OSWA · Practice machines

OSWA Practice Machines

Our curated list of machines that train the same skills as the OSWA syllabus, mapped to the module they fit best. Techniques are hidden behind spoilers, and machines whose platform forbids public solutions only show a name and link.

120 machines 12 with a HackIndex.io writeup

Done	Machine	OS	Difficulty	Module	Writeup
Mark Basic clickjacking with CSRF token protection as done	Basic clickjacking with CSRF token protection PortSwigger Show spoilers clickjacking ui-redressing iframe-overlay csrf	N/A	Apprentice	Cross-Origin Attacks	hackmd.io
Mark PortSwigger Web Security Academy - NoSQL injection as done	PortSwigger Web Security Academy - NoSQL injection PortSwigger Show spoilers nosql-injection operator-injection auth-bypass mongodb	N/A	Mixed	SQL Injection	–
Mark File Path Traversal (Web Security Academy) as done	File Path Traversal (Web Security Academy) PortSwigger Show spoilers directory-traversal path-traversal absolute-path-bypass url-decode-bypass null-byte-bypass	N/A	Apprentice-Practitioner	Directory Traversal and File Inclusion	medium.com
Mark XML External Entity (XXE) Injection as done	XML External Entity (XXE) Injection PortSwigger Show spoilers xxe file-disclosure ssrf blind-xxe xinclude out-of-band	N/A	Apprentice-Practitioner	XML External Entities	ricardojoserf.github.io
Mark Web Security Academy: Server-side template injection as done	Web Security Academy: Server-side template injection PortSwigger Show spoilers ssti template-injection jinja2 twig freemarker rce	N/A	Mixed	Server-side Template Injection	–
Mark OS command injection (Web Security Academy) as done	OS command injection (Web Security Academy) PortSwigger Show spoilers os-command-injection blind-command-injection time-delays output-redirection out-of-band	N/A	Apprentice/Practitioner	Command Injection	–
Mark Access control vulnerabilities and privilege escalation as done	Access control vulnerabilities and privilege escalation PortSwigger Show spoilers idor horizontal-privilege-escalation vertical-privilege-escalation broken-access-control parameter-tampering	N/A	Mixed (Apprentice to Expert)	Insecure Direct Object References (IDOR)	–
Mark SQLi-Labs as done	SQLi-Labs Standalone Show spoilers SQL injection Error-based injection Boolean/blind injection Time-based injection UNION-based injection Second-order injection	N/A	Training	Full Web Application Assessment	–
Mark OWASP NodeGoat as done	OWASP NodeGoat Standalone Show spoilers Server-side JavaScript injection NoSQL injection Broken access control / IDOR SSRF Cross-Site Scripting CSRF	N/A	Training	Server-side Request Forgery	–
Mark Google XSS Game as done	Google XSS Game Standalone Show spoilers Cross-Site Scripting Reflected XSS Stored XSS DOM-based XSS Filter/sanitization bypass	N/A	Training	Cross-Site Scripting: Exploitation	–
Mark Astronaut as done	Astronaut Proving Grounds	Linux	Easy	Server-side Template Injection	HackIndex.io
Mark Web Security Academy - Cross-Site Scripting as done	Web Security Academy - Cross-Site Scripting PortSwigger Show spoilers reflected-xss stored-xss dom-based-xss waf-bypass cookie-theft	N/A	Mixed (Apprentice to Expert)	Cross-Site Scripting: Exploitation	–
Mark CORS vulnerability with basic origin reflection as done	CORS vulnerability with basic origin reflection PortSwigger Show spoilers cors-misconfiguration origin-reflection credential-theft cross-origin-read	N/A	Apprentice	Cross-Origin Attacks	ricardojoserf.github.io
Mark PortSwigger Web Security Academy - SQL injection as done	PortSwigger Web Security Academy - SQL injection PortSwigger Show spoilers union-based-sqli blind-sqli error-based-sqli auth-bypass sqlmap	N/A	Mixed	SQL Injection	github.com
