PT2 · Practice machines

PT2 Practice Machines

Our curated list of machines that train the same skills as the PT2 syllabus, mapped to the module they fit best. Techniques are hidden behind spoilers, and machines whose platform forbids public solutions only show a name and link.

80 machines 4 with a HackIndex.io writeup

Has writeup

Done	Machine	OS	Difficulty	Module	Writeup
Mark Enumeration & Brute Force as done	Enumeration & Brute Force TryHackMe Show spoilers Enumeration Brute Force Authentication	Other	Easy	Authentication Attacks	–
Mark Intro to Containerisation as done	Intro to Containerisation TryHackMe Show spoilers Containers	Linux	Easy	Container Security & Escape	–
Mark Insecure Deserialisation as done	Insecure Deserialisation TryHackMe Show spoilers Deserialization Gadget Chains RCE	Other	Medium	Advanced Server-Side Attacks	–
Mark Input Manipulation & Prompt Injection as done	Input Manipulation & Prompt Injection TryHackMe Show spoilers Prompt Injection LLM	Other	Easy	Attacking LLMs	–
Mark Reel as done	Reel HackTheBox Show spoilers anonymous-ftp phishing cve-2017-0199 rtf-exploit bloodhound writeowner writedacl	Windows	Hard	Fileless Attacks & Evasion	0xdf.gitlab.io
Mark Active Directory Basics as done	Active Directory Basics TryHackMe Show spoilers Active Directory	Windows	Easy	Active Directory Fundamentals	–
Mark Postman as done	Postman HackTheBox Show spoilers redis-exploitation ssh-key-injection ssh-key-cracking webmin-rce cve-2019-12840 password-reuse	Linux	Easy	SSH & Linux Lateral Movement	0xdf.gitlab.io
Mark Bucket as done	Bucket HackTheBox Show spoilers AWS S3 bucket enum LocalStack abuse DynamoDB credential dump IAM credential reuse	Linux	Medium	Cloud Security Bypass	–
Mark Mantis as done	Mantis HackTheBox Show spoilers port-enumeration mssql-enumeration credential-disclosure ms14-068 kerberos-ticket-forgery goldenpac	Windows	Hard	AD Trusts & Forest Attacks	0xdf.gitlab.io
Mark Chaining Vulnerabilities as done	Chaining Vulnerabilities TryHackMe Show spoilers Vulnerability Chaining	Other	Easy	Chaining Vulnerabilities	–
Mark Escape as done	Escape HackTheBox Show spoilers smb-enumeration mssql xp-dirtree net-ntlmv2-capture password-cracking adcs-esc1 pass-the-hash	Windows	Medium	NTLM Relay, ADCS & SQL Server Trust	0xdf.gitlab.io
Mark Exploiting Active Directory as done	Exploiting Active Directory TryHackMe Show spoilers Kerberoasting DCSync Golden Ticket	Windows	Medium	AD Exploitation & Persistence	–
Mark Breaching Active Directory as done	Breaching Active Directory TryHackMe Show spoilers AD Breach Password Spraying	Windows	Medium	Active Directory Fundamentals	–
Mark Extract as done	Extract TryHackMe Show spoilers Information Extraction Chaining	Other	Hard	Chaining Vulnerabilities	–
Mark Persisting Active Directory as done	Persisting Active Directory TryHackMe Show spoilers AD Persistence Shadow Credentials	Windows	Medium	AD Exploitation & Persistence	–
Mark Intro to Docker as done	Intro to Docker TryHackMe Show spoilers Docker	Linux	Easy	Container Security & Escape	–
Mark Traverxec as done	Traverxec HackTheBox Show spoilers nostromo-rce cve-2019-16278 ssh-key-cracking sudo-journalctl gtfobins privilege-escalation	Linux	Easy	SSH & Linux Lateral Movement	0xdf.gitlab.io
Mark LLM Output Handling and Privacy Risks as done	LLM Output Handling and Privacy Risks TryHackMe Show spoilers Output Handling Privacy LLM	Other	Easy	Attacking LLMs	–
Mark Session Management as done	Session Management TryHackMe Show spoilers Session Management Session Fixation	Other	Easy	Authentication Attacks	–
Mark SSRF as done	SSRF TryHackMe Show spoilers SSRF IMDS Internal Access	Other	Medium	Advanced Server-Side Attacks	–
