[OSWA](https://hackindex.io/learn/oswa-web-200-study-path) · Practice machines

## OSWA Practice Machines

Our curated list of machines that train the same skills as the OSWA syllabus, mapped to the module they fit best. Techniques are hidden behind spoilers, and machines whose platform forbids public solutions only show a name and link.

120 machines 12 with a HackIndex.io writeup

Machines completed 0/120

| Done | Machine | OS | Difficulty | Module | Writeup |
| --- | --- | --- | --- | --- | --- |
| | [Basic clickjacking with CSRF token protection](https://portswigger.net/web-security/clickjacking/lab-basic-csrf-protected) PortSwigger Show spoilers clickjacking ui-redressing iframe-overlay csrf | N/A | Apprentice | [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks) | [hackmd.io](https://hackmd.io/@janlele91/SJWKTG5To) |
| | [PortSwigger Web Security Academy - NoSQL injection](https://portswigger.net/web-security/nosql-injection) PortSwigger Show spoilers nosql-injection operator-injection auth-bypass mongodb | N/A | Mixed | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | – |
| | [File Path Traversal (Web Security Academy)](https://portswigger.net/web-security/file-path-traversal) PortSwigger Show spoilers directory-traversal path-traversal absolute-path-bypass url-decode-bypass null-byte-bypass | N/A | Apprentice-Practitioner | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [medium.com](https://medium.com/@blueorionn/portswigger-web-security-academy-all-path-traversal-labs-solved-full-walkthrough-8cccad53d44e) |
| | [XML External Entity (XXE) Injection](https://portswigger.net/web-security/xxe) PortSwigger Show spoilers xxe file-disclosure ssrf blind-xxe xinclude out-of-band | N/A | Apprentice-Practitioner | [XML External Entities](https://hackindex.io/learn/oswa-web-200-study-path/xml-external-entities) | [ricardojoserf.github.io](https://ricardojoserf.github.io/portswiggerlabs/) |
| | [Web Security Academy: Server-side template injection](https://portswigger.net/web-security/server-side-template-injection) PortSwigger Show spoilers ssti template-injection jinja2 twig freemarker rce | N/A | Mixed | [Server-side Template Injection](https://hackindex.io/learn/oswa-web-200-study-path/server-side-template-injection) | – |
| | [OS command injection (Web Security Academy)](https://portswigger.net/web-security/os-command-injection) PortSwigger Show spoilers os-command-injection blind-command-injection time-delays output-redirection out-of-band | N/A | Apprentice/Practitioner | [Command Injection](https://hackindex.io/learn/oswa-web-200-study-path/command-injection) | – |
| | [Access control vulnerabilities and privilege escalation](https://portswigger.net/web-security/access-control) PortSwigger Show spoilers idor horizontal-privilege-escalation vertical-privilege-escalation broken-access-control parameter-tampering | N/A | Mixed (Apprentice to Expert) | [Insecure Direct Object References (IDOR)](https://hackindex.io/learn/oswa-web-200-study-path/insecure-direct-object-referencing) | – |
| | [SQLi-Labs](https://github.com/Audi-1/sqli-labs) Standalone Show spoilers SQL injection Error-based injection Boolean/blind injection Time-based injection UNION-based injection Second-order injection | N/A | Training | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | – |
| | [OWASP NodeGoat](https://github.com/OWASP/NodeGoat) Standalone Show spoilers Server-side JavaScript injection NoSQL injection Broken access control / IDOR SSRF Cross-Site Scripting CSRF | N/A | Training | [Server-side Request Forgery](https://hackindex.io/learn/oswa-web-200-study-path/server-side-request-forgery) | – |
| | [Google XSS Game](https://xss-game.appspot.com/) Standalone Show spoilers Cross-Site Scripting Reflected XSS Stored XSS DOM-based XSS Filter/sanitization bypass | N/A | Training | [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study) | – |
| | [Astronaut](https://portal.offsec.com/machine/astronaut-49479/overview) Proving Grounds | Linux | Easy | [Server-side Template Injection](https://hackindex.io/learn/oswa-web-200-study-path/server-side-template-injection) | [HackIndex.io](https://hackindex.io/writeups/astronaut) |
| | [Web Security Academy - Cross-Site Scripting](https://portswigger.net/web-security/cross-site-scripting) PortSwigger Show spoilers reflected-xss stored-xss dom-based-xss waf-bypass cookie-theft | N/A | Mixed (Apprentice to Expert) | [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study) | – |
| | [CORS vulnerability with basic origin reflection](https://portswigger.net/web-security/cors/lab-basic-origin-reflection-attack) PortSwigger Show spoilers cors-misconfiguration origin-reflection credential-theft cross-origin-read | N/A | Apprentice | [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks) | [ricardojoserf.github.io](https://ricardojoserf.github.io/portswiggerlabs/) |