Mark File Upload Vulnerabilities (Web Security Academy) as done	File Upload Vulnerabilities (Web Security Academy) PortSwigger Show spoilers file-upload web-shell content-type-bypass extension-blacklist-bypass polyglot-upload race-condition	N/A	Apprentice-Practitioner	Directory Traversal and File Inclusion	yashfren.github.io
Mark Command Injection as done	Command Injection TryHackMe Show spoilers os-command-injection ping-parameter input-validation reverse-shell	Linux	Easy	Command Injection	github.com
Mark SSRF (Server-Side Request Forgery) as done	SSRF (Server-Side Request Forgery) PortSwigger Show spoilers ssrf blacklist-bypass whitelist-bypass open-redirect blind-ssrf out-of-band	N/A	Mixed	Server-side Request Forgery	portswigger.net
Mark OWASP Juice Shop as done	OWASP Juice Shop Standalone Show spoilers idor broken-access-control horizontal-privilege-escalation forced-browsing jwt	N/A	Mixed	Insecure Direct Object References (IDOR)	help.owasp-juice.shop
Mark bWAPP (buggy web application) as done	bWAPP (buggy web application) Standalone Show spoilers sql-injection xss command-injection xxe ssrf	N/A	Beginner	Full Web Application Assessment	–
Mark XVWA (Xtreme Vulnerable Web Application) as done	XVWA (Xtreme Vulnerable Web Application) Standalone Show spoilers SQL injection Cross-Site Scripting OS command injection XML External Entity (XXE) Server-Side Request Forgery File inclusion / path traversal Unrestricted file upload CSRF	N/A	Training	XML External Entities	–
Mark Doctor as done	Doctor HackTheBox Show spoilers ssti jinja2-template-injection log-analysis splunk-universal-forwarder splunkwhisperer2	Linux	Easy	Server-side Template Injection	HackIndex.io
Mark Editorial as done	Editorial HackTheBox Show spoilers ssrf-image-upload internal-api-leak git-log-credential-hunt python-library-hijack sudo-git-abuse	Linux	Easy	Server-side Request Forgery	0xdf.gitlab.io
Mark Hawat as done	Hawat Proving Grounds	Linux	Easy	SQL Injection	Not allowed
Mark Alert as done	Alert HackTheBox Show spoilers xss markdown-injection file-read password-cracking	Linux	Easy	Cross-Site Scripting: Exploitation	0xdf.gitlab.io
Mark CORS vulnerability with trusted null origin as done	CORS vulnerability with trusted null origin PortSwigger Show spoilers cors-misconfiguration null-origin sandboxed-iframe credential-theft	N/A	Apprentice	Cross-Origin Attacks	ricardojoserf.github.io
Mark File Inclusion as done	File Inclusion TryHackMe Show spoilers lfi rfi directory-traversal php-wrapper	Linux	Easy	Directory Traversal and File Inclusion	farros.co
Mark MonitorsTwo as done	MonitorsTwo HackTheBox Show spoilers cacti command-injection cve-2022-46169 auth-bypass reverse-shell	Linux	Easy	Command Injection	0xdf.gitlab.io
Mark Bookstore as done	Bookstore TryHackMe Show spoilers api-idor api-enumeration broken-object-level-authorization parameter-tampering	Linux	Easy	Insecure Direct Object References (IDOR)	www.hackingarticles.in
Mark DVWA (Damn Vulnerable Web Application) as done	DVWA (Damn Vulnerable Web Application) Standalone Show spoilers sql-injection xss command-injection file-upload file-inclusion csrf	N/A	Beginner	Full Web Application Assessment	–
Mark PentesterLab: Web For Pentester as done	PentesterLab: Web For Pentester Vulnhub Show spoilers Cross-Site Scripting SQL injection Directory traversal Local/Remote File Inclusion Command injection XML / XXE attacks Code injection	Linux	Beginner	XML External Entities	–
Mark FriendZone as done	FriendZone HackTheBox Show spoilers dns-zone-transfer smb-enumeration local-file-inclusion credential-reuse python-library-hijacking cron-job	Linux	Easy	Directory Traversal and File Inclusion	HackIndex.io
Mark OpenAdmin as done	OpenAdmin HackTheBox Show spoilers opennetadmin-rce credential-reuse ssh-key-cracking sudo-nano gtfobins	Linux	Easy	Command Injection	HackIndex.io
Mark Headless as done	Headless HackTheBox Show spoilers reflected-xss cookie-theft header-injection command-injection	Linux	Easy	Cross-Site Scripting: Exploitation	0xdf.gitlab.io
