnhub.com/entry/sickos-12,144/) Vulnhub Show spoilers http-put-method webshell-upload cron-job chkrootkit-exploit | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | – |
| | [Slort](https://portal.offsec.com/labs/practice) Proving Grounds | Windows | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Snookums](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Spydersec](https://www.vulnhub.com/entry/spydersec-challenge,128/) Vulnhub Show spoilers web-recon cookie-manipulation steganography exif-metadata base64-decoding truecrypt-volume-decryption | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [research.g0blin.co.uk](https://research.g0blin.co.uk/spydersec-challenge-vulnhub-writeup/) |
| | [Stapler 1](https://www.vulnhub.com/entry/stapler-1,150/) Vulnhub Show spoilers smb-enumeration wordpress-enumeration lfi credential-disclosure sudo-misconfiguration | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [jhalon.github.io](https://jhalon.github.io/vulnhub-stapler1/) |
| | [Temple of Doom](https://www.vulnhub.com/entry/temple-of-doom-1,243/) Vulnhub Show spoilers insecure-deserialization nodejs-rce reverse-shell credential-reuse sudo-misconfiguration tcpdump-privesc | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.infosecinstitute.com](https://www.infosecinstitute.com/topic/temple-of-doom-1-vulnhub-ctf-walkthrough/) |
| | [Walla](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Wallaby's Nightmare](https://www.vulnhub.com/entry/wallabys-nightmare-v102,176/) Vulnhub Show spoilers command-injection php-reverse-shell sudo-vim irc-bot-abuse iptables-manipulation sudo-misconfiguration | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.abatchy.com](http://www.abatchy.com/2017/01/wallabys-nightmare-walkthrough-vulnhub.html) |
| | [Xposedapi](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Zino](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Bart](https://app.hackthebox.com/machines/Bart?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers vhost-enumeration username-enumeration password-brute-force log-poisoning lfi autologon-credentials | Windows | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/07/15/htb-bart.html) |
| | [Bitlab](https://app.hackthebox.com/machines/Bitlab?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers gitlab-enumeration javascript-deobfuscation webshell-deploy postgresql-credential-dump git-hook-abuse sudo-git-pull | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/01/11/htb-bitlab.html) |
| | [Book](https://app.hackthebox.com/machines/Book?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-truncation stored-xss local-file-read ssh-key-abuse logrotten cron-job | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/07/11/htb-book.html) |
| | [Breach 1](https://www.vulnhub.com/entry/breach-1,152/) Vulnhub Show spoilers information-disclosure ssl-decryption pcap-analysis keystore-cracking tomcat-war-upload metadata-analysis cron-job sudo-misconfiguration | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/hack-breach-1-0-vm-ctf-challenges/) |
| | [Celestial](https://app.hackthebox.com/machines/Celestial?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers nodejs-deserialization cookie-tampering-rce cron-abuse | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/08/25/htb-celestial.html) |
| | [Conceal](https://app.hackthebox.com/machines/Conceal?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers snmp-enumeration ipsec-vpn ike-scan ftp-upload asp-webshell juicypotato | Windows | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/conceal) |
| | [DevOops](https://app.hackthebox.com/machines/DevOops?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers xxe file-upload ssh-key-abuse git-history information-disclosure | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/10/13/htb-devoops.html) |
| | [Digitalworld.local (Bravery)](https://www.vulnhub.com/entry/digitalworldlocal-bravery,281/) Vulnhub Show spoilers nfs-enumeration smb-enumeration cuppa-cms remote-file-inclusion php-reverse-shell suid-cp etc-passwd-write | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/digitalworld-local-bravery-vulnhub-walkthrough/) |
| | [Digitalworld.local (FALL)](https://www.vulnhub.com/entry/digitalworldlocal-fall,726/) Vulnhub Show spoilers web-enumeration parameter-fuzzing local-file-inclusion ssh-private-key bash-history credential-reuse sudo-misconfiguration | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/digital-world-local-fall-vulnhub-walkthrough/) |
| | [Digitalworld.local (JOY)](https://www.vulnhub.com/entry/digitalworldlocal-joy,298/) Vulnhub Show spoilers anonymous-ftp proftpd-mod-copy ftp-upload credential-harvesting sudo-misconfiguration script-abuse | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/digitalworld-local-joy-vulnhub-walkthrough/) |
| | [Digitalworld.local (Mercy v2)](https://www.vulnhub.com/entry/digitalworldlocal-mercy-v2,263/) Vulnhub Show spoilers smb-enumeration port-knocking local-file-inclusion tomcat-manager war-upload writable-cron weak-credentials | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/mercy-vulnhub-walkthrough/) |
| | [Djinn 1](https://www.vulnhub.com/entry/djinn-1,397/) Vulnhub Show spoilers ftp-anonymous command-injection sudo-misconfiguration python-eval-injection environment-variable-injection privilege-escalation | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | – |
