📝 Latest Writeups
- Blacksite DB C
- Axferia A
- Bastion B
- Postmark A
The XSS Rat Training Grounds
Own every lab. Master the methodology.
Training machines built by The XSS Rat — from basic enumeration to extreme multi-vector chains. Register once, unlock targets, submit flags, and track your progress on the leaderboard.
🥷 New Track — Dropping today
The OSEP Track is here
Where OSCP ends and the red team begins — advanced evasion and chaining for PEN-300. Restricted-shell breakouts, filter & defense evasion, lateral movement & pivoting, advanced Active Directory, and insecure deserialization. Three brand-new machines — Bastion, Nightfall, and Sidewinder — release in 4 hours. Free.
Explore the OSEP Track →
Getting a shell isn't enough here. Get it past the defences.
⚡ New Series — Launching 31 May 2026
Project Meridian
5 new OSCP-prep machines inside SolarGate Energy's network. SUID abuse, cron hijacking, sudo escapes, and Linux capabilities — a full Linux privesc series.
View Project Meridian →
💡 Community suggestion by tumtum
Dropping in
--days
:
--hrs
:
--min
:
--sec
🛡 Purple Team Series — Launching 20 Jun 2026
Help me, I got compromised
Five connected hosts. One breach. Log forensics, SOC triage, code review, and a host under constant attack that you must defend — with a 30-minute auto-reset.
Dropping in
--days
:
--hrs
:
--min
:
--sec
🔥 8 New Series — Launching 1 Sep 2026
40 new machines across 8 themed series
Operation Switchboard, Blacksite Webapp, Pipeline Breach, Exposed API, Cryptovault, Containment Failure, Memory Lane, and Social Engineering Sim — network protocols, web vulns, CI/CD, API attacks, crypto, container escapes, binary exploitation, and OSINT chains.
Dropping in
--days
:
--hrs
:
--min
:
--sec
Community Hub
📚 Latest writeups, reports & resources
🐞 Bug Bounty Reports
💡 Newest Hints & Labs
Top Players
View full leaderboard00x003
268387 points
thinkverse
231234 points
tumtum
169233 points
davidkarpinski1
158619 points
suraj_pun_magar
155538 points
Want to go further?
All courses. All certs. All lives. One price — forever.
These labs are built around the same methodology taught in The XSS Rat's courses. If you want the full picture — recon, exploit chains, API hacking, business logic, CNWPP certification and everything in between — the Endless Bundle has 45+ courses, 3 cert paths, weekly live sessions, and every future release included. No subscriptions. No upsells.
10+Courses
3xCertifications
ALLLive lessons
€300One-time, forever