This repository contains a curated list of machines, notes, and resources targeting the eCPPT, OSCP and CPTS exams. It covers VulnHub, VulNyx, HackMyVM, TryHackMe, HackTheBox, PortSwigger and HackingHub targets, plus self-hosted labs and full AD ranges you can run offline.
The following machines are categorized by the specific skill sets required for the eCPPT exam.
Focus: Enumeration, Brute-force, Shells, Old School Exploits.
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
|---|---|---|---|---|---|
| Basic | VulNyx | Low | CUPS, SSH Brute-force, env SUID, Misconfiguration | Free | Download |
| Beginner | VulNyx | Low | UDP, TFTP, TFTP Brute-force, sudo html2text | Free | Download |
| Exec | VulNyx | Low | SMB, SMB Shares, PHP, sudo bash | Free | Download |
| Fing | VulNyx | Low | finger, Finger user enumeration, SSH Brute-force, doas | Free | Download |
| Fuser | VulNyx | Low | CUPS, CVE-2024-47176, Dash suid, RCE | Free | Download |
| Lower | VulNyx | Low | VHost Fuzzing, SSH Brute-force, Group writable | Free | Download |
| Lower4 | VulNyx | Low | ident, SSH Brute-force, sudo multitail, Misconfiguration | Free | Download |
| Lower6 | VulNyx | Low | Redis, Redis Brute-force, SSH Brute-force, Capabilities | Free | Download |
| Lower7 | VulNyx | Low | FTP, FTP Brute-force, Node.js, shadow Group | Free | Download |
| Noob | VulNyx | Low | id_rsa Cracking, su Brute-force, Misconfiguration | Free | Download |
| Absolute | VulNyx | Easy | SMB, HTTP GET Brute-force, PHP, sudo rclone | Free | Download |
| APex | VulNyx | Easy | OSINT, finger, SQLite, SSH Brute-force | Free | Download |
| Basic Pentesting 1 | VulnHub | Beg | Web to Root | Free | Download |
| Beep | HackTheBox | Easy | Web/Asterisk | VIP | HTB Link |
| Call | VulNyx | Easy | UDP, SIP, Md5 Cracking, sudo (CVE) | Free | Download |
| EasyPeasy | HackMyVM | Easy | Web/Shells | Free | HMV Link |
| Fire | VulNyx | Easy | FTP, Anonymous FTP, Firefox decrypt, Cockpit | Free | Download |
| Friendly | HackMyVM | Easy | FTP/SSH | Free | HMV Link |
| Gift | HackMyVM | Easy | Basic Enumeration | Free | HMV Link |
| Kioptrix Level 1 | VulnHub | Beg | SMB, Apache, mod_ssl | Free | Download |
| Kioptrix Level 1.1 | VulnHub | Beg | SQL Injection, RCE | Free | Download |
| Kioptrix Level 1.2 | VulnHub | Beg | LotusCMS | Free | Download |
| Kioptrix Level 1.3 | VulnHub | Beg | SQLi, Restricted Shell | Free | Download |
| Lame | HackTheBox | Easy | Enumeration/Samba | VIP | HTB Link |
| LazySysAdmin 1 | VulnHub | Beg | Info Disclosure | Free | Download |
| Lookup | VulNyx | Easy | DNS, Reverse DNS Lookup, DNS Zone Transfer, SSH Brute-force | Free | Download |
| Mission 1 | HackingHub | Easy | Basic Recon | Free | Start Mission |
| Open | VulNyx | Easy | Openplc, Default Creds, HTTP GET Brute-force, Ttyd | Free | Download |
| RickdiculouslyEasy 1 | VulnHub | Beg | Multiple Paths | Free | Download |
| Swamp | VulNyx | Easy | DNS, DNS Zone Transfer, Command Injection, Misconfiguration | Free | Download |
| Yadis | VulNyx | Easy | SMB, Redis, sudo yaegi, Misconfiguration | Free | Download |
| Belial | VulNyx | Medium | FTP, Anonymous FTP, FTP Brute-force, KeePass | Free | Download |
| Bulldog 1 | VulnHub | Int | Django, Hidden Files | Free | Download |
| Bund | VulNyx | Medium | rsync, rsync Brute-force, rsync Enumeration, Jekyll | Free | Download |
| Chain | VulNyx | Medium | UDP, SNMP, SNMP Community String Brute-force, SNMP Enumeration | Free | Download |
| Cronos | HackTheBox | Medium | DNS/Web | VIP | HTB Link |
| Dark | VulNyx | Medium | UDP, SNMP, SNMP Community String Brute-force, SNMP Enumeration | Free | Download |
| Discover | VulNyx | Medium | SMB, RPC Enumeration, SMB Brute-force, SMB Shares | Free | Download |
| HackLAB: Vulnix | VulnHub | Int | General Pentest | Free | Download |
| Hunter | VulNyx | Medium | DNS, DNS Zone Transfer, File Upload, sudo bsh | Free | Download |
| Kioptrix 2014 | VulnHub | Int | Web Exploits | Free | Download |
| Mission 2 | HackingHub | Medium | Foothold | Free | Start Mission |
| NullByte | VulnHub | Int | General Pentest | Free | Download |
| Prime 1 | VulnHub | Int | General Pentest | Free | Download |
| pWnOS 2.0 | VulnHub | Int | Old School | Free | Download |
| SickOs 1.1 | VulnHub | Int | Squid Proxy, Shellshock | Free | Download |
| SickOs 1.2 | VulnHub | Int | PUT Method, Cron Jobs | Free | Download |
| SkyTower 1 | VulnHub | Int | SSH Tunneling | Free | Download |
| Stapler 1 | VulnHub | Int | SMB Enum, Password Spraying | Free | Download |
| System | VulNyx | Medium | Redis, Redis Brute-force, FTP Brute-force, Redis module | Free | Download |
| Tr0ll 1 | VulnHub | Int | FTP, Binary Analysis | Free | Download |
| Unbaked Pie | HackMyVM | Medium | Docker/Pivoting | Free | HMV Link |
| VulnOS 2 | VulnHub | Int | General Pentest | Free | Download |
| Denied | VulNyx | Hard | SSH Enumeration, SSH Brute-force, doas, Misconfiguration | Free | Download |
| Raw | VulNyx | Hard | SNMP, SNMP Community String Brute-force, SNMP Enumeration, SMB | Free | Download |
| Tr0ll 2 | VulnHub | Hard | Deep Rabbit Holes | Free | Download |
| Blue | TryHackMe | - | EternalBlue (MS17-010) | Free | THM Link |
| Bounty Hacker | TryHackMe | - | FTP/SSH Attacks | Free | THM Link |
| Hydra | TryHackMe | - | Brute-forcing | Free | THM Link |
| Nmap Live Host Discovery | TryHackMe | - | Network Scanning | Free | THM Link |
| Vulnversity | TryHackMe | - | Upload Vulnerabilities | Free | THM Link |
Focus: SQLi, XSS, LFI, RCE, Manual Exploitation.
