RatCTF
The XSS Rat Training Grounds
Training machines built by The XSS Rat — from basic enumeration to extreme multi-vector chains. Register once, unlock targets, submit flags, and track your progress on the leaderboard.
⚡ New Series — Launching 31 May 2026
5 new OSCP-prep machines inside SolarGate Energy's network. SUID abuse, cron hijacking, sudo escapes, and Linux capabilities — a full Linux privesc series.
Dropping in
🛡 Purple Team Series — Launching 20 Jun 2026
Five connected hosts. One breach. Log forensics, SOC triage, code review, and a host under constant attack that you must defend — with a 30-minute auto-reset.
Dropping in
🔥 8 New Series — Launching 1 Sep 2026
Operation Switchboard, Blacksite Webapp, Pipeline Breach, Exposed API, Cryptovault, Containment Failure, Memory Lane, and Social Engineering Sim — network protocols, web vulns, CI/CD, API attacks, crypto, container escapes, binary exploitation, and OSINT chains.
Dropping in
Coming Soon
Every HTTP response includes an X-Debug-Pass header containing the SSH password in plaintext. A single curl -I reveals the credential. Root via sudo python3.
In calculating...
robots.txt disallows /backup/config.bak. That file contains plaintext SSH credentials. Root via sudo ruby GTFObins.
In calculating...
A report.docx is available for download. EXIF/document metadata contains a description field with ssh_temp_pass:user123. cap_setuid python3 for root escalation.
In calculating...
Community Hub
239719 points
231234 points
169233 points
151812 points
149415 points
Want to go further?
These labs are built around the same methodology taught in The XSS Rat's courses. If you want the full picture — recon, exploit chains, API hacking, business logic, CNWPP certification and everything in between — the Endless Bundle has 45+ courses, 3 cert paths, weekly live sessions, and every future release included. No subscriptions. No upsells.