[PT2](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path) · Practice machines

## PT2 Practice Machines

Our curated list of machines that train the same skills as the PT2 syllabus, mapped to the module they fit best. Techniques are hidden behind spoilers, and machines whose platform forbids public solutions only show a name and link.

80 machines 4 with a HackIndex.io writeup

Machines completed 0/80

| Done | Machine | OS | Difficulty | Module | Writeup |
| --- | --- | --- | --- | --- | --- |
| | [Enumeration & Brute Force](https://tryhackme.com/room/enumerationbruteforce) TryHackMe Show spoilers Enumeration Brute Force Authentication | Other | Easy | [Authentication Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/authentication-attacks) | – |
| | [Intro to Containerisation](https://tryhackme.com/room/introtocontainerisation) TryHackMe Show spoilers Containers | Linux | Easy | [Container Security & Escape](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/container-security-and-escape) | – |
| | [Insecure Deserialisation](https://tryhackme.com/room/insecuredeserialisation) TryHackMe Show spoilers Deserialization Gadget Chains RCE | Other | Medium | [Advanced Server-Side Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/advanced-server-side-attacks) | – |
| | [Input Manipulation & Prompt Injection](https://tryhackme.com/room/inputmanipulationpromptinjection) TryHackMe Show spoilers Prompt Injection LLM | Other | Easy | [Attacking LLMs](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/attacking-llms) | – |
| | [Reel](https://app.hackthebox.com/machines/Reel?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers anonymous-ftp phishing cve-2017-0199 rtf-exploit bloodhound writeowner writedacl | Windows | Hard | [Fileless Attacks & Evasion](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/fileless-attacks-and-evasion) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/11/10/htb-reel.html) |
| | [Active Directory Basics](https://tryhackme.com/room/winadbasics) TryHackMe Show spoilers Active Directory | Windows | Easy | [Active Directory Fundamentals](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/active-directory-fundamentals) | – |
| | [Postman](https://app.hackthebox.com/machines/Postman?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers redis-exploitation ssh-key-injection ssh-key-cracking webmin-rce cve-2019-12840 password-reuse | Linux | Easy | [SSH & Linux Lateral Movement](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ssh-and-linux-lateral-movement) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/03/14/htb-postman.html) |
| | [Bucket](https://app.hackthebox.com/machines/Bucket) HackTheBox Show spoilers AWS S3 bucket enum LocalStack abuse DynamoDB credential dump IAM credential reuse | Linux | Medium | [Cloud Security Bypass](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/cloud-security-bypass) | – |
| | [Mantis](https://app.hackthebox.com/machines/Mantis?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers port-enumeration mssql-enumeration credential-disclosure ms14-068 kerberos-ticket-forgery goldenpac | Windows | Hard | [AD Trusts & Forest Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ad-trusts-and-forest-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/09/03/htb-mantis.html) |
| | [Chaining Vulnerabilities](https://tryhackme.com/room/chainingvulnerabilitiesZp) TryHackMe Show spoilers Vulnerability Chaining | Other | Easy | [Chaining Vulnerabilities](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/chaining-vulnerabilities) | – |
| | [Escape](https://app.hackthebox.com/machines/Escape?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration mssql xp-dirtree net-ntlmv2-capture password-cracking adcs-esc1 pass-the-hash | Windows | Medium | [NTLM Relay, ADCS & SQL Server Trust](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ntlm-relay-adcs-and-sql-server-trust) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/06/17/htb-escape.html) |
| | [Exploiting Active Directory](https://tryhackme.com/room/exploitingad) TryHackMe Show spoilers Kerberoasting DCSync Golden Ticket | Windows | Medium | [AD Exploitation & Persistence](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ad-exploitation-and-persistence) | – |