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
|---|---|---|---|---|---|
| Blogger | VulNyx | Low | WordPress, CMS, WP User Enum, WP Brute | Free | Download |
| Deploy | VulNyx | Low | Tomcat, Default Creds, WAR, sudo ex | Free | Download |
| Diff3r3ntS3c | VulNyx | Low | File Upload, PHP, Cron, RCE | Free | Download |
| Loweb | VulNyx | Low | SQLi, LFI, sudo chown, Misconfiguration | Free | Download |
| Lower5 | VulNyx | Low | LFI, Log Poisoning, sudo bash, Gpg Cracking | Free | Download |
| Wicca | VulNyx | Low | Node.js, Command Injection, sudo links | Free | Download |
| Arpon | VulNyx | Easy | File Upload, PHP, Zip Cracking, sudo arp | Free | Download |
| Automation | VulNyx | Easy | VHost Fuzzing, Livewire, CVE-2025-54068, Git | Free | Download |
| Bank | VulNyx | Easy | SMB, SMB Shares, JWT, Bcrypt Cracking | Free | Download |
| Base | HackMyVM | Easy | Basic Web | Free | HMV Link |
| Blog | VulNyx | Easy | Nibbleblog, CMS, HTTP POST Brute-force, File Upload | Free | Download |
| Cibercamp | VulNyx | Easy | WordPress, CMS, WP File Manager, CVE-2020-25213 | Free | Download |
| Code | VulNyx | Easy | Pluck, CMS, Default Creds, File Upload | Free | Download |
| Druid | VulNyx | Easy | VHost Fuzzing, HotelDruid, CVE-2022-22909, sudo perl | Free | Download |
| Explorer | VulNyx | Easy | Extplorer, PHP, Misconfiguration, RCE | Free | Download |
| External | VulNyx | Easy | VHost Fuzzing, XXE, MySQL, sudo mysql | Free | Download |
| Horizontall | HackTheBox | Easy | Strapi CMS | VIP | HTB Link |
| Load | VulNyx | Easy | RiteCMS, CMS, Default Creds, File Upload | Free | Download |
| MailForge | VulNyx | Easy | SSTI, File Upload, Eml file, CVE-2026-27641 | Free | Download |
| Method | VulNyx | Easy | HTTP Methods, PHP, Wildcard Injection, Misconfiguration | Free | Download |
| Northwing | VulNyx | Easy | LFI, PHP Wrappers, MySQL, Bcrypt Cracking | Free | Download |
| Ober | VulNyx | Easy | October, CMS, Default Creds, Misconfiguration | Free | Download |
| Panel | HackMyVM | Easy | Admin Panel Bypass | Free | HMV Link |
| Photographer 1 | VulnHub | Beg | Web/SMB | Free | Download |
| Printer | VulNyx | Easy | Command Injection, Screen suid, Misconfiguration | Free | Download |
| Ready | VulNyx | Easy | Redis, PHP, disk Group, id_rsa Cracking | Free | Download |
| Remote | VulNyx | Easy | WordPress, CMS, WP Gwolle Plugin, CVE-2015-8351 | Free | Download |
| Sales | VulNyx | Easy | VHost Fuzzing, HTTP POST Brute-force, SuiteCRM, CVE-2022-23940 | Free | Download |
| Serve | VulNyx | Easy | WebDAV, KDBX Cracking, HTTP GET Brute-force, HTTP Methods | Free | Download |
| Service | VulNyx | Easy | Joomla, CMS, CVE-2023-23752, PHP | Free | Download |
| Twitx | VulNyx | Easy | File Upload, PHP, Bcrypt Cracking, sudo ascii85 | Free | Download |
| Unit | VulNyx | Easy | HTTP Methods, PHP, sudo su, sudo xargs | Free | Download |
| VulnCMS 1 | VulnHub | Beg | CMS Enumeration | Free | Download |
| Web App Mission 1 | HackingHub | Easy | Common Web Vulns | Free | Start Mission |
| YourWAF | VulNyx | Easy | VHost Fuzzing, Command Injection, WAF, API | Free | Download |
| Zone | VulNyx | Easy | DNS, DNS Zone Transfer, File Upload, PHP | Free | Download |
| Access | VulNyx | Medium | WebSocket, FTP Brute-force, PHP 5, sudo perl | Free | Download |
| Billu: b0x | VulnHub | Int | SQLi, RCE, LFI | Free | Download |
| Breach 1.0 | VulnHub | Int | Traffic Analysis, SSL | Free | Download |
| Breach 2.1 | VulnHub | Int | Traffic Analysis | Free | Download |
| Ceres | VulNyx | Medium | LFI, PHP Wrappers, Log Poisoning, sudo python | Free | Download |
| DC-9 | VulnHub | Int | SQLi Search, LFI | Free | Download |
| Deathnote 1 | VulnHub | Int | LFI, RCE, Upload | Free | Download |
| DevGuru 1 | VulnHub | Int | Web Focus | Free | Download |
| EID | VulNyx | Medium | VHost Fuzzing, HTTP POST Brute-force, SSTI, RCE | Free | Download |
| Express | VulNyx | Medium | API, API Enumeration, HTTP Verb Tampering, SSRF | Free | Download |
