New here? Try our interactive tutorial and learn how everything works, step by step, on a real box.
Pick a difficulty from the BOXES tab -- EASY, MEDIUM, HARD, or HARD -- CHAINED (a two-machine scenario) -- and a fresh target generates on the spot. Its IP appears once loaded.
nmap -sV <ip> -- check every service before picking a targethydra for weak/default creds, or dirbuster to find a hidden endpoint leaking something to crack offline -- both need a wordlist, already sitting in ~/wordlists/ on ghost (type wordlists to see exact filenames/paths)hashcat -m 0 <hash file> <wordlist> cracks it -- works whether you run it on the target or copy the hash to your own machine first, just like real offline crackingsu <user> alone picks up the cracked password automatically -- no need to type itfind / -perm -4000 for SUID binaries, sudo -l for sudo misconfigcat -- progress shows on the FLAGS tabrm/shred /var/log/auth.log covers your tracks (bonus, never required)Separate from the mission boxes: every player (and a scattering of NPCs) has their own persistent server out in a shared address space. Other real players can find and attack yours, and you can find and attack theirs.
myserver checks your own machine -- services, versions, open ports, and anyone who's compromised you recentlypatch <service> fixes a vulnerable service; ufw allow|deny <port> opens or closes a port entirely -- nobody does this for you, and it starts with one real vulnerability already sitting on itnmap -sV <ip> a specific address, or sweep a whole range at once with nmap -sn <cidr>10.50.0.0/24, real players around 10.50.1.0/24 -- most addresses in either range are genuinely empty, so sweep and see what turns up rather than expecting every IP to answerpasswdhydra: the hostname (<username>-srv, visible via nmap) and the public LEADERBOARD/profile pages -- both point at the same real login, so a weak box password is a genuine, discoverable riskhydra guesses against the same target eventually start silently failing for a while, like a real fail2ban ban -- brute-forcing isn't free/profile?user=<name>help lists every command; help <command> shows details and an example/bin/bash as well as /bin/sh for the final privilege-escalation step. Fixed: Tutorials 2-4 could get stuck at their first flag, ssh could reuse a stale password from the previous box, and loading a different box in the middle of a tutorial left every step failing (it now offers a one-tap way back).dirbuster, a real searchsploit-found exploit, and two different sudo-misconfiguration privesc techniques. Click the small arrow next to TUTORIAL in the topbar to jump straight to any module.sudo -l, SUID binaries). Find it in the topbar any time you want a refresher.wordlists command -- run it on your own machine to see exactly where your wordlists are and what's in them. Also in your readme.txt and the welcome message now.Open World -- in the next month or so.
New to this? The guided tour walks you through a real box step by step. Every step has a button that runs the command for you (no typing needed), with a plain-English explanation of what it does -- recon, cracking a login, privilege escalation with GTFOBins. Skip it any time; you can find it later under TUTORIAL.
Make a shareable badge for this box. It's optional -- nothing is public unless you create it, and you can remove it any time.
VulnBox Pro ($4.99/mo) unlocks the next level:
Free forever: Easy boxes, the weekly challenge, and Story Chapter 1. Manage or cancel any time from the BOXES tab.
patch <service> or ufw deny <port> before time runs out