| | [Breaching Active Directory](https://tryhackme.com/room/breachingad) TryHackMe Show spoilers AD Breach Password Spraying | Windows | Medium | [Active Directory Fundamentals](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/active-directory-fundamentals) | – |
| | [Extract](https://tryhackme.com/room/extract) TryHackMe Show spoilers Information Extraction Chaining | Other | Hard | [Chaining Vulnerabilities](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/chaining-vulnerabilities) | – |
| | [Persisting Active Directory](https://tryhackme.com/room/persistingad) TryHackMe Show spoilers AD Persistence Shadow Credentials | Windows | Medium | [AD Exploitation & Persistence](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ad-exploitation-and-persistence) | – |
| | [Intro to Docker](https://tryhackme.com/room/introtodockerk8pdqk) TryHackMe Show spoilers Docker | Linux | Easy | [Container Security & Escape](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/container-security-and-escape) | – |
| | [Traverxec](https://app.hackthebox.com/machines/Traverxec?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers nostromo-rce cve-2019-16278 ssh-key-cracking sudo-journalctl gtfobins privilege-escalation | Linux | Easy | [SSH & Linux Lateral Movement](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ssh-and-linux-lateral-movement) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/04/11/htb-traverxec.html) |
| | [LLM Output Handling and Privacy Risks](https://tryhackme.com/room/outputhandlingandprivacyrisks) TryHackMe Show spoilers Output Handling Privacy LLM | Other | Easy | [Attacking LLMs](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/attacking-llms) | – |
| | [Session Management](https://tryhackme.com/room/sessionmanagement) TryHackMe Show spoilers Session Management Session Fixation | Other | Easy | [Authentication Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/authentication-attacks) | – |
| | [SSRF](https://tryhackme.com/room/ssrfhr) TryHackMe Show spoilers SSRF IMDS Internal Access | Other | Medium | [Advanced Server-Side Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/advanced-server-side-attacks) | – |
| | [Epsilon](https://app.hackthebox.com/machines/Epsilon) HackTheBox Show spoilers AWS keys in .git Lambda GetFunction JWT forgery with Lambda secret SSTI | Linux | Medium | [Cloud Security Bypass](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/cloud-security-bypass) | – |
| | [Certified](https://app.hackthebox.com/machines/Certified?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers bloodhound-enumeration acl-abuse writeowner genericwrite shadow-credentials adcs-esc9 pass-the-hash | Windows | Medium | [NTLM Relay, ADCS & SQL Server Trust](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ntlm-relay-adcs-and-sql-server-trust) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2025/03/15/htb-certified.html) |
| | [Game of Active Directory (GOAD)](https://github.com/Orange-Cyberdefense/GOAD) Standalone Show spoilers Parent/child trust Cross-forest trust SID History Trust key extraction Kerberoasting across trusts | Windows | Hard | [AD Trusts & Forest Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ad-trusts-and-forest-attacks) | – |
| | [Mist](https://app.hackthebox.com/machines/Mist) HackTheBox Show spoilers AMSI bypass (variable rename) PetitPotam coercion Shadow Credentials ADCS ESC13 gMSA password read | Windows | Insane | [Fileless Attacks & Evasion](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/fileless-attacks-and-evasion) | – |
| | [Data Integrity & Model Poisoning](https://tryhackme.com/room/modelpoisoning) TryHackMe Show spoilers Model Poisoning Supply Chain | Other | Medium | [Attacking LLMs](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/attacking-llms) | – |
| | [JWT Security](https://tryhackme.com/room/jwtsecurity) TryHackMe Show spoilers JWT alg:none HS256 Confusion | Other | Easy | [Authentication Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/authentication-attacks) | – |
| | [Intro to Kubernetes](https://tryhackme.com/room/introtok8s) TryHackMe Show spoilers Kubernetes | Linux | Easy | [Container Security & Escape](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/container-security-and-escape) | – |