| FristiLeaks 1.3 | VulnHub | Int | LFI to Shell, PrivEsc | Free | Download |
| Future | VulNyx | Medium | SSRF, LFI, id_rsa Cracking, Docker SUID | Free | Download |
| Hacksudo: Thor | VulnHub | Int | CGI-bin, Shellshock | Free | Download |
| JarJar | VulNyx | Medium | LFI, Ab suid, Yescrypt Cracking, Misconfiguration | Free | Download |
| Jenk | VulNyx | Medium | LFI, Jenkins, Bcrypt Cracking, Hping3 ping | Free | Download |
| Kyubi | VulNyx | Medium | Grafana, CVE-2021–43798, Path Traversal, Redis | Free | Download |
| LemonSqueezy | VulnHub | Int | Web | Free | Download |
| Mr-Robot 1 | VulnHub | Int | Wordpress, Keys, Decoding | Free | Download |
| MyWAF | VulNyx | Medium | VHost Fuzzing, WAF, MySQL, Capabilities | Free | Download |
| PwnLab: init | VulnHub | Int | LFI, PHP Filters, Cmd Inj | Free | Download |
| Raven 1 | VulnHub | Int | Wordpress, PHPMailer | Free | Download |
| Raven 2 | VulnHub | Int | PHPMailer RCE | Free | Download |
| Registry | HackMyVM | Medium | Docker Registry/Web | Free | HMV Link |
| Reset | VulNyx | Medium | LFI, SSRF, Command Injection, Find suid | Free | Download |
| Sandwich | VulNyx | Medium | VHost Fuzzing, HTTP POST Brute-force, sudo chvt | Free | Download |
| Shared | VulNyx | Medium | WordPress, Wordpress plugin site editor, CVE-2018-7422, LFI | Free | Download |
| Site | HackMyVM | Medium | Web Exploitation | Free | HMV Link |
| Spooisong | VulNyx | Medium | PHP, LFI, Log Poisoning, Dns spoofing | Free | Download |
| TheDoor | VulNyx | Medium | FTP, Anonymous FTP, SQLi, IDOR | Free | Download |
| Tom | VulNyx | Medium | LFI, Tomcat, WAR, sudo ascii85 | Free | Download |
| W34kn3ss 1 | VulnHub | Int | Web/PrivEsc | Free | Download |
| Web App Mission 2 | HackingHub | Medium | Advanced Web Vulns | Free | Start Mission |
| WebSploit2018 | VulnHub | Int | Vulnerable Apps Collection | Free | Download |
| Blind XSS Masterclass | HackingHub | Advanced | XSS | Paid | Course Link |
| GoldenEye 1 | VulnHub | Hard | POP3, Compilation | Free | Download |
| Hands-On Web Exploitation Course | HackingHub | Advanced | Various Web Vulns | Paid | Course Link |
| Headache | VulNyx | Hard | API, API Enumeration, Api rest, SSRF | Free | Download |
| Init | VulNyx | Hard | Command Injection, Git, SQLite, XXE | Free | Download |
| Jerry | VulNyx | Hard | File Upload, XXE, PHP, sudo node | Free | Download |
| Mirage | VulNyx | Hard | API, API Enumeration, Reverse engineering, Suid binary | Free | Download |
| Nuclei Masterclass | HackingHub | Advanced | Vulnerability Scanning | Paid | Course Link |
| Pinkys Palace v1 | VulnHub | Hard | SQLi, Dictionary Attacks | Free | Download |
| Pinkys Palace v2 | VulnHub | Hard | Proxy Tunneling, SQLi | Free | Download |
| Pressed | HackTheBox | Hard | WordPress/XML-RPC | VIP | HTB Link |
| SlyWindow | VulNyx | Hard | VHost Fuzzing, Stego, XSS, API | Free | Download |
| Solar | VulNyx | Hard | XSS, Mqtt, LFI, PHP | Free | Download |
| Trace | VulNyx | Hard | NFS, Nfs enumeration, VHost Fuzzing, Type juggling | Free | Download |
| Wrapp | VulNyx | Hard | SSRF, PHP Wrappers, LFI, Tomcat | Free | Download |
| Yincana | VulNyx | Hard | XSS, IDOR, LFI, id_rsa Cracking | Free | Download |
| Authentication & Logic | PortSwigger | - | Bypassing Controls | Free | Start Lab |
| Burp Suite Basics | TryHackMe | - | Proxy Interception | Paid | THM Link |
| Command Injection | PortSwigger | - | OS Command Execution | Free | Start Lab |
| Cross-Site Request Forgery | PortSwigger | - | CSRF Token Bypass | Free | Start Lab |
| Cross-Site Scripting (XSS) | PortSwigger | - | Reflected, Stored, DOM | Free | Start Lab |
| Directory Traversal | PortSwigger | - | File Path Traversal | Free | Start Lab |
| File Inclusion | TryHackMe | - | LFI/RFI/Path Traversal | Paid | THM Link |
| OWASP Juice Shop | TryHackMe | - | Modern Web Exploitation | Free | THM Link |
| OWASP Top 10 | TryHackMe | - | Critical Web Vulns | Free | THM Link |