| | [PortSwigger Web Security Academy - SQL injection](https://portswigger.net/web-security/sql-injection) PortSwigger Show spoilers union-based-sqli blind-sqli error-based-sqli auth-bypass sqlmap | N/A | Mixed | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [github.com](https://github.com/shabarinathkv/sql-injection-labs-portswigger) |
| | [File Upload Vulnerabilities (Web Security Academy)](https://portswigger.net/web-security/file-upload) PortSwigger Show spoilers file-upload web-shell content-type-bypass extension-blacklist-bypass polyglot-upload race-condition | N/A | Apprentice-Practitioner | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [yashfren.github.io](https://yashfren.github.io/posts/FileUploadVulnerabilities_PortswiggerLabs_Walkthrough/) |
| | [Command Injection](https://tryhackme.com/room/oscommandinjection) TryHackMe Show spoilers os-command-injection ping-parameter input-validation reverse-shell | Linux | Easy | [Command Injection](https://hackindex.io/learn/oswa-web-200-study-path/command-injection) | [github.com](https://github.com/Cajac/TryHackMe-Writeups/blob/main/Walkthroughs/Easy/Command_Injection.md) |
| | [SSRF (Server-Side Request Forgery)](https://portswigger.net/web-security/ssrf) PortSwigger Show spoilers ssrf blacklist-bypass whitelist-bypass open-redirect blind-ssrf out-of-band | N/A | Mixed | [Server-side Request Forgery](https://hackindex.io/learn/oswa-web-200-study-path/server-side-request-forgery) | [portswigger.net](https://portswigger.net/web-security/learning-paths/ssrf-attacks) |
| | [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/) Standalone Show spoilers idor broken-access-control horizontal-privilege-escalation forced-browsing jwt | N/A | Mixed | [Insecure Direct Object References (IDOR)](https://hackindex.io/learn/oswa-web-200-study-path/insecure-direct-object-referencing) | [help.owasp-juice.shop](https://help.owasp-juice.shop/part2/broken-access-control.html) |
| | [bWAPP (buggy web application)](https://sourceforge.net/projects/bwapp/) Standalone Show spoilers sql-injection xss command-injection xxe ssrf | N/A | Beginner | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | – |
| | [XVWA (Xtreme Vulnerable Web Application)](https://github.com/s4n7h0/xvwa) Standalone Show spoilers SQL injection Cross-Site Scripting OS command injection XML External Entity (XXE) Server-Side Request Forgery File inclusion / path traversal Unrestricted file upload CSRF | N/A | Training | [XML External Entities](https://hackindex.io/learn/oswa-web-200-study-path/xml-external-entities) | – |
| | [Doctor](https://app.hackthebox.com/machines/Doctor?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ssti jinja2-template-injection log-analysis splunk-universal-forwarder splunkwhisperer2 | Linux | Easy | [Server-side Template Injection](https://hackindex.io/learn/oswa-web-200-study-path/server-side-template-injection) | [HackIndex.io](https://hackindex.io/writeups/doctor) |
| | [Editorial](https://app.hackthebox.com/machines/Editorial?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ssrf-image-upload internal-api-leak git-log-credential-hunt python-library-hijack sudo-git-abuse | Linux | Easy | [Server-side Request Forgery](https://hackindex.io/learn/oswa-web-200-study-path/server-side-request-forgery) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/10/19/htb-editorial.html) |
| | [Hawat](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Easy | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | Not allowed |
| | [Alert](https://app.hackthebox.com/machines/Alert) HackTheBox Show spoilers xss markdown-injection file-read password-cracking | Linux | Easy | [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2025/03/22/htb-alert.html) |
| | [CORS vulnerability with trusted null origin](https://portswigger.net/web-security/cors/lab-null-origin-whitelisted-attack) PortSwigger Show spoilers cors-misconfiguration null-origin sandboxed-iframe credential-theft | N/A | Apprentice | [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks) | [ricardojoserf.github.io](https://ricardojoserf.github.io/portswiggerlabs/) |
| | [File Inclusion](https://tryhackme.com/room/fileinc) TryHackMe Show spoilers lfi rfi directory-traversal php-wrapper | Linux | Easy | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [farros.co](https://farros.co/blog/file-inclusion-tryhackme-write-up/) |
| | [MonitorsTwo](https://app.hackthebox.com/machines/MonitorsTwo) HackTheBox Show spoilers cacti command-injection cve-2022-46169 auth-bypass reverse-shell | Linux | Easy | [Command Injection](https://hackindex.io/learn/oswa-web-200-study-path/command-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/09/02/htb-monitorstwo.html) |