| | [Authority](https://app.hackthebox.com/machines/Authority?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ansible-vault-cracking pwm-ldap-abuse responder adcs-esc1 certificate-abuse | Windows | Medium | [NTLM Relay, ADCS & SQL Server Trust](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ntlm-relay-adcs-and-sql-server-trust) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/12/09/htb-authority.html) |
| | [Voyage](https://tryhackme.com/room/voyage) TryHackMe Show spoilers Vulnerability Chaining RCE | Other | Medium | [Chaining Vulnerabilities](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/chaining-vulnerabilities) | – |
| | [File Inclusion, Path Traversal](https://tryhackme.com/room/filepathtraversal) TryHackMe Show spoilers LFI RFI Path Traversal | Other | Medium | [Advanced Server-Side Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/advanced-server-side-attacks) | – |
| | [Ghoul](https://app.hackthebox.com/machines/Ghoul) HackTheBox Show spoilers SSH agent hijacking Forwarded SSH_AUTH_SOCK abuse Docker container pivoting | Linux | Hard | [SSH & Linux Lateral Movement](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ssh-and-linux-lateral-movement) | – |
| | [Credentials Harvesting](https://tryhackme.com/room/credharvesting) TryHackMe Show spoilers Credential Harvesting LSASS NTDS | Windows | Medium | [AD Exploitation & Persistence](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ad-exploitation-and-persistence) | – |
| | [Stacked](https://app.hackthebox.com/machines/Stacked?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers stored-xss aws-localstack-abuse lambda-command-injection command-injection docker-escape | Linux | Insane | [Cloud Security Bypass](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/cloud-security-bypass) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/03/19/htb-stacked.html) |
| | [Giddy](https://app.hackthebox.com/machines/Giddy?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection net-ntlmv2-capture responder hash-cracking winrm unifi-video-privesc | Windows | Medium | [Fileless Attacks & Evasion](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/fileless-attacks-and-evasion) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/02/16/htb-giddy.html) |
| | [Enumerating Active Directory](https://tryhackme.com/room/adenumeration) TryHackMe Show spoilers AD Enumeration LDAP BloodHound | Windows | Medium | [Active Directory Fundamentals](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/active-directory-fundamentals) | – |
| | [Blackfield](https://app.hackthebox.com/machines/Blackfield?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration as-rep-roasting password-cracking rpc-password-reset lsass-dump ntds-dit-extraction sebackupprivilege | Windows | Hard | [AD Exploitation & Persistence](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ad-exploitation-and-persistence) | [HackIndex.io](https://hackindex.io/writeups/blackfield) |
| | [AWS Fortress](https://app.hackthebox.com/fortresses/7) HackTheBox | Linux | Hard | [Cloud Security Bypass](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/cloud-security-bypass) | Not allowed |
| | [Sizzle](https://app.hackthebox.com/machines/Sizzle?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration scf-file-attack responder-ntlm-capture adcs-certificate-abuse kerberoasting applocker-bypass dcsync | Windows | Insane | [NTLM Relay, ADCS & SQL Server Trust](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ntlm-relay-adcs-and-sql-server-trust) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/06/01/htb-sizzle.html) |
| | [Juicy](https://tryhackme.com/room/juicy) TryHackMe Show spoilers Prompt Injection Jailbreak | Other | Medium | [Attacking LLMs](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/attacking-llms) | – |
| | [Sequence](https://tryhackme.com/room/sequence) TryHackMe Show spoilers Vulnerability Chaining | Other | Medium | [Chaining Vulnerabilities](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/chaining-vulnerabilities) | – |
| | [Lateral Movement and Pivoting](https://tryhackme.com/room/lateralmovementandpivoting) TryHackMe Show spoilers Lateral Movement Pivoting | Windows | Easy | [Active Directory Fundamentals](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/active-directory-fundamentals) | – |