| Server-Side Request Forgery | PortSwigger | - | SSRF & Cloud Metadata | Free | Start Lab |
| SQL Injection (All Labs) | PortSwigger | - | Manual SQLi Mastery | Free | Start Lab |
| SQL Injection Lab | TryHackMe | - | Manual/Automated SQLi | Free | THM Link |
| XML External Entity (XXE) | PortSwigger | - | Injection & Retrieval | Free | Start Lab |
Focus: Recon, Lateral Movement, Tunneling. (Requires Lab Setup)
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
|---|---|---|---|---|---|
| Care | VulNyx | Easy | LFI, Squid, Log Poisoning, sudo perl | Free | Download |
| Goetia | VulNyx | Easy | Command Injection, Port Forwarding, PHP Filter Chain, LD_PRELOAD | Free | Download |
| Hidden | VulNyx | Easy | UDP, TFTP, PHP, sudo dash | Free | Download |
| Observer | VulNyx | Easy | SSH Brute-force, X11, X11 Forwarding, Env Vars | Free | Download |
| Psymin | VulNyx | Easy | PHP, PsySH, id_rsa Cracking, Port Forwarding | Free | Download |
| ShadowBlocks | VulNyx | Easy | iSCSI, 7z Cracking, Port Forwarding, NFS no_root_squash | Free | Download |
| Anon | VulNyx | Medium | Log Poisoning, Pivoting, SSH Brute-force, Docker Group | Free | Download |
| Baal | VulNyx | Medium | CVE-2023-25690, ICMP Tunneling, RCE | Free | Download |
| Bola | VulNyx | Medium | rsync, rsync Brute-force, Port Forwarding, IDOR | Free | Download |
| Cache | VulNyx | Medium | Squid, SSH Brute-force, sudo python3, Writable /etc/passwd | Free | Download |
| ExposedDev | VulNyx | Medium | VHost Fuzzing, LFI, Git, Port Forwarding | Free | Download |
| Hat | VulNyx | Medium | LFI, IPv6, FTP, FTP Brute-force | Free | Download |
| Internal | VulNyx | Medium | LFI, Port Forwarding, Vnc, Misconfiguration | Free | Download |
| Key | VulNyx | Medium | IPv6, Redis, sudo perl, sudo runc | Free | Download |
| Leak | VulNyx | Medium | Jenkins, Cve‑2024‑23897, IPv6, sudo wkhtmltopdf | Free | Download |
| Responder | VulNyx | Medium | LFI, PHP Wrappers, id_rsa Cracking, IPv6 | Free | Download |
| Static | VulNyx | Medium | rsync, rsync Brute-force, Node.js, Nodejs ecstatic | Free | Download |
| SummarizeThis | VulNyx | Medium | Ai, Prompt injection, PostgreSQL, Port Forwarding | Free | Download |
| Unbaked Pie | HackMyVM | Medium | Docker Pivoting | Free | HMV Link |
| Vault | HackTheBox | Medium | SSH Tunneling | VIP | HTB Link |
| Cap | VulNyx | Hard | ident, IPv6, SSH Brute-force, GRUB | Free | Download |
| Gattaca | VulNyx | Hard | HTTP GET Brute-force, Command Injection, Port Forwarding, FTP Brute-force | Free | Download |
| Gen | VulNyx | Hard | SSH Brute-force, Port Forwarding, sudo puttygen | Free | Download |
| Lang | VulNyx | Hard | UDP, SNMP, SNMP Community String Brute-force, SNMP Enumeration | Free | Download |
| Lost | VulNyx | Hard | VHost Fuzzing, SQLi, Port Forwarding, Command Injection | Free | Download |
| Machine | HackMyVM | Hard | Internal Network | Free | HMV Link |
| Monitor | VulNyx | Hard | VHost Fuzzing, HTTP GET Brute-force, PHP, Log Poisoning | Free | Download |
| Travel | VulNyx | Hard | LFI, IPv6, rsync, Log Poisoning | Free | Download |
| Tunnel | VulNyx | Hard | Squid, FTP, Zip Cracking, sudo bash | Free | Download |
| WinterMute | HackMyVM | Hard | (Clone of VulnHub Lab) | Free | HMV Link |
| Reddish | HackTheBox | Insane | Chisel/Socat Pivoting | VIP | HTB Link |
| Lateral Movement | TryHackMe | - | Moving through Windows | Paid | THM Link |
| Metasploitable 3 | GitHub | - | Setup as dual-homed target. | Free | GitHub |
| myHouse7 | VulnHub | - | Docker/Subnet pivoting. | Free | Download |
| Pivoting | TryHackMe | - | Proxychains, sshuttle, Chisel | Paid | THM Link |
| Symfonos Series | VulnHub | - | Good for internal service chains. | Free | Download |
| WinterMute 1 | VulnHub | - | Best for Pivoting. Dual-VM lab. | Free | Download |
| Wpwn 1 | VulnHub | - | Dual NICs designed for pivoting. | Free | Download |
| Wreath | TryHackMe | - | Full Pivoting Network (Must Do) | Free* | THM Link |
Focus: Stack Buffer Overflow.