| | [Bookstore](https://tryhackme.com/room/bookstoreoc) TryHackMe Show spoilers api-idor api-enumeration broken-object-level-authorization parameter-tampering | Linux | Easy | [Insecure Direct Object References (IDOR)](https://hackindex.io/learn/oswa-web-200-study-path/insecure-direct-object-referencing) | [www.hackingarticles.in](https://www.hackingarticles.in/bookstore-tryhackme-walkthrough/) |
| | [DVWA (Damn Vulnerable Web Application)](https://github.com/digininja/DVWA) Standalone Show spoilers sql-injection xss command-injection file-upload file-inclusion csrf | N/A | Beginner | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | – |
| | [PentesterLab: Web For Pentester](https://pentesterlab.com/exercises/web_for_pentester) Vulnhub Show spoilers Cross-Site Scripting SQL injection Directory traversal Local/Remote File Inclusion Command injection XML / XXE attacks Code injection | Linux | Beginner | [XML External Entities](https://hackindex.io/learn/oswa-web-200-study-path/xml-external-entities) | – |
| | [FriendZone](https://app.hackthebox.com/machines/FriendZone?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers dns-zone-transfer smb-enumeration local-file-inclusion credential-reuse python-library-hijacking cron-job | Linux | Easy | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [HackIndex.io](https://hackindex.io/writeups/friendzone) |
| | [OpenAdmin](https://app.hackthebox.com/machines/OpenAdmin?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers opennetadmin-rce credential-reuse ssh-key-cracking sudo-nano gtfobins | Linux | Easy | [Command Injection](https://hackindex.io/learn/oswa-web-200-study-path/command-injection) | [HackIndex.io](https://hackindex.io/writeups/openadmin) |
| | [Headless](https://app.hackthebox.com/machines/Headless) HackTheBox Show spoilers reflected-xss cookie-theft header-injection command-injection | Linux | Easy | [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/07/20/htb-headless.html) |
| | [CSRF vulnerability with no defenses](https://portswigger.net/web-security/csrf/lab-no-defenses) PortSwigger Show spoilers csrf state-changing-request auto-submit-form | N/A | Apprentice | [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks) | [hackmd.io](https://hackmd.io/@thesuburbanboy/SkeLI_Y0kl) |
| | [Pentester Lab: Play XML Entities](https://www.vulnhub.com/entry/pentester-lab-play-xml-entities,119/) Vulnhub Show spoilers xxe file-disclosure dtd | Linux | Easy | [XML External Entities](https://hackindex.io/learn/oswa-web-200-study-path/xml-external-entities) | – |
| | [Neonify](https://app.hackthebox.com/challenges/Neonify) HackTheBox Show spoilers ssti erb ruby filter-bypass | N/A | Easy | [Server-side Template Injection](https://hackindex.io/learn/oswa-web-200-study-path/server-side-template-injection) | [drt.sh](https://drt.sh/posts/htb-neonify/) |
| | [Intro to SSRF](https://tryhackme.com/room/ssrfqi) TryHackMe Show spoilers ssrf blind-ssrf filter-bypass internal-service-access | N/A | Easy | [Server-side Request Forgery](https://hackindex.io/learn/oswa-web-200-study-path/server-side-request-forgery) | [oluwakamiye.medium.com](https://oluwakamiye.medium.com/introduction-to-server-side-request-forgery-ssrf-tryhackme-walkthrough-7e2efc631eb3) |
| | [Corridor](https://tryhackme.com/room/corridor) TryHackMe Show spoilers idor md5-hash-cracking enumeration automation | N/A | Easy | [Insecure Direct Object References (IDOR)](https://hackindex.io/learn/oswa-web-200-study-path/insecure-direct-object-referencing) | [medium.com](https://medium.com/@trixiahorner/tryhackme-corridor-ctf-walkthrough-idor-vulnerability-3ce5a2746ef2) |
| | [Google Gruyere](https://google-gruyere.appspot.com/) Standalone Show spoilers xss csrf path-traversal information-disclosure remote-code-execution | N/A | Beginner | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | – |
| | [Kioptrix Level 2](https://www.vulnhub.com/entry/kioptrix-level-11-2,23/) Vulnhub Show spoilers SQL injection SQLi login/authentication bypass Command injection (ping form RCE) | Linux | Easy | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [www.abatchy.com](https://www.abatchy.com/2016/12/kioptrix-2-walkthrough-vulnhub) |
| | [Forge](https://app.hackthebox.com/machines/Forge?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ssrf ssrf-filter-bypass open-redirect ftp-via-ssrf ssh-key-theft python-pdb-abuse sudo-misconfiguration | Linux | Medium | [Server-side Request Forgery](https://hackindex.io/learn/oswa-web-200-study-path/server-side-request-forgery) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/01/22/htb-forge.html) |