| | [Ypuffy](https://app.hackthebox.com/machines/Ypuffy?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers ldap-enumeration ssh-key-authentication doas-abuse signify-signing | OpenBSD | Medium | [SSH & Linux Lateral Movement](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ssh-and-linux-lateral-movement) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/02/09/htb-ypuffy.html) |
| | [Race Conditions](https://tryhackme.com/room/raceconditionsattacks) TryHackMe Show spoilers Race Condition TOCTOU | Other | Medium | [Advanced Server-Side Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/advanced-server-side-attacks) | – |
| | [OAuth Vulnerabilities](https://tryhackme.com/room/oauthvulnerabilities) TryHackMe Show spoilers OAuth Open Redirect State Bypass | Other | Medium | [Authentication Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/authentication-attacks) | – |
| | [Container Vulnerabilities](https://tryhackme.com/room/containervulnerabilitiesDG) TryHackMe Show spoilers Container Escape Docker Socket | Linux | Easy | [Container Security & Escape](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/container-security-and-escape) | – |
| | [Manage](https://app.hackthebox.com/machines/Manage) HackTheBox Show spoilers Google Authenticator TOTP bypass Leaked PAM MFA seed SSH key harvesting sudo misconfiguration | Linux | Easy | [SSH & Linux Lateral Movement](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ssh-and-linux-lateral-movement) | – |
| | [Forest](https://app.hackthebox.com/machines/Forest?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers rpc-enumeration as-rep-roasting winrm bloodhound acl-abuse dcsync | Windows | Easy | [Active Directory Fundamentals](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/active-directory-fundamentals) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/03/21/htb-forest.html) |
| | [SSRF via OpenID dynamic client registration](https://portswigger.net/web-security/oauth/openid/lab-oauth-ssrf-via-openid-dynamic-client-registration) PortSwigger Show spoilers OIDC dynamic client registration abuse SSRF to IMDS 169.254.169.254 IAM role credential theft | Other | Hard | [Cloud Security Bypass](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/cloud-security-bypass) | – |
| | [TwoMillion](https://app.hackthebox.com/machines/TwoMillion) HackTheBox Show spoilers API BAC to admin command injection credential reuse CVE-2023-0386 OverlayFS | Linux | Easy | [Chaining Vulnerabilities](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/chaining-vulnerabilities) | [HackIndex.io](https://hackindex.io/writeups/twomillion) |
| | [Scrambled](https://app.hackthebox.com/machines/Scrambled?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers kerberos-only-auth kerberoasting silver-ticket mssql reverse-engineering dotnet-deserialization | Windows | Medium | [NTLM Relay, ADCS & SQL Server Trust](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ntlm-relay-adcs-and-sql-server-trust) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2022/10/01/htb-scrambled.html) |
| | [Prototype Pollution](https://tryhackme.com/room/prototypepollution) TryHackMe Show spoilers Prototype Pollution Node.js RCE | Other | Medium | [Advanced Server-Side Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/advanced-server-side-attacks) | – |
| | [Multi-Factor Authentication](https://tryhackme.com/room/multifactorauthentications) TryHackMe Show spoilers MFA Bypass OTP | Other | Easy | [Authentication Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/authentication-attacks) | – |
| | [Container Hardening](https://tryhackme.com/room/containerhardening) TryHackMe Show spoilers Container Hardening | Linux | Easy | [Container Security & Escape](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/container-security-and-escape) | – |
| | [BankGPT](https://tryhackme.com/room/bankgpt) TryHackMe Show spoilers LLM Prompt Injection | Other | Easy | [Attacking LLMs](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/attacking-llms) | – |
| | [Waldo](https://app.hackthebox.com/machines/Waldo) HackTheBox Show spoilers rbash/ForceCommand escape ssh -t bash --noprofile red editor shell escape | Linux | Medium | [SSH & Linux Lateral Movement](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ssh-and-linux-lateral-movement) | – |