| | [Dynstr](https://app.hackthebox.com/machines/Dynstr?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers command-injection dns-manipulation ssh-key-abuse wildcard-injection information-disclosure | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/10/16/htb-dynstr.html) |
| | [Escalate_Linux 1](https://www.vulnhub.com/entry/escalatelinux-1,323/) Vulnhub Show spoilers command-injection suid sudo-misconfiguration cron-job path-hijacking writable-passwd ld-preload | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/escalate_linux-vulnhub-walkthrough-part-1/) |
| | [Forge](https://app.hackthebox.com/machines/Forge?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ssrf ssrf-filter-bypass open-redirect ftp-via-ssrf ssh-key-theft python-pdb-abuse sudo-misconfiguration | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/01/22/htb-forge.html) |
| | [Glasgow Smile 1.1](https://www.vulnhub.com/entry/glasgow-smile-11,491/) Vulnhub Show spoilers joomla-enumeration cewl-brute-force template-webshell-rce credential-decoding zip-password-cracking cron-job | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/glasgow-smile-1-1-vulnhub-walkthrough/) |
| | [Hacker Kid 1.0.1](https://www.vulnhub.com/entry/hacker-kid-101,719/) Vulnhub Show spoilers dns-zone-transfer xxe-injection ssrf server-side-template-injection linux-capabilities cap-setuid | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | – |
| | [HackPark](https://tryhackme.com/room/hackpark) TryHackMe Show spoilers brute-force blogengine-rce cve-2019-6714 file-upload insecure-service-permissions winpeas | Windows | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [steflan-security.com](https://steflan-security.com/tryhackme-hackpark-walkthrough/) |
| | [Haircut](https://app.hackthebox.com/machines/Haircut?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers command-injection argument-injection php-webshell suid screen-exploit | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/09/10/htb-haircut.html) |
| | [Json](https://app.hackthebox.com/machines/Json?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers dotnet-json-deserialization bearer-token-abuse juicypotato seimpersonateprivilege | Windows | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/02/15/htb-json.html) |
| | [LaCasaDePapel](https://app.hackthebox.com/machines/LaCasaDePapel?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers vsftpd-backdoor php-code-execution client-certificate-forgery path-traversal ssh-key-abuse | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/07/27/htb-lacasadepapel.html) |
| | [Nineveh](https://app.hackthebox.com/machines/Nineveh?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers vhost-enumeration credential-bruteforce phpliteadmin-rce local-file-inclusion port-knocking chkrootkit-exploit | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/04/22/htb-nineveh.html) |
| | [OpenKeyS](https://app.hackthebox.com/machines/OpenKeyS?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers local-file-inclusion openbsd-auth-bypass-cve-2019-19521 auth-userokay-abuse suid-privesc | OpenBSD | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/12/12/htb-openkeys.html) |
| | [Ophiuchi](https://app.hackthebox.com/machines/Ophiuchi?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers yaml-deserialization snakeyaml tomcat sudo-misconfiguration webassembly relative-path-hijack | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/ophiuchi) |
| | [Overpass 2 - Hacked](https://tryhackme.com/room/overpass2hacked) TryHackMe Show spoilers pcap-analysis wireshark insecure-file-upload reverse-shell hash-cracking ssh-backdoor suid-binary | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [steflan-security.com](https://steflan-security.com/tryhackme-overpass-2/) |
| | [Passage](https://app.hackthebox.com/machines/Passage?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers cutenews-rce file-upload php-webshell password-cracking ssh-key-reuse usbcreator-dbus | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/03/06/htb-passage.html) |
| | [Pit](https://app.hackthebox.com/machines/Pit?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers snmp-enumeration seeddms-authenticated-upload webshell credential-reuse cockpit-access snmp-extend-privesc | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [HackIndex.io](https://hackindex.io/writeups/pit) |
| | [Poison](https://app.hackthebox.com/machines/Poison?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers local-file-inclusion log-poisoning webshell password-decryption vnc-exploitation port-forwarding | FreeBSD | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/09/08/htb-poison.html) |
| | [Popcorn](https://app.hackthebox.com/machines/Popcorn?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers directory-bruteforce file-upload-bypass webshell cve-2010-0832 kernel-exploit | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/06/23/htb-popcorn.html) |
| | [Prime 1](https://www.vulnhub.com/entry/prime-1,358/) Vulnhub Show spoilers directory-enumeration local-file-inclusion wordpress wpscan php-injection theme-editor kernel-exploit | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [www.hackingarticles.in](https://www.hackingarticles.in/prime-1-vulnhub-walkthrough/) |
| | [Ready](https://app.hackthebox.com/machines/Ready?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers gitlab-rce ssrf cve-2018-19571 password-reuse docker-privileged-escape | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/05/15/htb-ready.html) |
