🐀
⚠️ Last -29 days
Relay is a beginner-friendly pivot box: ten user accounts, ten flags, one flag per user. You are handed the first account — SSH in directly as relay01 with password R3lay_St4rt_01 (no exploit needed to land the first user), grab the flag, and find the clue each user leaves behind for the next. Walk the chain relay01 → relay02 → … → relay10. NOTE: there is NO root on this machine and no privilege-escalation path. The whole challenge is lateral movement between users — do not waste time hunting for root.
Retires calculating…
🐀🐀🐀
⚠️ Last -27 days
The employee portal was built by a contractor in 2019, accepted without a security review, and has been quietly running ever since. It handles timesheets, leave requests, and a few internal tools nobody fully remembers adding. The codebase has never been audited.
Retires calculating…
🐀🐀🐀🐀🐀
⚠️ Last -14 days
HexVault is a classified document management system used by a fictional intelligence contractor. It stores sensitive material, controls access carefully, and presents a surface that looks more hardened than it is. No single weakness hands you the keys — but every component has something it trusts a little too much.
Retires calculating…
🐀🐀
⚠️ Last -14 days
StackDrop was built in a sprint by a developer who no longer works there. It does one thing: accept files from the build pipeline and make them available to the team. The handoff notes say it was hardened before go-live. The new team assumed that meant it was done.
Retires calculating…
🐀🐀🐀🐀
⚠️ Last -13 days
The binary on this machine is old. Older than most of the team. It was compiled once, deployed, and forgotten — a relic of infrastructure debt that nobody wanted to touch. It still runs as root. It always has.
Retires calculating…
🐀
⚠️ Last -7 days
Codebleed runs the internal DevOps portal for a team that moves fast. The current deployment looks clean — polished, even. But software has a memory, and this server has been around long enough to have accumulated a history worth reading.
Retires calculating…
🐀🐀🐀🐀
⚠️ Last -7 days
Capsule is a data platform that was provisioned for a project, shipped on time, and handed to ops without a security checklist. The database is reachable. The data inside it is more useful than the team intended. And somewhere on this machine, a capability was granted that nobody thought to revoke.
Retires calculating…
🐀🐀🐀🐀
⚠️ Last -7 days
The ops team's internal GraphQL API was never meant to be externally accessible — but here we are. Introspection is enabled. Fields that should require authentication don't. And the JWT library has a configuration the developer clearly didn't read the RFC for.
Retires calculating…
🐀🐀
⚠️ Last -6 days
The SolarGate incident team flagged unusual activity on prod-web-01. A file-upload vulnerability gave an attacker a foothold as www-data, and the logs show things escalated from there. Your job: step into the analyst's seat, reconstruct what happened, and finish the job the attacker started.
Retires calculating…
🐀
🔴 Retiring
Axferia's nameserver has been running in the corner of the datacenter since before anyone on the team can remember. Nobody touches it. Nobody audits it. The sysadmin who set it up left years ago — and took the hardening checklist with him.
Retires calculating…
🐀
🔴 Retiring
Listeria started as a quick internal tool that was never meant to face the world. Then someone pointed a domain at it. A Friday afternoon deploy. No review. The developer responsible has since changed departments.
Retires calculating…
🐀🐀
🔴 Retiring
Every enterprise has a directory. Bindforge's directory holds the full map of who has access to what — accounts, groups, and a few fields that the original engineer populated a little too liberally. It was only ever meant to be accessed from inside the building.
Retires calculating…
🐀🐀
🔴 Retiring
The Rootbase server has been the backbone of three different applications over five years. Each team that inherited it assumed the previous one had secured it properly. None of them checked.
Retires calculating…
🐀🐀🐀🐀
🔴 Retiring
Keyspace was provisioned as a temporary caching layer during a product launch. The launch went well. The cleanup never happened. The server is still running, still reachable, and nobody on the current team knows its password — or whether it has one.
Retires calculating…
🐀🐀🐀
🔴 Retiring
Bifrost was set up to bridge two legacy teams who couldn't agree on a file-sharing standard. So they ran both. Twice the surface, half the oversight. Somewhere in the middle of all that data lives a path forward.
Retires calculating…
🐀🐀
🔴 Retiring
Neuravex is CorpTech's shiny new internal AI assistant. The engineers shipped it fast, the executives loved it, and nobody asked too many questions about how it was built. It knows a lot. It's happy to talk. The question is how to make it tell you the right things.
Retires calculating…
🐀🐀🐀
🔴 Retiring
Deep beneath the city streets runs the RatHole — a forgotten server maintained by a rodent with more enthusiasm than operational discipline. The setup is scrappy, the maintenance is creative, and root has been running things down here for longer than anyone cares to admit.
Retires calculating…
🐀🐀
🔴 Retiring
The NFS server was set up to make file access easy across the team. It succeeded. It made access very easy. The engineer who configured it trusted the network perimeter to do the hard work — a decision that made sense at the time.
Retires calculating…
🐀
🔴 Retiring
Porthaven was designed to be hard to find. The engineer who built it believed obscurity was a valid security layer and documented that belief in a config file he left on the server. The admin panel is hidden. The key to finding it is not.
Retires calculating…
🐀🐀
🔴 Retiring
Glasswork is the team's build server — the machine that turns code into deployments. Someone stood it up in an afternoon, got the pipelines working, and moved on. The pipelines still run. The hardening ticket never got prioritised.
Retires calculating…
🐀🐀
🔴 Retiring
Irongrep is the search backbone for a product that got acquired and then deprioritised. The engineering team moved on. The server did not. It still indexes, still serves queries, and still holds everything that was ever put into it.
Retires calculating…
🐀🐀
🔴 Retiring
Driftsync runs nightly, faithfully mirroring data from one machine to the next. The engineer who wrote the job configured it to be 'easy to use'. He was proud of how accessible he'd made it. That was two years ago.
Retires calculating…
🐀🐀
🔴 Retiring
Postmark handles internal mail for a small ops team. It was stood up fast, kept running through three infrastructure migrations, and never got the security hardening that was always on next quarter's roadmap.
Retires calculating…
🐀🐀
🔴 Retiring
Walkabout is the network monitoring node that nobody monitors. It has a view of every device on the segment — interface stats, process lists, everything the ops team ever thought to wire up. It reports faithfully to whoever asks.
Retires calculating…
🐀
🔴 Retiring
Retrogate is the last machine in the building still running the old remote access service from the early 2000s. It survived every migration plan because removing it was always someone else's problem. The sysadmin who set it up retired. His habits did not.
Retires calculating…
🐀
🔴 Retiring
Bootleak's network boot server was set up to provision diskless clients in a lab that no longer exists. The server outlived the lab. It still serves. It still responds. It has no idea it shouldn't.
Retires calculating…
🐀🐀🐀🐀🐀
🔴 Retiring
The XSS Rat's personal research lab: a tangled mess of a PHP blog, an undocumented internal service, and the kind of server that accumulates features faster than it accumulates security reviews. Every quirk is deliberate. Every clue is earned.
Retires calculating…
