Hands-on assessments, organized by the security problem—not a list of 52 machines.

01 / Web & APIs

Application attack paths

Labs centered on web-facing attack surfaces: input handling, file operations, CMS platforms, and modern API logic. The useful takeaway is not only how access was achieved, but which control would have disrupted the path.

02 / Windows & Active Directory

Identity, delegation, and endpoint controls

These labs focus on Windows trust boundaries: credential material, service permissions, Active Directory delegation, and the local rights that can turn a foothold into administrator access.

03 / Linux escalation

From foothold to root: permission design matters

A focused set of labs for understanding how local configuration decisions—sudo scope, SUID programs, writable scripts, and group membership—compound after initial access.

04 / Services & infrastructure

Discovery and attack-surface reasoning

These are intentionally presented as broad assessment studies: examine exposed services, form hypotheses from evidence, validate security assumptions, then record the defensive lesson.

Every full writeup includes an authorized-lab notice, a scenario, learning objectives, technical evidence, and a concise takeaway. They are proof of practice—not a claim that a single technique is universally applicable.