Mark Epsilon as done	Epsilon HackTheBox Show spoilers AWS keys in .git Lambda GetFunction JWT forgery with Lambda secret SSTI	Linux	Medium	Cloud Security Bypass	–
Mark Certified as done	Certified HackTheBox Show spoilers bloodhound-enumeration acl-abuse writeowner genericwrite shadow-credentials adcs-esc9 pass-the-hash	Windows	Medium	NTLM Relay, ADCS & SQL Server Trust	0xdf.gitlab.io
Mark Game of Active Directory (GOAD) as done	Game of Active Directory (GOAD) Standalone Show spoilers Parent/child trust Cross-forest trust SID History Trust key extraction Kerberoasting across trusts	Windows	Hard	AD Trusts & Forest Attacks	–
Mark Mist as done	Mist HackTheBox Show spoilers AMSI bypass (variable rename) PetitPotam coercion Shadow Credentials ADCS ESC13 gMSA password read	Windows	Insane	Fileless Attacks & Evasion	–
Mark Data Integrity & Model Poisoning as done	Data Integrity & Model Poisoning TryHackMe Show spoilers Model Poisoning Supply Chain	Other	Medium	Attacking LLMs	–
Mark JWT Security as done	JWT Security TryHackMe Show spoilers JWT alg:none HS256 Confusion	Other	Easy	Authentication Attacks	–
Mark Intro to Kubernetes as done	Intro to Kubernetes TryHackMe Show spoilers Kubernetes	Linux	Easy	Container Security & Escape	–
Mark Authority as done	Authority HackTheBox Show spoilers ansible-vault-cracking pwm-ldap-abuse responder adcs-esc1 certificate-abuse	Windows	Medium	NTLM Relay, ADCS & SQL Server Trust	0xdf.gitlab.io
Mark Voyage as done	Voyage TryHackMe Show spoilers Vulnerability Chaining RCE	Other	Medium	Chaining Vulnerabilities	–
Mark File Inclusion, Path Traversal as done	File Inclusion, Path Traversal TryHackMe Show spoilers LFI RFI Path Traversal	Other	Medium	Advanced Server-Side Attacks	–
Mark Ghoul as done	Ghoul HackTheBox Show spoilers SSH agent hijacking Forwarded SSH_AUTH_SOCK abuse Docker container pivoting	Linux	Hard	SSH & Linux Lateral Movement	–
Mark Credentials Harvesting as done	Credentials Harvesting TryHackMe Show spoilers Credential Harvesting LSASS NTDS	Windows	Medium	AD Exploitation & Persistence	–
Mark Stacked as done	Stacked HackTheBox Show spoilers stored-xss aws-localstack-abuse lambda-command-injection command-injection docker-escape	Linux	Insane	Cloud Security Bypass	0xdf.gitlab.io
Mark Giddy as done	Giddy HackTheBox Show spoilers sql-injection net-ntlmv2-capture responder hash-cracking winrm unifi-video-privesc	Windows	Medium	Fileless Attacks & Evasion	0xdf.gitlab.io
Mark Enumerating Active Directory as done	Enumerating Active Directory TryHackMe Show spoilers AD Enumeration LDAP BloodHound	Windows	Medium	Active Directory Fundamentals	–
Mark Blackfield as done	Blackfield HackTheBox Show spoilers smb-enumeration as-rep-roasting password-cracking rpc-password-reset lsass-dump ntds-dit-extraction sebackupprivilege	Windows	Hard	AD Exploitation & Persistence	HackIndex.io
Mark AWS Fortress as done	AWS Fortress HackTheBox	Linux	Hard	Cloud Security Bypass	Not allowed
Mark Sizzle as done	Sizzle HackTheBox Show spoilers smb-enumeration scf-file-attack responder-ntlm-capture adcs-certificate-abuse kerberoasting applocker-bypass dcsync	Windows	Insane	NTLM Relay, ADCS & SQL Server Trust	0xdf.gitlab.io
Mark Juicy as done	Juicy TryHackMe Show spoilers Prompt Injection Jailbreak	Other	Medium	Attacking LLMs	–
Mark Sequence as done	Sequence TryHackMe Show spoilers Vulnerability Chaining	Other	Medium	Chaining Vulnerabilities	–
Mark Lateral Movement and Pivoting as done	Lateral Movement and Pivoting TryHackMe Show spoilers Lateral Movement Pivoting	Windows	Easy	Active Directory Fundamentals	–