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
|---|---|---|---|---|---|
| Buffer | HackMyVM | Medium | Stack Overflow | Free | HMV Link |
| Bunker | VulNyx | Medium | SCTP, Default Creds, Tomcat, WAR | Free | Download |
| Debug | VulNyx | Medium | UDP, SNMP, SNMP Community String Brute-force, gdbserver | Free | Download |
| Encode | VulNyx | Medium | Node.js, node-serialize, Deserialization, sudo gcc | Free | Download |
| October | HackTheBox | Medium | Buffer Overflow (ASLR/NX) | VIP | HTB Link |
| Overflow | HackMyVM | Medium | Binary Exploitation | Free | HMV Link |
| Brainpan | HackMyVM | Hard | (Clone/Similar) | Free | HMV Link |
| Developer | VulNyx | Hard | LFI, IPv6, rsync, disable_functions Bypass | Free | Download |
| Overflow | HackTheBox | Hard | Buffer Overflow | VIP | HTB Link |
| Transfer | VulNyx | Hard | VHost Fuzzing, PHP Wrappers, Command Injection, Port Forwarding | Free | Download |
| Brainpan 1 | VulnHub | - | The King of BoF. Do this until you dream in hex. | Free | Download |
| Brainpan 2 | VulnHub | - | Advanced Binary Exploitation. | Free | Download |
| Brainpan | TryHackMe | - | THM Port of VulnHub Machine | Free | THM Link |
| Buffer Overflow Prep | TryHackMe | - | Tib3rius Room (TryHackMe). | Free | THM Link |
| Gatekeeper | TryHackMe | - | Binary Exploitation | Free | THM Link |
| Intro To Pwntools | TryHackMe | - | Scripting Exploits. | Free | THM Link |
| Smasher | VulnHub | - | Web to Buffer Overflow. | Free | Download |
| Stack Overflows for Beginners | VulnHub | - | Linear progression BoF. | Free | Download |
| Sudo Buffer Overflow | TryHackMe | - | CVE-2019-18634 | Free | THM Link |
Focus: Linux PrivEsc, Cron jobs, SUID, Kernel exploits.
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
|---|---|---|---|---|---|
| Agent | VulNyx | Low | WebSVN, CVE-2021-32305, sudo c99, sudo ssh-agent | Free | Download |
| Doctor | VulNyx | Low | LFI, id_rsa Cracking, Writable /etc/passwd, Misconfiguration | Free | Download |
| First | VulNyx | Low | Raspberry Pi, Default Creds, rbash, rbash Bypass | Free | Download |
| HackingStation | VulNyx | Low | Command Injection, sudo nmap, Misconfiguration | Free | Download |
| Infected | VulNyx | Low | Backdoor, Apache mod_backdoor, sudo service, sudo joe | Free | Download |
| Look | VulNyx | Low | SSH Brute-force, Env Vars, sudo nokogiri, Misconfiguration | Free | Download |
| Lower2 | VulNyx | Low | Telnet, Telnet Brute-force, shadow Group, Shadow writable | Free | Download |
| Lower3 | VulNyx | Low | NFS, NFS no_root_squash, Misconfiguration, RCE | Free | Download |
| Mux | VulNyx | Low | Stego, strings, rlogin, sudo tmux | Free | Download |
| Network | VulNyx | Low | Command Injection, sudo ip, RCE, Misconfiguration | Free | Download |
| Node | VulNyx | Low | Node red, sudo node, Misconfiguration, RCE | Free | Download |
| Plot | VulNyx | Low | VHost Fuzzing, sar2html, sudo ssh, Wildcard Injection | Free | Download |
| Real | VulNyx | Low | Unrealircd, CVE-2010-2075, Cron, Hosts writable | Free | Download |
| Robot | VulNyx | Low | Stego, MongoDB, SSH Brute-force, sudo sh | Free | Download |
| Share | VulNyx | Low | Weborf, CVE-2010-3306, LFI, id_rsa Cracking | Free | Download |
| Shock | VulNyx | Low | Shellshock, CVE-2014-6271, cgi-bin, sudo busybox | Free | Download |
| Zero | VulNyx | Low | PHP 8.1.0-dev Backdoor, Backdoor, sudo wine, RCE | Free | Download |
| Air | VulNyx | Easy | File Upload, sudo vifm, Misconfiguration | Free | Download |
| Alpine | VulNyx | Easy | Git, Cron, Misconfiguration | Free | Download |
| Blind | VulNyx | Easy | Blind command injection, sudo jshell, Misconfiguration | Free | Download |
| Brain | VulNyx | Easy | LFI, sudo wfuzz, Python Library Hijacking | Free | Download |
| Flash | VulNyx | Easy | SSTI, sudo expect, RCE, Misconfiguration | Free | Download |
| Friends | VulNyx | Easy | OSINT, MySQL, MySQL Brute-force, Mysql load_file | Free | Download |
