This is a vulnerable linux box for testing your web application exploitation skills and you will learn basics of binary exploitation.

Recently, Good Tech Inc. has decided to change their application development process. However, their applications look broken and too basic. Is this an application full of snakeoil, or are they insecure too? This goes beyond PEN-200, and some web application development expertise could be helpful.

If you MUST have hints for this machine: SNAKEOIL is (#1): a hint by itself, (#2): full of disallowed methods, (#3): a single file full of problems.

VPLE (Vulnerable Pentesting Lab Environment)

• username:- administrator
• password:- password

VPLE is an intentionally vulnerable Linux virtual machine. This VM can be used to conduct security training, test security tools, and practice common penetration testing Labs. In VPLE bunch of labs Available. (only run in VMWare Pls Don’t run in VirtualBox)

List Of All Labs:-

• Web-dvwa (eg.123.123.123.123:1335/)
• Mutillidae (eg.123.123.123.123:1336/)
• Webgoat (eg.123.123.123.123:1337/WebGoat/)
• Bwapp (eg.123.123.123.123:8080/install.php & 123.123.123.123:8080/install.php )
• Juice-shop (eg.123.123.123.123:3000/)
• Security-ninjas (eg.123.123.123.123:8899/)
• Wordpress (eg.123.123.123.123:8800/)

This is a vulnerable linux box focused on web application testing along with showing the importance of enumeration. There are three users you needs to compromise to read the root flag.

Difficulty: Easy-Medium

This Box is all about enumeration. Basic web app test and linux environment test. If you have basic knowledge about handling tools you will root it in a days

Happy Hacking :)

Difficulty: easy/medium

After the last breach, The Shuriken Company decided to move and rebuild its infrastructure. This time using different technology, and assuring us it's gonna be secure. Will it be so? It's up to you to prove otherwise.

My main focus is to not make the machines typical CTF like riddles but at least a bit more realistic. Remember it's a custom machine after all.

This machine was tested with VirtualBox.

See you in the root.

Hint: For the foothold, it's important to understand the technology behind the web app and how it handles user input.

Machine name: School

Level: Easy

flags: user, root

Description: This is a Linux box, running a Web Application, and a Windows application in WINE environment to give Access to Wine from Linux.

Author: foxlox

About VM: VirtualBox ready, the adapter is currently Bridged, DHCP active

You can contact me by email (fox at thebrain dot net) or Discord foxlox#1089

• Goal - Get "user.txt" and "root.txt". You can also aim to get a root shell after getting "root.txt"
• Difficulty - Medium

A fun VM created to test your skills around docker, OSINT, and web application exploitation. It is recommended to run this VM with a network interface connected to the internet, however, it is not necessary in any way to accomplish the final goal.

Easy level Linux box.

This box "dev" aims to educate people on common and misconfigurations of a widely used developer tool.

Use a good wordlist!

Feedback is appreciated - [email protected]

Send me your writeups, and let me know if you want it advertised on my website: www.cybergoat.co.uk

A VERY beginner friendly box with a LOT of hand holding.

Once the system grabs an IP, head straight to the web port before scanning.

You will find your first set of instructions which starts the guided process.

Created in Virtualbox.

Goal: Get the root flag.

Your feedback is appreciated -- Twitter: @iamv1nc3nt

Nully Cybersecurity - this is an easy-intermediate realistic machine.

While working with the machine, you will need to brute force, pivoting (using metasploit, via portfwd), exploitation web app, and using searchsploit.

About: Wait 5-8 minutes before starting for the machine to start its services. Also, check the welcome page on port 80.

Hints: 'cat rockyou.txt | grep bobby > wordlist' for generating wordlist.

Story: You are a Professional White Hat. Small company Nully Cybersecurity hired you to conduct a security test of their internal corporate systems.

Feedback. https://twitter.com/laf3r_

Difficulty: Easy-intermediate

• Machine Name: DMV 2
• Goal: Get the user and the root flag
• Difficulty: Medium/Intermediate Level
• Description: "This time I am going to complicate things for you, I have fixed all the bugs and now my website is 100% secure, I challenge you to hack it"

Your feedback is appreciated - Twitter: @over_jt