boxes

All of the boxes, Sherlocks, and various other practice.

Hands-on security challenges spanning offensive and defensive domains, each with detailed write-ups covering methodology, tooling, and lessons learned. Purple team focus: analyzing red team challenges as an attacker (exploitation, privilege escalation) and blue team challenges as a responder (threat hunting, timeline analysis, IOC extraction).

By platform Total 97
HackTheBox
40
TryHackMe
24
HTB Challenges
10
VulnHub
1
Sherlocks
7
CyberDefenders
5
Blue Team Labs
10
By team Total 97
Red Team Labs
75
Blue Team Labs
22
Insane
Hard
Medium
Easy
Very Easy
Red Team Labs HackTheBox

Popcorn

Exploited file upload on torrent host

Haircut

Leveraged command injection vulnerability

Cronos

SQLi auth bypass, executed command injection

SolidState

Exploited JAMES SMTP server

Celestial

Exploited NodeJS deserialization vulnerability

Passage

Exploited CuteNews public vulnerability

Jeeves

Abused Jenkins Script Console.

HTB Blue

Exploited EternalBlue SMB vulnerability (MS17-010)

Jerry

Used default credentials to upload file via Tomcat

Nibbles

Exploited Nibbleblog public vulnerability

Knife

Exploited vulnerable PHP version

Remote

Discovered NFS credentials, executed authenticated exploit

Blocky

Decompiled JAR to extract credentials

Bashed

Discovered exposed CLI page with RCE

Grandpa

Abused IIS WebDAV vulnerability to execute code

Granny

Uploaded web shell via HTTP PUT

Irked

Leveraged UnrealIRCd exploit for RCE

Optimum

Exploited HFS 2.3 public vulnerability

GreenHorn

Discovered credentials in exposed repository

Sense

Exploited default credentials via known exploit

Sau

Exploited SSRF to access internal resources

BoardLight

Used default credentials with public exploit

Planning

Active challenge – details withheld per TOS

Titanic

Exploited LFI to steal credentials

Arctic

Exploited CFIDE vulnerability

Analytics

Escalated privilege via environment variables

Devvortex

Exploited stolen credentials via password reuse

Code

Bypassed Python word and import blacklists.

Love

Exploited public vulnerability in voting system

Curling

Exploited template injection using discovered password

OpenAdmin

Exploited Ona public vulnerability

Dog

Exploited RCE and exposed credentials.

Cap

Leveraged IDOR to access cleartext credentials

Lame

Exploited distcc service for remote code execution

Bank

Abused PHP file upload functionality.

Beep

Exploited Elastix LFI vulnerability.

Legacy

Exploited SMB vulnerability (MS08-067) for RCE

CodePartTwo

Exfilitrated Exposed Users Database.

MonitorsTwo

Exfilitrated Exposed Users Database.

Devel

Uploaded web shell via FTP server
TryHackMe

Brainpan

Wrote buffer overflow exploit for shell

Daily Bugle

Exploited Joomla via public vulnerability

Retro

Discovered credentials and executed theme code injection

Mr. Robot

Brute-forced credentials using exposed wordlist

Brainstorm

Wrote buffer overflow exploit

HackPark

Brute-forced credentials and uploaded file

Pickle Rick

Discovered exposed default credentials command panel

Steel Mountain

Exploited HttpFileServer 2.3 public vulnerability

Alfred

Discovered exposed script panel via default credentials

Game Zone

Used SQLMap to retrieve hash, gained SSH access

Skynet

Discovered credentials

Overpass 2

Captured credentials using Wireshark

Corp

Bypassed whitelist in application

Blaster

Discovered credentials and gained RDP access

Vulnversity

Bypassed file upload restrictions

SimpleCTF

Exploited CMS via public vulnerability

Ignite

Exploited Fuel CMS via public vulnerability

Colddbox - Easy

Brute-forced credentials, exploited theme injection

Billing

Exploited HTTP parameter for command injection

Library

Brute-forced SSH with Hydra

Ice

Executed public exploit

THM Blue

Gained remote access via MS17-010

Kenobi

Retrieved private key over SMB

Buffer Overflow Prep

Practiced buffer overflow exploitation techniques
HTB Challenges

Cred Hunter

Created Script To Analyze Data Dump.

PINsmith

Programmed a Python to Fix Data.

WebVault Time Machine Investigation

Performed Historical Web Intestigation Using Archives.

MinMax

Identify smallest and largest numbers in dataset.

SpookyPass

Extracted STRINGS to steal password.

Questionaire

Took a pop quiz, hotshot.

Mathematics

Completed a math pop quiz.

Behind The Scenes

Active challenge – details withheld per TOS

The Suspicious Reviewer

Investigate Fraudulent Reviewer Profile to Uncover Contact.

The Suspicious Domain

Investigate domain infrastructure to Uncover Campaign Links.
VulnHub

Photographer

Retrieved credentials via SMB
Blue Team Labs Sherlocks

ElectricBreeze-2

Active challenge – details withheld per TOS

Meerkat

Investigated PCAPs and correlated log data.

Bumblebee

Examined databases and correlated log data.

Noted

Investigated Notepad++ artifacts after exfiltration attack.

Brutus

Analyzed logs and identified brute-force.

PhishNet

Analysed a phishing email and attachment.

Unit42

Reviewed event logs for malware distribution.
CyberDefenders

Fake GPT Lab

Analyzed JS credential stealer malware

WebStrike Lab

Reviewed PCAP for Webshell Upload Attack.

PoisonedCredentials Lab

Reviewed PCAP for LLMNR/NBT-NS Poisoning Attack.

Oski Lab

Analyzed Virustotal and Any.Run virus reports.

Web Investigation Lab

Reviewed PCAP for SQL Injection Attack.
Blue Team Labs

Reverse Engineering - Another Injection

Active challenge – details withheld per TOS

Phishing Analysis

Active challenge – details withheld per TOS

Malware Analysis - Ransomware Script

Active challenge – details withheld per TOS

The Report

Active challenge – details withheld per TOS

ILOVEYOU

Active challenge – details withheld per TOS

MELISSA

Active challenge – details withheld per TOS

Phishing Analysis 2

Active challenge – details withheld per TOS

PowerShell Analysis Keylogger

Active challenge – details withheld per TOS

Meta

Reviewed jpeg metedata and reverse image search.

ATT&CK

Mapped adversary tactics using MITRE ATT&CK.