| Hit | VulNyx | Easy | Git, Knock, Port knocking, id_rsa Cracking | Free | Download |
| Hook | VulNyx | Easy | Htmlawed, CVE-2022-35914, sudo perl, sudo iex | Free | Download |
| Memory | VulNyx | Easy | Memcache, SSH Brute-force, sudo wormhole, Misconfiguration | Free | Download |
| Misstep | VulNyx | Easy | API, Docker, Docker Group, Cron | Free | Download |
| Play | VulNyx | Easy | Musicco, Path Traversal, Arbitrary directory download, SSH Brute-force | Free | Download |
| Plex | VulNyx | Easy | Sslh, Multiplexer, JWT, sudo mutt | Free | Download |
| Return | HackTheBox | Easy | Windows/Server Operators | VIP | HTB Link |
| Send | VulNyx | Easy | rsync, Cron, Apt writable, Misconfiguration | Free | Download |
| Shop | VulNyx | Easy | SQLi, Sqli time based, SSH Brute-force, Capabilities | Free | Download |
| Slash | VulNyx | Easy | Nginx misconfigured, Path Traversal, SSH Brute-force, sudo aoss | Free | Download |
| Bind | VulNyx | Medium | SCTP, sudo wtfutil, Misconfiguration | Free | Download |
| Chimera | VulNyx | Medium | Gitea, Git, CVE-2024–1086 | Free | Download |
| Coliseum | VulNyx | Medium | IDOR, PostgreSQL, su Brute-force, sudo busybox | Free | Download |
| Escalate | HackMyVM | Medium | SUID/Sudo Abuse | Free | HMV Link |
| Hellman | VulNyx | Medium | TBA | Free | Download |
| Jeeves | HackTheBox | Medium | Windows/RottenPotato | VIP | HTB Link |
| Listen | VulNyx | Medium | id_rsa Cracking, CVE-2018-15473, Cron, Cron Hijacking | Free | Download |
| LostTape | VulNyx | Medium | Git, LFI, Xinetd, Bof | Free | Download |
| VulNyx | Medium | LFI, Smtp, Mail poisoning, sudo mail | Free | Download | |
| Matrix | VulNyx | Medium | Pcap, Stego, Wildcard Injection, sudo rsync | Free | Download |
| PrivEsc Mission | HackingHub | Medium | Linux PrivEsc | Free | Start Mission |
| PrivEsc | HackMyVM | Medium | Multi-vector Escalation | Free | HMV Link |
| Safeguard | VulNyx | Medium | Tomcat, CVE-2025-24813, Cron, Cron Hijacking | Free | Download |
| Secrets | VulNyx | Medium | HTTP POST Brute-force, id_rsa Cracking, sudo date, sudo jed | Free | Download |
| Toxin | HackMyVM | Medium | Kernel Exploits | Free | HMV Link |
| University | VulNyx | Medium | Moodle, CVE-2024-43425, KDBX Cracking, sudo git | Free | Download |
| Volt | VulNyx | Medium | TBA | Free | Download |
| Zerotrace | VulNyx | Medium | LFI, sudo chattr, Cron, Ethereum Cracking | Free | Download |
| Annunciation | VulNyx | Hard | Command Injection, Cron, CVE-2021-3156, Misconfiguration | Free | Download |
| Backdoor | VulNyx | Hard | Backdoor, HTTP POST Brute-force, Writable apache2.conf, sudo bettercap | Free | Download |
| QuartzLock | VulNyx | Hard | TBA | Free | Download |
| DC-1 | VulnHub | - | SUID Abuse. | Free | Download |
| DC-2 | VulnHub | - | Restricted Shell. | Free | Download |
| DC-3 | VulnHub | - | Kernel Exploit. | Free | Download |
| DC-4 | VulnHub | - | Sudo Abuse. | Free | Download |
| DC-5 | VulnHub | - | Screen Exploit. | Free | Download |
| DC-6 | VulnHub | - | Script Abuse. | Free | Download |
| Escalate_Linux 1 | VulnHub | - | 12+ Methods of Escalation. | Free | Download |
| Lin.Security | VulnHub | - | Dedicated PrivEsc Practice. | Free | Download |
| Linux for Hackers Course | HackingHub | Intermediate | Linux Skills | Paid | Course Link |
| Linux PrivEsc | TryHackMe | - | Full Linux Escalation Course | Paid | THM Link |
| Post-Exploitation Basics | TryHackMe | - | Mimikatz, Bloodhound, Powerview | Paid | THM Link |
| PrivEsc Arena | TryHackMe | - | Multi-vector Practice | Paid | THM Link |
| Temple of Doom | VulnHub | - | Node.js / Serialization. | Free | Download |
| Tommy Boy 1 | VulnHub | - | Sudo Abuse. | Free | Download |
| Windows PrivEsc | TryHackMe | - | Full Windows Escalation Course | Paid | THM Link |
Focus: Kerberoasting, AS-REP, Domain Dominance.
WARNING: VulnHub is weak for AD. Use these resources instead.