| | [Intro to Cross-site Scripting](https://tryhackme.com/room/xss) TryHackMe Show spoilers reflected-xss stored-xss dom-based-xss blind-xss | N/A | Easy | [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study) | [medium.com](https://medium.com/@trixiahorner/tryhackme-intro-to-cross-site-scripting-ee555b2deaf1) |
| | [CORS vulnerability with trusted insecure protocols](https://portswigger.net/web-security/cors/lab-breaking-https-attack) PortSwigger Show spoilers cors-misconfiguration trusted-subdomain xss-to-cors insecure-http-origin | N/A | Practitioner | [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks) | [ricardojoserf.github.io](https://ricardojoserf.github.io/portswiggerlabs/) |
| | [NodeBlog](https://app.hackthebox.com/machines/NodeBlog) HackTheBox Show spoilers nosql-injection auth-bypass xxe | Linux | Easy | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/01/10/htb-nodeblog.html) |
| | [Inclusion](https://tryhackme.com/room/inclusion) TryHackMe Show spoilers lfi directory-traversal | Linux | Easy | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [0xsanz.medium.com](https://0xsanz.medium.com/lfi-inclusion-tryhackme-d66943f7ae4c) |
| | [XXE Injection](https://tryhackme.com/room/xxeinjection) TryHackMe Show spoilers xxe in-band out-of-band ssrf | N/A | Easy | [XML External Entities](https://hackindex.io/learn/oswa-web-200-study-path/xml-external-entities) | [medium.com](https://medium.com/h7w/tryhackme-xxe-injection-writeup-018572ab7abd) |
| | [Nunchucks](https://app.hackthebox.com/machines/Nunchucks) HackTheBox Show spoilers ssti nunjucks nodejs rce | Linux | Easy | [Server-side Template Injection](https://hackindex.io/learn/oswa-web-200-study-path/server-side-template-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/11/02/htb-nunchucks.html) |
| | [Photobomb](https://app.hackthebox.com/machines/Photobomb) HackTheBox Show spoilers command-injection parameter-injection credential-discovery reverse-shell | Linux | Easy | [Command Injection](https://hackindex.io/learn/oswa-web-200-study-path/command-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/02/11/htb-photobomb.html) |
| | [IDOR](https://tryhackme.com/room/idor) TryHackMe Show spoilers idor encoded-ids hashed-ids parameter-tampering burp-suite | N/A | Easy | [Insecure Direct Object References (IDOR)](https://hackindex.io/learn/oswa-web-200-study-path/insecure-direct-object-referencing) | [notesbynisha.com](https://notesbynisha.com/tryhackme/web%20exploitation/blog/idor-thm/) |
| | [OWASP Mutillidae II](https://github.com/webpwnized/mutillidae) Standalone Show spoilers sql-injection xss command-injection html-injection file-inclusion | N/A | Beginner | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | – |
| | [Kotarak](https://app.hackthebox.com/machines/Kotarak?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ssrf tomcat-war-deployment ntds-dit-extraction hash-cracking wget-cve-2016-4971 | Linux | Hard | [Server-side Request Forgery](https://hackindex.io/learn/oswa-web-200-study-path/server-side-request-forgery) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/05/19/htb-kotarak.html) |
| | [Pentester Lab: XSS and MySQL FILE](https://www.vulnhub.com/entry/pentester-lab-xss-and-mysql-file,66/) Vulnhub Show spoilers reflected-xss cookie-theft sql-injection code-execution | Linux | Easy | [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study) | [medium.com](https://medium.com/@shayhershko20/vulnhub-xss-and-mysql-file-walkthrough-f54dbfe77769) |
| | [CSRF where Referer validation depends on header being present](https://portswigger.net/web-security/csrf/bypassing-referer-based-defenses/lab-referer-validation-depends-on-header-being-present) PortSwigger Show spoilers csrf referer-validation-bypass referrer-policy | N/A | Practitioner | [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks) | [hackmd.io](https://hackmd.io/@thesuburbanboy/SkeLI_Y0kl) |
| | [Pentester Lab: From SQL injection to Shell](https://www.vulnhub.com/entry/pentester-lab-from-sql-injection-to-shell,80/) Vulnhub Show spoilers union-sqli database-dump webshell | Linux | Easy | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [pentesterarchive.github.io](https://pentesterarchive.github.io/posts/fromSqliToShell/) |
| | [XXE Lab: 1](https://www.vulnhub.com/entry/xxe-lab-1,254/) Vulnhub Show spoilers xxe file-disclosure blind-xxe | Linux | Easy | [XML External Entities](https://hackindex.io/learn/oswa-web-200-study-path/xml-external-entities) | – |
| | [SSTI](https://tryhackme.com/room/learnssti) TryHackMe Show spoilers ssti jinja2 flask rce | N/A | Easy | [Server-side Template Injection](https://hackindex.io/learn/oswa-web-200-study-path/server-side-template-injection) | [motasem-notes.net](https://motasem-notes.net/understanding-server-side-template-injection-tryhackme/) |