Mark CSRF vulnerability with no defenses as done	CSRF vulnerability with no defenses PortSwigger Show spoilers csrf state-changing-request auto-submit-form	N/A	Apprentice	Cross-Origin Attacks	hackmd.io
Mark Pentester Lab: Play XML Entities as done	Pentester Lab: Play XML Entities Vulnhub Show spoilers xxe file-disclosure dtd	Linux	Easy	XML External Entities	–
Mark Neonify as done	Neonify HackTheBox Show spoilers ssti erb ruby filter-bypass	N/A	Easy	Server-side Template Injection	drt.sh
Mark Intro to SSRF as done	Intro to SSRF TryHackMe Show spoilers ssrf blind-ssrf filter-bypass internal-service-access	N/A	Easy	Server-side Request Forgery	oluwakamiye.medium.com
Mark Corridor as done	Corridor TryHackMe Show spoilers idor md5-hash-cracking enumeration automation	N/A	Easy	Insecure Direct Object References (IDOR)	medium.com
Mark Google Gruyere as done	Google Gruyere Standalone Show spoilers xss csrf path-traversal information-disclosure remote-code-execution	N/A	Beginner	Full Web Application Assessment	–
Mark Kioptrix Level 2 as done	Kioptrix Level 2 Vulnhub Show spoilers SQL injection SQLi login/authentication bypass Command injection (ping form RCE)	Linux	Easy	SQL Injection	www.abatchy.com
Mark Forge as done	Forge HackTheBox Show spoilers ssrf ssrf-filter-bypass open-redirect ftp-via-ssrf ssh-key-theft python-pdb-abuse sudo-misconfiguration	Linux	Medium	Server-side Request Forgery	0xdf.gitlab.io
Mark Intro to Cross-site Scripting as done	Intro to Cross-site Scripting TryHackMe Show spoilers reflected-xss stored-xss dom-based-xss blind-xss	N/A	Easy	Cross-Site Scripting: Exploitation	medium.com
Mark CORS vulnerability with trusted insecure protocols as done	CORS vulnerability with trusted insecure protocols PortSwigger Show spoilers cors-misconfiguration trusted-subdomain xss-to-cors insecure-http-origin	N/A	Practitioner	Cross-Origin Attacks	ricardojoserf.github.io
Mark NodeBlog as done	NodeBlog HackTheBox Show spoilers nosql-injection auth-bypass xxe	Linux	Easy	SQL Injection	0xdf.gitlab.io
Mark Inclusion as done	Inclusion TryHackMe Show spoilers lfi directory-traversal	Linux	Easy	Directory Traversal and File Inclusion	0xsanz.medium.com
Mark XXE Injection as done	XXE Injection TryHackMe Show spoilers xxe in-band out-of-band ssrf	N/A	Easy	XML External Entities	medium.com
Mark Nunchucks as done	Nunchucks HackTheBox Show spoilers ssti nunjucks nodejs rce	Linux	Easy	Server-side Template Injection	0xdf.gitlab.io
Mark Photobomb as done	Photobomb HackTheBox Show spoilers command-injection parameter-injection credential-discovery reverse-shell	Linux	Easy	Command Injection	0xdf.gitlab.io
Mark IDOR as done	IDOR TryHackMe Show spoilers idor encoded-ids hashed-ids parameter-tampering burp-suite	N/A	Easy	Insecure Direct Object References (IDOR)	notesbynisha.com
Mark OWASP Mutillidae II as done	OWASP Mutillidae II Standalone Show spoilers sql-injection xss command-injection html-injection file-inclusion	N/A	Beginner	Full Web Application Assessment	–
Mark Kotarak as done	Kotarak HackTheBox Show spoilers ssrf tomcat-war-deployment ntds-dit-extraction hash-cracking wget-cve-2016-4971	Linux	Hard	Server-side Request Forgery	0xdf.gitlab.io
Mark Pentester Lab: XSS and MySQL FILE as done	Pentester Lab: XSS and MySQL FILE Vulnhub Show spoilers reflected-xss cookie-theft sql-injection code-execution	Linux	Easy	Cross-Site Scripting: Exploitation	medium.com
Mark CSRF where Referer validation depends on header being present as done	CSRF where Referer validation depends on header being present PortSwigger Show spoilers csrf referer-validation-bypass referrer-policy	N/A	Practitioner	Cross-Origin Attacks	hackmd.io
Mark Pentester Lab: From SQL injection to Shell as done	Pentester Lab: From SQL injection to Shell Vulnhub Show spoilers union-sqli database-dump webshell	Linux	Easy	SQL Injection	pentesterarchive.github.io