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
|---|---|---|---|---|---|
| Build | VulNyx | Low | Jenkins, Default Creds, Misconfiguration, RCE | Free | Download |
| Eternal | VulNyx | Low | SMB, MS17-010, CVE-2017-0143, EternalBlue | Free | Download |
| Experience | VulNyx | Low | SMB, MS08-067, CVE-2008-4250, NetAPI | Free | Download |
| Active | HackTheBox | Easy | Kerberoasting/GPP | VIP | HTB Link |
| Admin | VulNyx | Easy | SMB Brute-force, WinRM, PowerShell History, Misconfiguration | Free | Download |
| Carlam | VulNyx | Easy | NFS, SMB, RID Brute, SSH Brute-force | Free | Download |
| Dump | VulNyx | Easy | FTP, Anonymous FTP, SAM/SYSTEM Dump, NTLM Cracking | Free | Download |
| Hosting | VulNyx | Easy | SMB, SMB Brute-force, RPC Enumeration, WinRM | Free | Download |
| Magic | VulNyx | Easy | SMB, SMB RID Brute, SMB Brute-force, SMB Shares | Free | Download |
| Policy | VulNyx | Easy | Zip Cracking, GPP, groups.xml, GPP Decrypt | Free | Download |
| Sauna | HackTheBox | Easy | AD Enumeration | VIP | HTB Link |
| SRV | VulNyx | Easy | FTP, Anonymous FTP, IIS, ASPX | Free | Download |
| Store | VulNyx | Easy | IIS, File Upload, ASPX, SeImpersonatePrivilege | Free | Download |
| Sun | VulNyx | Easy | SMB, SMB RID Brute, SMB Brute-force, SMB Shares | Free | Download |
| War | VulNyx | Easy | Tomcat, Default Creds, WAR, SeImpersonatePrivilege | Free | Download |
| Change | VulNyx | Medium | Active Directory, SMB Brute-force, Kerberos, LDAP | Free | Download |
| Controler | VulNyx | Medium | Active Directory, SMB Brute-force, Kerberos, LDAP | Free | Download |
| Misconfigured | VulNyx | Medium | Active Directory, SMB Brute-force, LDAP, LDAP Enumeration | Free | Download |
| Monteverde | HackTheBox | Medium | Azure AD Traits | VIP | HTB Link |
| Tech | VulNyx | Medium | LFI, PHP, Log Poisoning, Misconfiguration | Free | Download |
| AD Course | HackingHub | Advanced | Full AD Compromise | Paid | Course Link |
| AD Mission | HackingHub | Hard | AD Exploitation | Free | Start Mission |
| AD | HackMyVM | Hard | Basic AD Chain | Free | HMV Link |
| Blackfield | HackTheBox | Hard | Forensics/AD | VIP | HTB Link |
| Domain | HackMyVM | Hard | Kerberos Attacks | Free | HMV Link |
| Manager | VulNyx | Hard | UDP, SNMP, SNMP Community String Brute-force, SNMP Enumeration | Free | Download |
| School | VulNyx | Hard | LFI, Tomcat, WAR, SeImpersonatePrivilege | Free | Download |
| Sizzle | HackTheBox | Hard | Deep AD | VIP | HTB Link |
| Controller | HackMyVM | Insane | Full Forest Compromise | Free | HMV Link |
| GOAD | GitHub | - | Full Lab | Free | GitHub |
| VulnLab | VulnLab | - | Cloud Lab | Paid | Website |
| Active Directory Basics | TryHackMe | - | AD Fundamentals | Free | THM Link |
| Attacktive Directory | TryHackMe | - | Kerberos, Impacket, Domain Admin | Free | THM Link |
| Breaching Active Directory | TryHackMe | - | Initial Access in AD | Free | THM Link |
| Dante | HackTheBox | - | Pro Lab | Paid | HTB Link |
| HTB ProLabs | HackTheBox | - | Cloud Lab | Paid | Website |
| Lateral Movement in AD | TryHackMe | - | Spreading through the Domain | Paid | THM Link |
| Metasploitable 3 | GitHub | - | Local Lab | Free | GitHub |
| Offshore | HackTheBox | - | Pro Lab | Paid | HTB Link |
| Post-Exploitation Basics | TryHackMe | - | Persistence & Looting | Paid | THM Link |
| RastaLabs | HackTheBox | - | Pro Lab | Paid | HTB Link |
| Zephyr | HackTheBox | - | Pro Lab | Paid | HTB Link |
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
|---|---|---|---|---|---|
| Basic Malware RE | TryHackMe | - | Reversing Fundamentals | Free | THM Link |
| Carnage | TryHackMe | - | C2 Simulation | Free | THM Link |
| Dunkle Materie | TryHackMe | - | Packed Malware | Free | THM Link |
| History of Malware | TryHackMe | - | Intro to Malware | Free | THM Link |
| MAL: Malware Introductory | TryHackMe | - | Basic Concepts | Free | THM Link |
| MAL: Researching | TryHackMe | - | Analysis & Research | Free | THM Link |
| Mobile Malware Analysis | TryHackMe | - | Android/iOS Malware | Free | THM Link |
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
|---|---|---|---|---|---|
| Aster | TryHackMe | - | Decompiling Python | Free | THM Link |
| CC: Ghidra | TryHackMe | - | Ghidra Tool | Free | THM Link |
| CC: Radare2 | TryHackMe | - | Radare2 Tool | Free | THM Link |
| Classic Passwd | TryHackMe | - | Binary Reversing | Free | THM Link |
| Intro to x86-64 | TryHackMe | - | Assembly Basics | Free | THM Link |
