Pre We finish the roadmap where a lot of people start their hacking journey: Pickle Rick, a light, funny THM room that teaches the single most important web-recon habit – read the source code an...

Pre Back to TryHackMe for a moment, because Attacktive Directory is the best guided introduction to the Impacket + Kerberos toolchain I know of. It reinforces everything from Forest and Active...

Pre Active is the perfect companion to Forest: it’s another AD box, but it teaches two different techniques – GPP cpassword recovery and Kerberoasting – so together the pair covers most of the “...

Pre Time for the big one: our first Active Directory box. If everything so far has been single hosts, Forest is where we start thinking about a domain. It covers the AD starter pack: LDAP/RPC ...

Pre Paper is a modern, realistic box: a WordPress information-disclosure bug leaks a secret, that secret leads to a Rocket.Chat workspace with an over-helpful bot, and root falls to a 2021 polki...

Pre Jeeves is a fantastic Windows box that strings together four very different skills: an unauthenticated Jenkins console, cracking a KeePass database, a pass-the-hash, and reading a flag hidde...

Pre Doctor is the box that made SSTI (Server-Side Template Injection) click for me. A Flask app renders a user-supplied string through Jinja2 without escaping, and that single mistake turns “pri...

Pre Jarvis is our first Medium box and our first proper SQL injection. I’ll show the manual approach first (because understanding UNION injection is non-negotiable) and then the sqlmap shortcut....

Pre BountyHunter is the box I always recommend to someone who wants to finally understand XXE (XML External Entity injection). The web form is small enough to read end-to-end, so the vulnerabili...

Pre OpenAdmin is a proper little chain: a web-app RCE, then two hops of credential reuse, a cracked SSH key, and finally a classic GTFOBins sudo escape. It’s the box that really drills in the ...