Mark XXE Lab: 1 as done	XXE Lab: 1 Vulnhub Show spoilers xxe file-disclosure blind-xxe	Linux	Easy	XML External Entities	–
Mark SSTI as done	SSTI TryHackMe Show spoilers ssti jinja2 flask rce	N/A	Easy	Server-side Template Injection	motasem-notes.net
Mark Precious as done	Precious HackTheBox Show spoilers pdfkit command-injection cve-2022-25765 reverse-shell	Linux	Easy	Command Injection	0xdf.gitlab.io
Mark IDOR - Santa's Little IDOR as done	IDOR - Santa's Little IDOR TryHackMe Show spoilers idor horizontal-privilege-escalation burp-intruder parameter-tampering	N/A	Easy	Insecure Direct Object References (IDOR)	pawan7.medium.com
Mark OWASP WebGoat as done	OWASP WebGoat Standalone Show spoilers sql-injection xss insecure-deserialization jwt-manipulation xxe	N/A	Beginner	Full Web Application Assessment	–
Mark Inclusiveness as done	Inclusiveness Proving Grounds	Linux	Easy	Directory Traversal and File Inclusion	Not allowed
Mark Networked as done	Networked HackTheBox Show spoilers file-upload-bypass double-extension command-injection cron-job sudo-misconfiguration ifcfg-injection	Linux	Easy	Directory Traversal and File Inclusion	0xdf.gitlab.io
Mark Sau as done	Sau HackTheBox Show spoilers request-baskets-ssrf-cve-2023-27163 maltrail-command-injection systemctl-sudo-gtfobins	Linux	Easy	Command Injection	0xdf.gitlab.io
Mark Sea as done	Sea HackTheBox Show spoilers xss wondercms cve-2023-41425 command-injection	Linux	Easy	Cross-Site Scripting: Exploitation	0xdf.gitlab.io
Mark CSRF where token is not tied to user session as done	CSRF where token is not tied to user session PortSwigger Show spoilers csrf csrf-token-bypass token-reuse	N/A	Practitioner	Cross-Origin Attacks	hackmd.io
Mark Shoppy as done	Shoppy HackTheBox Show spoilers nosql-injection auth-bypass operator-injection	Linux	Easy	SQL Injection	0xdf.gitlab.io
Mark Aragog as done	Aragog HackTheBox Show spoilers xxe file-disclosure wordpress credential-reuse	Linux	Medium	XML External Entities	0xdf.gitlab.io
Mark Templated as done	Templated HackTheBox Show spoilers ssti jinja2 flask rce	N/A	Easy	Server-side Template Injection	github.com
Mark Nimbus as done	Nimbus HackTheBox Show spoilers ssrf cloud-metadata imds filter-bypass aws-credentials	Linux	Hard	Server-side Request Forgery	HackIndex.io
Mark Neighbour as done	Neighbour TryHackMe Show spoilers idor authentication-bypass source-code-review parameter-tampering	N/A	Easy	Insecure Direct Object References (IDOR)	medium.com
Mark BountyHunter as done	BountyHunter HackTheBox Show spoilers xxe information-disclosure credential-reuse python-eval-injection	Linux	Easy	Full Web Application Assessment	0xdf.gitlab.io
Mark CozyHosting as done	CozyHosting HackTheBox Show spoilers spring-boot-actuator session-hijack command-injection postgresql-credential-dump hash-cracking ssh-sudo-gtfobins	Linux	Easy	Full Web Application Assessment	0xdf.gitlab.io
Mark DevOops as done	DevOops HackTheBox Show spoilers xxe file-upload ssh-key-abuse git-history information-disclosure	Linux	Medium	XML External Entities	0xdf.gitlab.io
Mark Shocker as done	Shocker HackTheBox Show spoilers directory-enumeration cgi-bin shellshock cve-2014-6271 sudo-perl	Linux	Easy	Command Injection	0xdf.gitlab.io
Mark Soccer as done	Soccer HackTheBox Show spoilers tiny-file-manager-default-creds file-upload-webshell websocket-sql-injection doas-dstat-privesc	Linux	Easy	SQL Injection	0xdf.gitlab.io
Mark XSS as done	XSS TryHackMe Show spoilers reflected-xss stored-xss dom-based-xss filter-bypass	N/A	Easy	Cross-Site Scripting: Exploitation	medium.com
Mark CSRF where token validation depends on request method as done	CSRF where token validation depends on request method PortSwigger Show spoilers csrf csrf-token-bypass http-method-change	N/A	Practitioner	Cross-Origin Attacks	hackmd.io
Mark JinjaCare as done	JinjaCare HackTheBox Show spoilers ssti jinja2 flask filter-bypass rce	N/A	Medium	Server-side Template Injection	dev.to