| | [Precious](https://app.hackthebox.com/machines/Precious) HackTheBox Show spoilers pdfkit command-injection cve-2022-25765 reverse-shell | Linux | Easy | [Command Injection](https://hackindex.io/learn/oswa-web-200-study-path/command-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/05/20/htb-precious.html) |
| | [IDOR - Santa's Little IDOR](https://tryhackme.com/room/idor-aoc2025-zl6MywQid9) TryHackMe Show spoilers idor horizontal-privilege-escalation burp-intruder parameter-tampering | N/A | Easy | [Insecure Direct Object References (IDOR)](https://hackindex.io/learn/oswa-web-200-study-path/insecure-direct-object-referencing) | [pawan7.medium.com](https://pawan7.medium.com/tryhackme-idor-walkthrough-santas-little-idor-complete-guide-to-insecure-direct-object-eaab6d2156c2) |
| | [OWASP WebGoat](https://owasp.org/www-project-webgoat/) Standalone Show spoilers sql-injection xss insecure-deserialization jwt-manipulation xxe | N/A | Beginner | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | – |
| | [Inclusiveness]() Proving Grounds | Linux | Easy | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | Not allowed |
| | [Networked](https://app.hackthebox.com/machines/Networked?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers file-upload-bypass double-extension command-injection cron-job sudo-misconfiguration ifcfg-injection | Linux | Easy | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/11/16/htb-networked.html) |
| | [Sau](https://app.hackthebox.com/machines/Sau?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers request-baskets-ssrf-cve-2023-27163 maltrail-command-injection systemctl-sudo-gtfobins | Linux | Easy | [Command Injection](https://hackindex.io/learn/oswa-web-200-study-path/command-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/01/06/htb-sau.html) |
| | [Sea](https://app.hackthebox.com/machines/Sea) HackTheBox Show spoilers xss wondercms cve-2023-41425 command-injection | Linux | Easy | [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/12/21/htb-sea.html) |
| | [CSRF where token is not tied to user session](https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-not-tied-to-user-session) PortSwigger Show spoilers csrf csrf-token-bypass token-reuse | N/A | Practitioner | [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks) | [hackmd.io](https://hackmd.io/@thesuburbanboy/SkeLI_Y0kl) |
| | [Shoppy](https://app.hackthebox.com/machines/Shoppy) HackTheBox Show spoilers nosql-injection auth-bypass operator-injection | Linux | Easy | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/01/14/htb-shoppy.html) |
| | [Aragog](https://www.hackthebox.com/machines/aragog) HackTheBox Show spoilers xxe file-disclosure wordpress credential-reuse | Linux | Medium | [XML External Entities](https://hackindex.io/learn/oswa-web-200-study-path/xml-external-entities) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/07/21/htb-aragog.html) |
| | [Templated](https://app.hackthebox.com/challenges/Templated) HackTheBox Show spoilers ssti jinja2 flask rce | N/A | Easy | [Server-side Template Injection](https://hackindex.io/learn/oswa-web-200-study-path/server-side-template-injection) | [github.com](https://github.com/HHousen/hack-the-box/blob/master/Challenges/Web/Templated/README.md) |
| | [Nimbus](https://app.hackthebox.com/machines/Nimbus) HackTheBox Show spoilers ssrf cloud-metadata imds filter-bypass aws-credentials | Linux | Hard | [Server-side Request Forgery](https://hackindex.io/learn/oswa-web-200-study-path/server-side-request-forgery) | [HackIndex.io](https://hackindex.io/writeups/nimbus) |
| | [Neighbour](https://tryhackme.com/room/neighbour) TryHackMe Show spoilers idor authentication-bypass source-code-review parameter-tampering | N/A | Easy | [Insecure Direct Object References (IDOR)](https://hackindex.io/learn/oswa-web-200-study-path/insecure-direct-object-referencing) | [medium.com](https://medium.com/@gyanastra/tryhackme-neighbour-walkthrough-c1f445fab44d) |
| | [BountyHunter](https://app.hackthebox.com/machines/BountyHunter) HackTheBox Show spoilers xxe information-disclosure credential-reuse python-eval-injection | Linux | Easy | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/11/20/htb-bountyhunter.html) |
| | [CozyHosting](https://app.hackthebox.com/machines/CozyHosting?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers spring-boot-actuator session-hijack command-injection postgresql-credential-dump hash-cracking ssh-sudo-gtfobins | Linux | Easy | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/03/02/htb-cozyhosting.html) |