| JVM Reverse Engineering | TryHackMe | - | Java Bytecode | Free | THM Link |
| REloaded | TryHackMe | - | Various Challenges | Free | THM Link |
| Reverse Engineering | TryHackMe | - | RE Fundamentals | Free | THM Link |
| Reversing ELF | TryHackMe | - | Linux ELF Binaries | Free | THM Link |
| Windows x64 Assembly | TryHackMe | - | Windows Assembly | Free | THM Link |
| Machine / Room | Platform | Difficulty | Focus | Cost | Link |
|---|---|---|---|---|---|
| All Hard Machines | HackTheBox | Hard | Various | VIP | HTB Link |
| doubletrouble: 1 | VulnHub | Hard | Misconfigs/PrivEsc | Free | Download |
| Empire: Breakout | VulnHub | Hard | Adv. PrivEsc | Free | Download |
| Hacksudo: FOG | VulnHub | Hard | Web/Linux PrivEsc | Free | Download |
| Hacksudo: Thor | VulnHub | Hard | Unique PrivEsc | Free | Download |
| Hard | HackMyVM | Hard | Advanced Exploits | Free | HMV Link |
| Metasploitable 3 | VulnHub | Hard | Windows Exploit | Free | GitHub |
| SickOS 1.2 | VulnHub | Hard | Masterful Exploitation | Free | Download |
| Temple of Doom | VulnHub | Hard | Obscure Puzzles | Free | Download |
| Tr0ll 2 | VulnHub | Hard | Deep Exploitation | Free | Download |
| Vikings: 1 | VulnHub | Hard | Lateral Movement | Free | Download |
| All Insane Machines | HackTheBox | Insane | Various | VIP | HTB Link |
| Insane | HackMyVM | Insane | Complex Challenges | Free | HMV Link |
| Borderlands | TryHackMe | - | Boot2Root | Free | THM Link |
| Brainpan 1 | TryHackMe | - | Buffer Overflow | Paid | THM Link |
| Daily Bugle | TryHackMe | - | CMS Exploitation | Paid | THM Link |
| Internal | TryHackMe | - | Pivoting/AD | Paid | THM Link |
| Iron Corp | TryHackMe | - | Web/Linux Exploit | Paid | THM Link |
| Jeff | TryHackMe | - | Boot2Root | Paid | THM Link |
| Motunui | TryHackMe | - | Boot2Root | Free | THM Link |
| Ra | TryHackMe | - | AD/Internal Network | Paid | THM Link |
| Retro | TryHackMe | - | Boot2Root | Free | THM Link |
| Spring | TryHackMe | - | Web App Hacking | Paid | THM Link |
| Squid Game | TryHackMe | - | Malware/RE | Paid | THM Link |
| VulnNet: dotjar | TryHackMe | - | Java Deserialization | Paid | THM Link |
Full multi-host environments for practising lateral movement, AD attacks and detection engineering. These are the closest free stand-ins for the OSCP challenge labs and the CPTS/eCPPTv3 internal-network sections.
| Lab | Type | Focus | Cost | Link |
|---|---|---|---|---|
| HackLabs | Self-hosted | Curated vulnerable-lab collection & guided paths | Free | GitHub |
| Metasploitable 3 | Self-hosted (Vagrant) | Windows Server 2008 + Ubuntu targets, dual-homed for pivoting | Free | GitHub |
| HackMyVM | Downloadable VMs | 400+ boot2root machines, free flag submission & ladder | Free | Website |
| VulNyx | Downloadable VMs | 179 free boot2root VMs, listed by domain above | Free | Website |
| DetectionLab | Self-hosted (Vagrant/Terraform) | Blue-team telemetry: Splunk, Sysmon, osquery, Velociraptor | Free | GitHub |
| Windows Attack & Defense Lab | Self-hosted | Windows/AD attack paths paired with defensive tooling | Free | GitHub |
| Range | Type | Focus | Cost | Link |
|---|---|---|---|---|
| GOAD v3 | Multi-domain AD range | Kerberoasting, AS-REP, delegation, trust abuse, ADCS. The free AD range | Free | GitHub |
| VulnLab | Cloud range | Chained AD/Windows labs, OSCP+ difficulty | Paid | Website |
| HTB Pro Labs | Cloud range | Dante, RastaLabs, Offshore, Zephyr | Paid | Website |
GOAD lab variants: pick one that fits your hardware; all ship in the same repo and deploy via Vagrant/Ansible (VirtualBox, VMware, Proxmox, or Azure providers).
| Variant | Size | Topology | Link |
|---|---|---|---|
| MINILAB | 2 VMs | 1 forest, 1 domain (1 DC + 1 Win10 workstation) | Docs |
| GOAD-Light | 3 VMs | 1 forest, 2 domains. Start here on a smaller PC | Docs |
| GOAD | 5 VMs | 2 forests, 3 domains. The full lab | Docs |
| SCCM | 4 VMs | 1 forest, 1 domain with Microsoft Configuration Manager | Docs |
| DRACARYS | 3 VMs | Challenge lab, 1 domain, no schema provided | Docs |
| NHA | 5 VMs | Challenge lab, 2 domains, no schema provided | Docs |
This project is licensed under the MIT License.
You are free to use, modify, and distribute this toolkit for personal or commercial purposes, provided that the original copyright notice and this permission notice are included in all copies or substantial portions of the software.
See the full license text in the MIT License.