// LABS

Practise offensive and defensive skills

Core labs run in your browser, Box labs in a container of your own. Free, with a leaderboard.

94Labs

1Player

1Solves today

Start with an intro challenge Leaderboard

Practise offensive and defensive skills

All labs94 labs

Falaj 0: Welcome Aboard

Falaj 1: Where Am I?

Falaj 2: Dotfiles

Falaj 3: The Long Name

Awareness: handling a reported attachment

Awareness: passwords and sign-in prompts

Awareness: spot the phish

Caesar Decoder

Hash It Out

Hex and Binary Decoder

Fix the Page Build: Credential in an HTML Comment

Fix the Image Upload: Identifying Metadata

Password and Lockout Policy

Fix the Export Folder: robots.txt Is Not Access Control

What Is This File?

XSS Playground: No Filter

Falaj 10: Two Encodings

Falaj 11: Mirror Writing

Falaj 4: Nested Rota

Falaj 5: Needle Directory

Falaj 6: Read the Bits

Falaj 7: Only Once

Falaj 8: Loud Lines

Falaj 9: Column Nine

The Encoding Onion

Harden a Live Web and SSH Box

Hash Identifier: Name the Family

Headers On

Fix the Profile API: Missing Ownership Check

JWT Decoder: Read the Claims

Lock the Door (SSH)

Log Grep: Name the Attacker

Password Cracker: Wordlist Attack

Fix the Report Download: Path Traversal

Peel the Config

Phishing Detective

Phishing Detector: Sort the Mailbox

Private by Default

Read the Sandbox Report

SOC triage: a reported phishing email

SOC triage: the overnight SSH alert

Fix the Login Lookup: SQL Injection

Strings Attached

Fix the DNS Zone: Exposed Internal Host

Windows Account Policy Concepts

XSS Playground: Basic Filter

Archive catalogue: the all-powerful service token

Ledger desk: the unguarded admin route

Station dashboard: the listener on every interface

Falaj 12: What Changed?

All labs94 labs

Falaj 0: Welcome Aboard

Falaj 1: Where Am I?

Falaj 2: Dotfiles

Falaj 3: The Long Name

Awareness: handling a reported attachment

Awareness: passwords and sign-in prompts

Awareness: spot the phish

Caesar Decoder

Hash It Out

Hex and Binary Decoder

Fix the Page Build: Credential in an HTML Comment

Fix the Image Upload: Identifying Metadata

Password and Lockout Policy

Fix the Export Folder: robots.txt Is Not Access Control

What Is This File?

XSS Playground: No Filter

Falaj 10: Two Encodings

Falaj 11: Mirror Writing

Falaj 4: Nested Rota

Falaj 5: Needle Directory

Falaj 6: Read the Bits

Falaj 7: Only Once

Falaj 8: Loud Lines

Falaj 9: Column Nine

The Encoding Onion

Harden a Live Web and SSH Box

Hash Identifier: Name the Family