Browse the Full Catalog

Test your Application Attacks knowledge and skills to identify strengths, gaps, and weaknesses in areas like web application vulnerabilities and Burp Suite. Measure your mastery of Application Attacks and advance your career with targeted course and virtual lab recommendations.

‍

Test your Evasion knowledge and skills to identify strengths, gaps, and weaknesses in areas like identifying ingress and egress rules, evading Microsoft Defender, and bypassing web application firewalls.

Test your Credential Attacks knowledge and skills to identify strengths, gaps, and weaknesses in areas like Password Cracking, Password Spraying, and Credential Stuffing.

‍

Test your Network Attacks knowledge and skills to identify strengths, gaps, and weaknesses in areas like reconnaissance, enumeration, exploitation, and more. Measure your mastery of Network Attacks and advance your career with targeted course and virtual lab recommendations.

Test your Reconnaissance and Enumeration knowledge and skills to identify strengths, gaps, and weaknesses in areas like OSINT, network reconnaissance, and local host enumeration.

Test your Offensive Security Fundamentals knowledge to identify strengths, gaps, and weaknesses in areas like offensive security operations and cyber kill chains. Measure your mastery of Offensive Security Fundamentals and advance your career with targeted course recommendations.

In this hands-on challenge, you will practice using Burp Suite to exploit a vulnerable web application.

In this hands-on challenge, you will practice exploiting SSRF vulnerablities and converting binary output.

In this hands-on challenge, you will practice identifying potential egress points through intermediate devices and creating tunnels out of a network.

In this hands-on challenge, you will practice making changes to a malware sample in order to evade Microsoft Defender.

In this hands-on challenge, you will exercise your password cracking and password spraying skills.

In this hands-on challenge, you will exercise your password cracking skills to defeat the security of an encrypted file.

In this hands-on challenge, you will practice identifying and exploiting vulnerabilities on a target host, then using tunneling and pivoting to broker access to internal services

In this hands-on challenge, you will practice network sniffing. You will interpret and manipulate a packet capture to gain access to other hosts on a target network.

In this hands-on challenge, you will practice performing local host enumeration and privilege escalation on a Linux system.

In this hands-on challenge, you will practice using Nmap to identify and exploit simple vulnerabilities on target hosts.

In this hands-on lab, you will learn the basics of API Attacks. You will practice exploiting some common API vulnerabilities in a REST-based web application.

In this hands-on lab, you will learn the basics of deserialization attacks. You will practice performing deserialization attacks using Python scripts and Burp Suite.

In this hands-on lab, you will learn about Web Application Firewalls (WAF) and common techniques for bypassing them. You will practice using manual testing techniques to bypass various WAF configurations.

In this hands-on lab, you will learn the basics of Server-Side Request Forgery (SSRF) Attacks. You will practice performing live SSRF attacks against a vulnerable web application.

In this hands-on lab, you will learn the basics of injection attacks. You will practice performing SQL injection, command injection, and XSS attacks against a vulnerable web application.

‍

In this hands-on lab, you will learn about password spraying and credential stuffing. You will practice using Hydra and Burp Suite to perform password spraying and credential stuffing attacks.

‍

In this course, you will learn the basics of applications and how to attack them, including web application architecture, common vulnerablities, and mitigation strategies.

‍

In this hands-on lab, you will learn about evading Microsoft Defender. You will practice using process injection and obfuscation techniques to evade Microsoft Defender.

‍

In this hands-on lab, you will learn about tunneling and pivoting as tactics for traversing target networks. You will practice tunneling and pivoting using Metasploit and SSH Dynamic Port Forwarding.

In this hands-on challenge, you will practice researching log events related to a reported spearphishing attack.

In this hands-on challenge, you will practice researching network observables.

In this hands-on challenge, you will practice analyzing log events related to Windows authentication.

In this hands-on challenge, you practice profiling a suspicious process on a Windows system.

In this hands-on challenge, you will practice using SIEM search expressions to locate suspicious activity related to XRDP traffic.

CVE-2024-23897 is a critical security flaw affecting Jenkins, a Java-based open-source automation server widely used for application building, testing, and deployment. It allows unauthorized access to files through the Jenkins integrated command line interface (CLI), potentially leading to remote code execution (RCE).

In this hands-on challenge, you will practice using SIEM search expressions to locate suspicious activity related to XRDP traffic.

CVE-2023-27524 is a critical vulnerability in Apache Superset, affecting versions up to 2.0.1. It enables attackers to bypass authentication by exploiting weak or default SECRET_KEY values. Attackers can forge session cookies to gain admin access, leading to potential remote code execution and unauthorized data access.

‍

Confluence suffers from a Broken Access Control vulnerability that affects Data Center and Server versions 8.0.0 to 8.3.2, 8.4.0 to 8.4.2, and 8.5.0 to 8.5.1. Threat actors exploit this vulnerability to obtain administrator access to Confluence servers. Put on your Red Team hat to create your own malicious admin account leveraging this CVE!

Royal is a spin-off group of Conti, which first emerged in January of 2022. The group consists of veterans of the ransomware industry and brings more advanced capabilities and TTPs against their victims. Begin this campaign to learn how to detect and protect against this newer APT group!

Magic Hound (APT35) is an Iranian state-sponsored threat group that primarily targets organizations across various industries and geographic regions through cyber espionage. Launch this campaign to start detecting the sophisticated techniques leveraged by this threat group.

Raspberry Robin is a malware family that continues to be manipulated by several different threat groups for their purposes. These threat actors (Clop, LockBit, and Evil Corp) specialize in establishing persistence on a compromised host and creating remote connections to use later. Once established, these C2 connections can be used for multiple purposes, including data exfiltration, espionage, and even further exploitation.

Threat actors will use stolen data exfiltrated from victim systems to extort organizations. Once they gain a foothold, they delete critical system files and threaten to release the data or disrupt operations if the victims do not pay up. Understanding these techniques is vital to defending your organization from such attacks.

Threat actors continue to leverage ransomware to extort victim organizations. What was once a simple scheme to encrypt target data has expanded to include data disclosure and targeting a victim’s clients or suppliers. Understanding the techniques threat actors use in these attacks is vital to having an effective detection and mitigation strategy.