Mark Ypuffy as done	Ypuffy HackTheBox Show spoilers ldap-enumeration ssh-key-authentication doas-abuse signify-signing	OpenBSD	Medium	SSH & Linux Lateral Movement	0xdf.gitlab.io
Mark Race Conditions as done	Race Conditions TryHackMe Show spoilers Race Condition TOCTOU	Other	Medium	Advanced Server-Side Attacks	–
Mark OAuth Vulnerabilities as done	OAuth Vulnerabilities TryHackMe Show spoilers OAuth Open Redirect State Bypass	Other	Medium	Authentication Attacks	–
Mark Container Vulnerabilities as done	Container Vulnerabilities TryHackMe Show spoilers Container Escape Docker Socket	Linux	Easy	Container Security & Escape	–
Mark Manage as done	Manage HackTheBox Show spoilers Google Authenticator TOTP bypass Leaked PAM MFA seed SSH key harvesting sudo misconfiguration	Linux	Easy	SSH & Linux Lateral Movement	–
Mark Forest as done	Forest HackTheBox Show spoilers rpc-enumeration as-rep-roasting winrm bloodhound acl-abuse dcsync	Windows	Easy	Active Directory Fundamentals	0xdf.gitlab.io
Mark SSRF via OpenID dynamic client registration as done	SSRF via OpenID dynamic client registration PortSwigger Show spoilers OIDC dynamic client registration abuse SSRF to IMDS 169.254.169.254 IAM role credential theft	Other	Hard	Cloud Security Bypass	–
Mark TwoMillion as done	TwoMillion HackTheBox Show spoilers API BAC to admin command injection credential reuse CVE-2023-0386 OverlayFS	Linux	Easy	Chaining Vulnerabilities	HackIndex.io
Mark Scrambled as done	Scrambled HackTheBox Show spoilers kerberos-only-auth kerberoasting silver-ticket mssql reverse-engineering dotnet-deserialization	Windows	Medium	NTLM Relay, ADCS & SQL Server Trust	0xdf.gitlab.io
Mark Prototype Pollution as done	Prototype Pollution TryHackMe Show spoilers Prototype Pollution Node.js RCE	Other	Medium	Advanced Server-Side Attacks	–
Mark Multi-Factor Authentication as done	Multi-Factor Authentication TryHackMe Show spoilers MFA Bypass OTP	Other	Easy	Authentication Attacks	–
Mark Container Hardening as done	Container Hardening TryHackMe Show spoilers Container Hardening	Linux	Easy	Container Security & Escape	–
Mark BankGPT as done	BankGPT TryHackMe Show spoilers LLM Prompt Injection	Other	Easy	Attacking LLMs	–
Mark Waldo as done	Waldo HackTheBox Show spoilers rbash/ForceCommand escape ssh -t bash --noprofile red editor shell escape	Linux	Medium	SSH & Linux Lateral Movement	–
Mark SteamCloud as done	SteamCloud HackTheBox Show spoilers Kubernetes enum anonymous kubelet API (10250) etcd exposure service account token theft privileged pod escape	Linux	Easy	Container Security & Escape	–
Mark Hammer as done	Hammer TryHackMe Show spoilers Authentication Bypass Account Takeover	Other	Medium	Authentication Attacks	–
Mark HealthGPT as done	HealthGPT TryHackMe Show spoilers LLM Safety Filter Bypass	Other	Easy	Attacking LLMs	–
Mark Include as done	Include TryHackMe Show spoilers File Inclusion RCE	Other	Medium	Advanced Server-Side Attacks	–
Mark Exploiting XXE to perform SSRF attacks as done	Exploiting XXE to perform SSRF attacks PortSwigger Show spoilers XXE out-of-band fetch SSRF to EC2 metadata IAM credential walking	Other	Medium	Cloud Security Bypass	–
Mark Pilgrimage as done	Pilgrimage HackTheBox Show spoilers Arbitrary file read LFI (ImageMagick CVE-2022-44268) Source code disclosure via exposed .git git-dumper	Linux	Easy	Chaining Vulnerabilities	0xdf.gitlab.io
Mark Querier as done	Querier HackTheBox Show spoilers smb-enumeration macro-analysis mssql-enumeration xp-dirtree-ntlm-capture responder hash-cracking xp-cmdshell gpp-password	Windows	Medium	NTLM Relay, ADCS & SQL Server Trust	0xdf.gitlab.io
Mark Sauna as done	Sauna HackTheBox Show spoilers user-enumeration as-rep-roasting autologon-credentials bloodhound dcsync	Windows	Easy	Active Directory Fundamentals	0xdf.gitlab.io