| | [SteamCloud](https://app.hackthebox.com/machines/SteamCloud) HackTheBox Show spoilers Kubernetes enum anonymous kubelet API (10250) etcd exposure service account token theft privileged pod escape | Linux | Easy | [Container Security & Escape](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/container-security-and-escape) | – |
| | [Hammer](https://tryhackme.com/room/hammer) TryHackMe Show spoilers Authentication Bypass Account Takeover | Other | Medium | [Authentication Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/authentication-attacks) | – |
| | [HealthGPT](https://tryhackme.com/room/healthgpt) TryHackMe Show spoilers LLM Safety Filter Bypass | Other | Easy | [Attacking LLMs](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/attacking-llms) | – |
| | [Include](https://tryhackme.com/room/include) TryHackMe Show spoilers File Inclusion RCE | Other | Medium | [Advanced Server-Side Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/advanced-server-side-attacks) | – |
| | [Exploiting XXE to perform SSRF attacks](https://portswigger.net/web-security/xxe/lab-exploiting-xxe-to-perform-ssrf) PortSwigger Show spoilers XXE out-of-band fetch SSRF to EC2 metadata IAM credential walking | Other | Medium | [Cloud Security Bypass](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/cloud-security-bypass) | – |
| | [Pilgrimage](https://www.hackthebox.com/machines/pilgrimage) HackTheBox Show spoilers Arbitrary file read LFI (ImageMagick CVE-2022-44268) Source code disclosure via exposed .git git-dumper | Linux | Easy | [Chaining Vulnerabilities](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/chaining-vulnerabilities) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2023/11/25/htb-pilgrimage.html) |
| | [Querier](https://app.hackthebox.com/machines/Querier?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration macro-analysis mssql-enumeration xp-dirtree-ntlm-capture responder hash-cracking xp-cmdshell gpp-password | Windows | Medium | [NTLM Relay, ADCS & SQL Server Trust](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ntlm-relay-adcs-and-sql-server-trust) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2019/06/22/htb-querier.html) |
| | [Sauna](https://app.hackthebox.com/machines/Sauna?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers user-enumeration as-rep-roasting autologon-credentials bloodhound dcsync | Windows | Easy | [Active Directory Fundamentals](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/active-directory-fundamentals) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/07/18/htb-sauna.html) |
| | [Multimaster](https://app.hackthebox.com/machines/Multimaster?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers sql-injection waf-bypass password-cracking vscode-cef-debug dll-reversing as-rep-roasting generic-write-abuse server-operators-abuse | Windows | Insane | [NTLM Relay, ADCS & SQL Server Trust](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ntlm-relay-adcs-and-sql-server-trust) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2020/09/19/htb-multimaster.html) |
| | [Unobtainium](https://app.hackthebox.com/machines/Unobtainium) HackTheBox Show spoilers Kubernetes RBAC abuse service account token harvesting hostPath mount escape Node.js prototype pollution | Linux | Hard | [Container Security & Escape](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/container-security-and-escape) | – |
| | [Jupiter](https://app.hackthebox.com/machines/Jupiter) HackTheBox Show spoilers Grafana PostgreSQL SQLi COPY FROM PROGRAM RCE Jupyter token mining sudo abuse | Linux | Medium | [Chaining Vulnerabilities](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/chaining-vulnerabilities) | – |
| | [Active](https://app.hackthebox.com/machines/Active?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration gpp-password kerberoasting | Windows | Easy | [Active Directory Fundamentals](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/active-directory-fundamentals) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2018/12/08/htb-active.html) |
| | [Reddish](https://app.hackthebox.com/machines/Reddish) HackTheBox Show spoilers Multi-hop SSH tunneling socat relays chisel SOCKS pivoting Docker container chains | Linux | Insane | [SSH & Linux Lateral Movement](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/ssh-and-linux-lateral-movement) | – |