| | [DevOops](https://app.hackthebox.com/machines/DevOops?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers xxe file-upload ssh-key-abuse git-history information-disclosure | Linux | Medium | [XML External Entities](https://hackindex.io/learn/oswa-web-200-study-path/xml-external-entities) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/10/13/htb-devoops.html) |
| | [Shocker](https://app.hackthebox.com/machines/Shocker?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers directory-enumeration cgi-bin shellshock cve-2014-6271 sudo-perl | Linux | Easy | [Command Injection](https://hackindex.io/learn/oswa-web-200-study-path/command-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/05/25/htb-shocker.html) |
| | [Soccer](https://app.hackthebox.com/machines/Soccer?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers tiny-file-manager-default-creds file-upload-webshell websocket-sql-injection doas-dstat-privesc | Linux | Easy | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/06/10/htb-soccer.html) |
| | [XSS](https://tryhackme.com/room/axss) TryHackMe Show spoilers reflected-xss stored-xss dom-based-xss filter-bypass | N/A | Easy | [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study) | [medium.com](https://medium.com/@maitreyeeeh/tryhackme-room-xss-walkthrough-d28500d1cce3) |
| | [CSRF where token validation depends on request method](https://portswigger.net/web-security/csrf/bypassing-token-validation/lab-token-validation-depends-on-request-method) PortSwigger Show spoilers csrf csrf-token-bypass http-method-change | N/A | Practitioner | [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks) | [hackmd.io](https://hackmd.io/@thesuburbanboy/SkeLI_Y0kl) |
| | [JinjaCare]() HackTheBox Show spoilers ssti jinja2 flask filter-bypass rce | N/A | Medium | [Server-side Template Injection](https://hackindex.io/learn/oswa-web-200-study-path/server-side-template-injection) | [dev.to](https://dev.to/exploitnotes/hackthebox-jinjacare-writeup-1488) |
| | [OWASP Broken Access Control](https://tryhackme.com/room/owaspbrokenaccesscontrol) TryHackMe Show spoilers broken-access-control idor privilege-escalation parameter-tampering | N/A | Easy | [Insecure Direct Object References (IDOR)](https://hackindex.io/learn/oswa-web-200-study-path/insecure-direct-object-referencing) | [medium.com](https://medium.com/@sthamahaan55/tryhackme-owasp-broken-access-control-writeup-1c9ff1803e6e) |
| | [Pilgrimage](https://www.hackthebox.com/machines/pilgrimage) HackTheBox Show spoilers Arbitrary file read LFI (ImageMagick CVE-2022-44268) Source code disclosure via exposed .git git-dumper | Linux | Easy | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/11/25/htb-pilgrimage.html) |
| | [Pelican](https://portal.offsec.com/machine/pelican-440/overview) Proving Grounds | Linux | Intermediate | [Command Injection](https://hackindex.io/learn/oswa-web-200-study-path/command-injection) | [HackIndex.io](https://hackindex.io/writeups/pelican) |
| | [Clipper]() Proving Grounds | Linux | Intermediate | [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study) | Not allowed |
| | [Exploiting clickjacking vulnerability to trigger DOM-based XSS](https://portswigger.net/web-security/clickjacking/lab-exploiting-to-trigger-dom-based-xss) PortSwigger Show spoilers clickjacking ui-redressing dom-xss iframe-overlay | N/A | Practitioner | [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks) | [hackmd.io](https://hackmd.io/@janlele91/SJWKTG5To) |
| | [Stocker](https://app.hackthebox.com/machines/Stocker) HackTheBox Show spoilers nosql-injection auth-bypass operator-injection | Linux | Easy | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/06/24/htb-stocker.html) |
| | [RootMe](https://tryhackme.com/room/rrootme) TryHackMe Show spoilers file-upload extension-bypass web-shell reverse-shell | Linux | Easy | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [HackIndex.io](https://hackindex.io/writeups/rootme) |
| | [Patents](https://www.hackthebox.com/machines/patents) HackTheBox Show spoilers xxe docx-upload lfi source-code-disclosure | Linux | Hard | [XML External Entities](https://hackindex.io/learn/oswa-web-200-study-path/xml-external-entities) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/05/16/htb-patents.html) |
| | [Server-side Template Injection](https://tryhackme.com/room/serversidetemplateinjection) TryHackMe Show spoilers ssti template-injection jinja2 rce | N/A | Medium | [Server-side Template Injection](https://hackindex.io/learn/oswa-web-200-study-path/server-side-template-injection) | [classroom.anir0y.in](https://classroom.anir0y.in/post/tryhackme-serversidetemplateinjection/) |
| | [GoodGames](https://app.hackthebox.com/machines/GoodGames) HackTheBox Show spoilers sql-injection ssti password-reuse docker-escape | Linux | Easy | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/02/23/htb-goodgames.html) |