Mark OWASP Broken Access Control as done	OWASP Broken Access Control TryHackMe Show spoilers broken-access-control idor privilege-escalation parameter-tampering	N/A	Easy	Insecure Direct Object References (IDOR)	medium.com
Mark Pilgrimage as done	Pilgrimage HackTheBox Show spoilers Arbitrary file read LFI (ImageMagick CVE-2022-44268) Source code disclosure via exposed .git git-dumper	Linux	Easy	Directory Traversal and File Inclusion	0xdf.gitlab.io
Mark Pelican as done	Pelican Proving Grounds	Linux	Intermediate	Command Injection	HackIndex.io
Mark Clipper as done	Clipper Proving Grounds	Linux	Intermediate	Cross-Site Scripting: Exploitation	Not allowed
Mark Exploiting clickjacking vulnerability to trigger DOM-based XSS as done	Exploiting clickjacking vulnerability to trigger DOM-based XSS PortSwigger Show spoilers clickjacking ui-redressing dom-xss iframe-overlay	N/A	Practitioner	Cross-Origin Attacks	hackmd.io
Mark Stocker as done	Stocker HackTheBox Show spoilers nosql-injection auth-bypass operator-injection	Linux	Easy	SQL Injection	0xdf.gitlab.io
Mark RootMe as done	RootMe TryHackMe Show spoilers file-upload extension-bypass web-shell reverse-shell	Linux	Easy	Directory Traversal and File Inclusion	HackIndex.io
Mark Patents as done	Patents HackTheBox Show spoilers xxe docx-upload lfi source-code-disclosure	Linux	Hard	XML External Entities	0xdf.gitlab.io
Mark Server-side Template Injection as done	Server-side Template Injection TryHackMe Show spoilers ssti template-injection jinja2 rce	N/A	Medium	Server-side Template Injection	classroom.anir0y.in
Mark GoodGames as done	GoodGames HackTheBox Show spoilers sql-injection ssti password-reuse docker-escape	Linux	Easy	Full Web Application Assessment	0xdf.gitlab.io
Mark Awkward as done	Awkward HackTheBox Show spoilers Server-Side Request Forgery Local File Inclusion IDOR / API access control Information disclosure	Linux	Medium	Insecure Direct Object References (IDOR)	infosecwriteups.com
Mark Titanic as done	Titanic HackTheBox Show spoilers local-file-inclusion gitea-config-disclosure sqlite-database-dump hash-cracking imagemagick-cve-2024-41817	Linux	Easy	Directory Traversal and File Inclusion	0xdf.gitlab.io
Mark IClean as done	IClean HackTheBox Show spoilers stored-xss cookie-theft ssti password-cracking	Linux	Medium	Cross-Site Scripting: Exploitation	0xdf.gitlab.io
Mark SameSite Lax bypass via method override as done	SameSite Lax bypass via method override PortSwigger Show spoilers csrf samesite-bypass samesite-lax method-override	N/A	Practitioner	Cross-Origin Attacks	hackmd.io
Mark Trick as done	Trick HackTheBox Show spoilers sqli-auth-bypass union-sqli file-read	Linux	Easy	SQL Injection	0xdf.gitlab.io
Mark Potato as done	Potato Proving Grounds	Linux	Easy	Full Web Application Assessment	HackIndex.io
Mark Previse as done	Previse HackTheBox Show spoilers broken-access-control execute-after-redirect command-injection password-cracking path-hijacking sudo-misconfiguration	Linux	Easy	Full Web Application Assessment	0xdf.gitlab.io
Mark Imagery as done	Imagery HackTheBox Show spoilers stored-xss blind-xss directory-traversal rce	Linux	Medium	Cross-Site Scripting: Exploitation	0xdf.gitlab.io
Mark SameSite Strict bypass via client-side redirect as done	SameSite Strict bypass via client-side redirect PortSwigger Show spoilers csrf samesite-bypass samesite-strict client-side-redirect	N/A	Practitioner	Cross-Origin Attacks	hackmd.io
Mark Usage as done	Usage HackTheBox Show spoilers blind-sqli boolean-based-sqli sqlmap	Linux	Easy	SQL Injection	0xdf.gitlab.io
Mark Upload Vulnerabilities as done	Upload Vulnerabilities TryHackMe Show spoilers file-upload web-shell client-side-bypass content-type-bypass	Linux	Easy	Directory Traversal and File Inclusion	www.jalblas.com