| | [Secret](https://app.hackthebox.com/machines/Secret) HackTheBox Show spoilers JWT HS256 forgery git history secret recovery admin bypass command injection | Linux | Easy | [Authentication Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/authentication-attacks) | – |
| | [Nunchucks](https://app.hackthebox.com/machines/Nunchucks) HackTheBox Show spoilers ssti nunjucks nodejs rce | Linux | Easy | [Advanced Server-Side Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/advanced-server-side-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/11/02/htb-nunchucks.html) |
| | [Support](https://app.hackthebox.com/machines/Support?sort_by=created_at&sort_type=desc) HackTheBox Show spoilers smb-enumeration reverse-engineering ldap-enumeration resource-based-constrained-delegation dcsync | Windows | Easy | [Active Directory Fundamentals](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/active-directory-fundamentals) | [HackIndex.io](https://hackindex.io/writeups/support) |
| | [Carpediem](https://app.hackthebox.com/machines/Carpediem) HackTheBox Show spoilers CVE-2022-0492 cgroup v1 release_agent escape unprivileged user namespaces Docker container pivot VoIP enum | Linux | Hard | [Container Security & Escape](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/container-security-and-escape) | – |
| | [Unicode](https://app.hackthebox.com/machines/Unicode) HackTheBox Show spoilers JWT jku header injection open redirect to bypass JKU allowlist RS256 key swap LFI | Linux | Medium | [Authentication Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/authentication-attacks) | – |
| | [Exfiltrated](https://portal.offsec.com/machine/exfiltrated-17398/overview) Proving Grounds | Linux | Easy | [Chaining Vulnerabilities](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/chaining-vulnerabilities) | [HackIndex.io](https://hackindex.io/writeups/exfiltrated) |
| | [BountyHunter](https://app.hackthebox.com/machines/BountyHunter) HackTheBox Show spoilers xxe information-disclosure credential-reuse python-eval-injection | Linux | Easy | [Advanced Server-Side Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/advanced-server-side-attacks) | [0xdf.gitlab.io](https://0xdf.gitlab.io/2021/11/20/htb-bountyhunter.html) |
| | [Vulnerable Docker 1](https://www.vulnhub.com/entry/vulnerable-docker-1,208/) Vulnhub Show spoilers shellshock wordpress-rce exposed-docker-api docker-socket-mount chroot-escape container-escape | Linux | Medium | [Container Security & Escape](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/container-security-and-escape) | [www.notsosecure.com](https://www.notsosecure.com/vulnerable-docker-vm/) |
| | [Pollution](https://app.hackthebox.com/machines/Pollution) HackTheBox Show spoilers Prototype pollution (lodash defaultsDeep) Blind XML SSRF PHP filter chain RCE FastCGI abuse | Linux | Hard | [Advanced Server-Side Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/advanced-server-side-attacks) | – |
| | [JWT authentication bypass via jku header injection](https://portswigger.net/web-security/jwt/lab-jwt-authentication-bypass-via-jku-header-injection) PortSwigger Show spoilers JWT jku parameter abuse attacker-hosted JWKS RS256 key injection | Other | Hard | [Authentication Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/authentication-attacks) | – |
| | [Travel](https://app.hackthebox.com/machines/Travel) HackTheBox Show spoilers SSRF via gopher PHP memcached deserialization .git source disclosure LDAP group abuse | Linux | Hard | [Advanced Server-Side Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/advanced-server-side-attacks) | – |
| | [Authentication bypass via OAuth implicit flow](https://portswigger.net/web-security/oauth/lab-oauth-authentication-bypass-via-oauth-implicit-flow) PortSwigger Show spoilers OAuth implicit flow abuse client-side validation bypass social-login tampering | Other | Medium | [Authentication Attacks](https://hackindex.io/learn/pt2-penetration-tester-level-2-study-path/authentication-attacks) | – |

List last verified October 4, 2026.

HackIndex is not affiliated with, authorized, endorsed by, or sponsored by TryHackMe Ltd. TryHackMe, PT2, and Penetration Tester Level 2 are trademarks of their respective owner, used here nominatively for identification only. This study path uses only original HackIndex content and links to TryHackMe's official pages as the authoritative source.