| | [Awkward](https://www.hackthebox.com/machines/awkward) HackTheBox Show spoilers Server-Side Request Forgery Local File Inclusion IDOR / API access control Information disclosure | Linux | Medium | [Insecure Direct Object References (IDOR)](https://hackindex.io/learn/oswa-web-200-study-path/insecure-direct-object-referencing) | [infosecwriteups.com](https://infosecwriteups.com/awkward-hack-the-box-walkthrough-htb-6d5f8d49c118) |
| | [Titanic](https://app.hackthebox.com/machines/Titanic?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers local-file-inclusion gitea-config-disclosure sqlite-database-dump hash-cracking imagemagick-cve-2024-41817 | Linux | Easy | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2025/06/21/htb-titanic.html) |
| | [IClean](https://app.hackthebox.com/machines/IClean) HackTheBox Show spoilers stored-xss cookie-theft ssti password-cracking | Linux | Medium | [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/08/03/htb-iclean.html) |
| | [SameSite Lax bypass via method override](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-lax-bypass-via-method-override) PortSwigger Show spoilers csrf samesite-bypass samesite-lax method-override | N/A | Practitioner | [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks) | [hackmd.io](https://hackmd.io/@thesuburbanboy/SkeLI_Y0kl) |
| | [Trick](https://app.hackthebox.com/machines/Trick) HackTheBox Show spoilers sqli-auth-bypass union-sqli file-read | Linux | Easy | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/10/29/htb-trick.html) |
| | [Potato]() Proving Grounds | Linux | Easy | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | [HackIndex.io](https://hackindex.io/writeups/potato) |
| | [Previse](https://app.hackthebox.com/machines/Previse?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers broken-access-control execute-after-redirect command-injection password-cracking path-hijacking sudo-misconfiguration | Linux | Easy | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/01/08/htb-previse.html) |
| | [Imagery](https://app.hackthebox.com/machines/Imagery) HackTheBox Show spoilers stored-xss blind-xss directory-traversal rce | Linux | Medium | [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2026/01/24/htb-imagery.html) |
| | [SameSite Strict bypass via client-side redirect](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions/lab-samesite-strict-bypass-via-client-side-redirect) PortSwigger Show spoilers csrf samesite-bypass samesite-strict client-side-redirect | N/A | Practitioner | [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks) | [hackmd.io](https://hackmd.io/@thesuburbanboy/SkeLI_Y0kl) |
| | [Usage](https://app.hackthebox.com/machines/Usage) HackTheBox Show spoilers blind-sqli boolean-based-sqli sqlmap | Linux | Easy | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/08/10/htb-usage.html) |
| | [Upload Vulnerabilities](https://tryhackme.com/room/uploadvulns) TryHackMe Show spoilers file-upload web-shell client-side-bypass content-type-bypass | Linux | Easy | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [www.jalblas.com](https://www.jalblas.com/blog/tryhackme-upload-vulnerabilities-walkthrough/) |
| | [Magic](https://app.hackthebox.com/machines/Magic?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection file-upload php-webshell credential-reuse path-hijacking suid | Linux | Medium | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [HackIndex.io](https://hackindex.io/writeups/magic) |
| | [BlockSynergy](https://app.hackthebox.com/machines/BlockSynergy) HackTheBox Show spoilers stored-xss ssrf command-injection path-traversal | Linux | Insane | [Cross-Site Scripting: Exploitation](https://hackindex.io/learn/oswa-web-200-study-path/cross-site-scripting-exploitation-and-case-study) | [HackIndex.io](https://hackindex.io/writeups/blocksynergy) |
| | [CSRF](https://tryhackme.com/room/csrfV2) TryHackMe Show spoilers csrf state-changing-request session-riding same-site-cookies | N/A | Easy | [Cross-Origin Attacks](https://hackindex.io/learn/oswa-web-200-study-path/cross-origin-attacks) | [medium.com](https://medium.com/@cyfernest/csrf-tryhackme-walkthrough-473572a921be) |
| | [Validation](https://app.hackthebox.com/machines/Validation) HackTheBox Show spoilers second-order-sqli file-write webshell | Linux | Easy | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/09/14/htb-validation.html) |
| | [Sumo]() Proving Grounds | Linux | Easy | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | Not allowed |
| | [Poison](https://app.hackthebox.com/machines/Poison?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers local-file-inclusion log-poisoning webshell password-decryption vnc-exploitation port-forwarding | FreeBSD | Medium | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/09/08/htb-poison.html) |