Mark Magic as done	Magic HackTheBox Show spoilers sql-injection file-upload php-webshell credential-reuse path-hijacking suid	Linux	Medium	Directory Traversal and File Inclusion	HackIndex.io
Mark BlockSynergy as done	BlockSynergy HackTheBox Show spoilers stored-xss ssrf command-injection path-traversal	Linux	Insane	Cross-Site Scripting: Exploitation	HackIndex.io
Mark CSRF as done	CSRF TryHackMe Show spoilers csrf state-changing-request session-riding same-site-cookies	N/A	Easy	Cross-Origin Attacks	medium.com
Mark Validation as done	Validation HackTheBox Show spoilers second-order-sqli file-write webshell	Linux	Easy	SQL Injection	0xdf.gitlab.io
Mark Sumo as done	Sumo Proving Grounds	Linux	Easy	Full Web Application Assessment	Not allowed
Mark Poison as done	Poison HackTheBox Show spoilers local-file-inclusion log-poisoning webshell password-decryption vnc-exploitation port-forwarding	FreeBSD	Medium	Directory Traversal and File Inclusion	0xdf.gitlab.io
Mark Writeup as done	Writeup HackTheBox Show spoilers blind-sqli cms-made-simple credential-dump	Linux	Easy	SQL Injection	0xdf.gitlab.io
Mark Interface as done	Interface Proving Grounds	Linux	Intermediate	Full Web Application Assessment	Not allowed
Mark Popcorn as done	Popcorn HackTheBox Show spoilers directory-bruteforce file-upload-bypass webshell cve-2010-0832 kernel-exploit	Linux	Medium	Directory Traversal and File Inclusion	0xdf.gitlab.io
Mark Cockpit as done	Cockpit Proving Grounds	Linux	Intermediate	SQL Injection	Not allowed
Mark OWASP Security Shepherd as done	OWASP Security Shepherd Standalone Show spoilers sql-injection xss csrf idor session-management	N/A	Intermediate	Full Web Application Assessment	–
Mark DC-9 as done	DC-9 Vulnhub Show spoilers union-sqli manual-sqli credential-dump lfi	Linux	Intermediate	SQL Injection	novasky.medium.com
Mark MonitorsThree as done	MonitorsThree HackTheBox Show spoilers sql-injection cacti-rce authenticated-file-write credential-harvesting	Linux	Medium	Full Web Application Assessment	0xdf.gitlab.io
Mark PC as done	PC Proving Grounds	Linux	Intermediate	SQL Injection	Not allowed
Mark Mr-Robot: 1 as done	Mr-Robot: 1 Vulnhub Show spoilers robots-txt wordpress-enumeration credential-bruteforce php-reverse-shell	Linux	Medium	Full Web Application Assessment	www.abatchy.com
Mark Jarvis as done	Jarvis HackTheBox Show spoilers sql-injection waf-bypass phpmyadmin-rce command-injection sudo-misconfiguration systemctl-gtfobins	Linux	Medium	SQL Injection	HackIndex.io
Mark Mango as done	Mango HackTheBox Show spoilers nosql-injection mongodb credential-extraction password-reuse jjs-suid	Linux	Medium	SQL Injection	HackIndex.io
Mark Union as done	Union HackTheBox Show spoilers SQL injection Second-order SQL injection UNION-based injection SQLi file read INTO OUTFILE	Linux	Medium	SQL Injection	0xdf.gitlab.io
Mark Writer as done	Writer HackTheBox Show spoilers sql-injection authentication-bypass command-injection hash-cracking postfix-filter-injection apt-config-injection	Linux	Medium	SQL Injection	0xdf.gitlab.io
Mark Zipping as done	Zipping HackTheBox Show spoilers SQL injection Local File Inclusion File upload (zip symlink arbitrary file read) SQLi INTO OUTFILE to webshell LFI to RCE	Linux	Medium	SQL Injection	0xdf.gitlab.io
Mark Falafel as done	Falafel HackTheBox Show spoilers sql-injection php-type-juggling file-upload video-group-framebuffer disk-group-abuse	Linux	Hard	SQL Injection	0xdf.gitlab.io
Mark Intentions as done	Intentions HackTheBox Show spoilers blind-sqli boolean-based-sqli hash-extraction	Linux	Hard	SQL Injection	0xdf.gitlab.io

HackIndex is independent study material, not affiliated with, endorsed by, or sponsored by OffSec. OSWA® and OffSec® are registered trademarks of OffSec Services Limited. WEB-200 is an OffSec course designation. This study path uses only original HackIndex content and links to OffSec's official pages as the authoritative source.