| | [Relevant](https://tryhackme.com/room/relevant) TryHackMe Show spoilers smb-enumeration credential-disclosure web-shell-upload seimpersonateprivilege printspoofer eternalblue | Windows | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [steflan-security.com](https://steflan-security.com/tryhackme-relevant-walkthrough/) |
| | [Seal](https://app.hackthebox.com/machines/Seal?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers gitbucket-enumeration git-credential-leak nginx-path-normalization tomcat-manager-war-upload ansible-symlink-abuse sudo-ansible-playbook | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/11/13/htb-seal.html) |
| | [Skynet](https://tryhackme.com/room/skynet) TryHackMe Show spoilers smb-enumeration brute-force remote-file-inclusion cuppa-cms cron-job tar-wildcard-injection | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [steflan-security.com](https://steflan-security.com/tryhackme-skynet-walkthrough/) |
| | [SneakyMailer](https://app.hackthebox.com/machines/SneakyMailer?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers phishing smtp-enumeration imap-access ftp-upload php-webshell pypi-package sudo-pip | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/11/28/htb-sneakymailer.html) |
| | [Sniper](https://app.hackthebox.com/machines/Sniper?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers lfi rfi webshell credential-reuse malicious-chm phishing | Windows | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/03/28/htb-sniper.html) |
| | [TartarSauce](https://app.hackthebox.com/machines/TartarSauce?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers wordpress-plugin-rfi remote-file-inclusion sudo-tar gtfobins cron-job | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/10/20/htb-tartarsauce.html) |
| | [Time](https://app.hackthebox.com/machines/Time?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers java-deserialization jackson-databind cve-2019-12384 systemd-timer writable-script | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/04/03/htb-time.html) |
| | [Vault](https://app.hackthebox.com/machines/Vault?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers file-upload-webshell network-pivoting dns-tunneling ssh-port-forwarding gpg-decryption | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/04/06/htb-vault.html) |
| | [Worker](https://app.hackthebox.com/machines/Worker?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers svn-enumeration credential-leak azure-devops webshell-upload ci-cd-pipeline-abuse | Windows | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/01/30/htb-worker.html) |
| | [Zico2](https://www.vulnhub.com/entry/zico2-1,210/) Vulnhub Show spoilers local-file-inclusion phpliteadmin-rce default-credentials password-reuse sudo-tar gtfobins | Linux | Medium | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [download.vulnhub.com](https://download.vulnhub.com/media/zico/rafael_zico-walkthrough.pdf) |
| | [Clue](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Hard | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Kotarak](https://app.hackthebox.com/machines/Kotarak?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ssrf tomcat-war-deployment ntds-dit-extraction hash-cracking wget-cve-2016-4971 | Linux | Hard | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/05/19/htb-kotarak.html) |
| | [Talkative](https://app.hackthebox.com/machines/Talkative?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers jamovi-rce bolt-cms template-injection mongodb-abuse rocketchat-webhook docker-pivoting ssh-pivoting | Linux | Hard | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/08/27/htb-talkative.html) |
| | [Vault]() TryHackMe Show spoilers file-upload-bypass web-shell ssh-tunneling openvpn-config-abuse gpg-decryption firewall-evasion | Linux | Hard | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/04/06/htb-vault.html) |
| | [Wintermute](https://www.vulnhub.com/entry/wintermute-1,239/) Vulnhub Show spoilers haraka-smtp-rce screen-privilege-escalation pivoting port-forwarding log-poisoning local-file-inclusion | Linux | Hard | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | – |
| | [Wreath](https://tryhackme.com/room/wreath) TryHackMe Show spoilers webmin-rce pivoting port-forwarding gitstack-rce file-upload antivirus-evasion insecure-service-permissions | Linux/Windows (network) | Hard | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | – |
| | [Zipper](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Hard | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | Not allowed |
| | [Stacked](https://app.hackthebox.com/machines/Stacked?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers stored-xss aws-localstack-abuse lambda-command-injection command-injection docker-escape | Linux | Insane | [Common Web Application Attacks](https://hackindex.io/learn/oscp-pen-200-study-path/common-web-application-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/03/19/htb-stacked.html) |

HackIndex is independent study material, not affiliated with, endorsed by, or sponsored by OffSec. OSCP® and OffSec® are registered trademarks of OffSec Services Limited. PEN-200 is an OffSec course designation. This study path uses only original HackIndex content and links to OffSec's official pages as the authoritative source.