| | [Writeup](https://app.hackthebox.com/machines/Writeup) HackTheBox Show spoilers blind-sqli cms-made-simple credential-dump | Linux | Easy | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/10/12/htb-writeup.html) |
| | [Interface]() Proving Grounds | Linux | Intermediate | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | Not allowed |
| | [Popcorn](https://app.hackthebox.com/machines/Popcorn?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers directory-bruteforce file-upload-bypass webshell cve-2010-0832 kernel-exploit | Linux | Medium | [Directory Traversal and File Inclusion](https://hackindex.io/learn/oswa-web-200-study-path/directory-traversal-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/06/23/htb-popcorn.html) |
| | [Cockpit](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | Not allowed |
| | [OWASP Security Shepherd](https://owasp.org/www-project-security-shepherd/) Standalone Show spoilers sql-injection xss csrf idor session-management | N/A | Intermediate | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | – |
| | [DC-9](https://www.vulnhub.com/entry/dc-9,412/) Vulnhub Show spoilers union-sqli manual-sqli credential-dump lfi | Linux | Intermediate | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [novasky.medium.com](https://novasky.medium.com/dc-9-manual-walkthrough-vulnhub-oscp-practice-e04b03ac2003) |
| | [MonitorsThree](https://app.hackthebox.com/machines/MonitorsThree) HackTheBox Show spoilers sql-injection cacti-rce authenticated-file-write credential-harvesting | Linux | Medium | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2025/01/18/htb-monitorsthree.html) |
| | [PC](https://portal.offsec.com/labs/practice) Proving Grounds | Linux | Intermediate | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | Not allowed |
| | [Mr-Robot: 1](https://www.vulnhub.com/entry/mr-robot-1,151/) Vulnhub Show spoilers robots-txt wordpress-enumeration credential-bruteforce php-reverse-shell | Linux | Medium | [Full Web Application Assessment](https://hackindex.io/learn/oswa-web-200-study-path/assembling-the-pieces-web-application-assessment-breakdown) | [www.abatchy.com](https://www.abatchy.com/2017/02/mr-robot-1-walkthrough-vulnhub) |
| | [Jarvis](https://app.hackthebox.com/machines/Jarvis?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection waf-bypass phpmyadmin-rce command-injection sudo-misconfiguration systemctl-gtfobins | Linux | Medium | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [HackIndex.io](https://hackindex.io/writeups/jarvis) |
| | [Mango](https://app.hackthebox.com/machines/Mango?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers nosql-injection mongodb credential-extraction password-reuse jjs-suid | Linux | Medium | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [HackIndex.io](https://hackindex.io/writeups/mango) |
| | [Union](https://www.hackthebox.com/machines/union) HackTheBox Show spoilers SQL injection Second-order SQL injection UNION-based injection SQLi file read INTO OUTFILE | Linux | Medium | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/11/22/htb-union.html) |
| | [Writer](https://app.hackthebox.com/machines/Writer?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection authentication-bypass command-injection hash-cracking postfix-filter-injection apt-config-injection | Linux | Medium | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/12/11/htb-writer.html) |
| | [Zipping](https://www.hackthebox.com/machines/zipping) HackTheBox Show spoilers SQL injection Local File Inclusion File upload (zip symlink arbitrary file read) SQLi INTO OUTFILE to webshell LFI to RCE | Linux | Medium | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2024/01/13/htb-zipping.html) |
| | [Falafel](https://app.hackthebox.com/machines/Falafel?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection php-type-juggling file-upload video-group-framebuffer disk-group-abuse | Linux | Hard | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/06/23/htb-falafel.html) |
| | [Intentions](https://app.hackthebox.com/machines/Intentions) HackTheBox Show spoilers blind-sqli boolean-based-sqli hash-extraction | Linux | Hard | [SQL Injection](https://hackindex.io/learn/oswa-web-200-study-path/sql-injection) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/10/14/htb-intentions.html) |

HackIndex is independent study material, not affiliated with, endorsed by, or sponsored by OffSec. OSWA® and OffSec® are registered trademarks of OffSec Services Limited. WEB-200 is an OffSec course designation. This study path uses only original HackIndex content and links to OffSec's official pages as the authoritative source.