Mark Multimaster as done	Multimaster HackTheBox Show spoilers sql-injection waf-bypass password-cracking vscode-cef-debug dll-reversing as-rep-roasting generic-write-abuse server-operators-abuse	Windows	Insane	NTLM Relay, ADCS & SQL Server Trust	0xdf.gitlab.io
Mark Unobtainium as done	Unobtainium HackTheBox Show spoilers Kubernetes RBAC abuse service account token harvesting hostPath mount escape Node.js prototype pollution	Linux	Hard	Container Security & Escape	–
Mark Jupiter as done	Jupiter HackTheBox Show spoilers Grafana PostgreSQL SQLi COPY FROM PROGRAM RCE Jupyter token mining sudo abuse	Linux	Medium	Chaining Vulnerabilities	–
Mark Active as done	Active HackTheBox Show spoilers smb-enumeration gpp-password kerberoasting	Windows	Easy	Active Directory Fundamentals	0xdf.gitlab.io
Mark Reddish as done	Reddish HackTheBox Show spoilers Multi-hop SSH tunneling socat relays chisel SOCKS pivoting Docker container chains	Linux	Insane	SSH & Linux Lateral Movement	–
Mark Secret as done	Secret HackTheBox Show spoilers JWT HS256 forgery git history secret recovery admin bypass command injection	Linux	Easy	Authentication Attacks	–
Mark Nunchucks as done	Nunchucks HackTheBox Show spoilers ssti nunjucks nodejs rce	Linux	Easy	Advanced Server-Side Attacks	0xdf.gitlab.io
Mark Support as done	Support HackTheBox Show spoilers smb-enumeration reverse-engineering ldap-enumeration resource-based-constrained-delegation dcsync	Windows	Easy	Active Directory Fundamentals	HackIndex.io
Mark Carpediem as done	Carpediem HackTheBox Show spoilers CVE-2022-0492 cgroup v1 release_agent escape unprivileged user namespaces Docker container pivot VoIP enum	Linux	Hard	Container Security & Escape	–
Mark Unicode as done	Unicode HackTheBox Show spoilers JWT jku header injection open redirect to bypass JKU allowlist RS256 key swap LFI	Linux	Medium	Authentication Attacks	–
Mark Exfiltrated as done	Exfiltrated Proving Grounds	Linux	Easy	Chaining Vulnerabilities	HackIndex.io
Mark BountyHunter as done	BountyHunter HackTheBox Show spoilers xxe information-disclosure credential-reuse python-eval-injection	Linux	Easy	Advanced Server-Side Attacks	0xdf.gitlab.io
Mark Vulnerable Docker 1 as done	Vulnerable Docker 1 Vulnhub Show spoilers shellshock wordpress-rce exposed-docker-api docker-socket-mount chroot-escape container-escape	Linux	Medium	Container Security & Escape	www.notsosecure.com
Mark Pollution as done	Pollution HackTheBox Show spoilers Prototype pollution (lodash defaultsDeep) Blind XML SSRF PHP filter chain RCE FastCGI abuse	Linux	Hard	Advanced Server-Side Attacks	–
Mark JWT authentication bypass via jku header injection as done	JWT authentication bypass via jku header injection PortSwigger Show spoilers JWT jku parameter abuse attacker-hosted JWKS RS256 key injection	Other	Hard	Authentication Attacks	–
Mark Travel as done	Travel HackTheBox Show spoilers SSRF via gopher PHP memcached deserialization .git source disclosure LDAP group abuse	Linux	Hard	Advanced Server-Side Attacks	–
Mark Authentication bypass via OAuth implicit flow as done	Authentication bypass via OAuth implicit flow PortSwigger Show spoilers OAuth implicit flow abuse client-side validation bypass social-login tampering	Other	Medium	Authentication Attacks	–

List last verified October 4, 2026.

HackIndex is not affiliated with, authorized, endorsed by, or sponsored by TryHackMe Ltd. TryHackMe, PT2, and Penetration Tester Level 2 are trademarks of their respective owner, used here nominatively for identification only. This study path uses only original HackIndex content and links to TryHackMe's official pages as the authoritative source.