Hack the Box

Linux	Windows	Active Directory and Networks
Enigma	Markup	Active
Nibbles	Jerry	Forest
Solidstate	Netmon	Sauna
Poison	Servmon	Flight
Editor	Chatterbox	Return
Sunday	Jeeves	Blackfield
Keeper	Sniper	Cicada
Pilgrimage	Querier	TheFrizz (harder)
Cozyhosting	Giddy
Codify	Bounty	Assumed Breach Scenarios:
Tartarsauce	Artic	Administrator
Jarvis	Remote
Tabby	Buff
Connected	Love
Mentor	Secnotes	Priv Esc not in scope but good practice:
Devvortex	Access	Monteverde
Irked	Mailing	Escape
Popcorn	Heist	EscapeTwo (Assumed breach)
Bashed		Certified (Assumed breach)
Broker		Puppy (harder)
Silentium		Timelapse (harder)
Networked		Signed (Assumed breach)
UpDown
Swagshop		ProLabs:
Nineveh		Dante
Pandora		Zephyr (harder)
OpenAdmin
Precious		AWS (Not in the exam)
Busqueda		Epsilon
Monitored		Gobox
BoardLight		Bucket
Magic		Facts
Help
Editorial
Builder
Linkvortex
UnderPass
Dog
Cctv

Hack Smarter Labs


Linux	Windows	Active Directory and Networks
BankSmarter	Slayer	ShareThePain
Ascension	New Hire (OSCP-LK)	Sysco
Talisman	Printer Issue (OSCP-LK2)	StellarComms
Verbose (harder)	Induction (OSCP-LK2)	MartiniAD
Exception
Samurai		Assumed Breach Scenarios:
Dark		Building Magic
SysAdmins		PivotSmarter (small network)
Casino (harder)		Forensics (OSCP-LK AD set)
Wordplay (OSCP-LK)		Messenger (OSCP-LK2 AD set)
Haystack (OSCP-LK)
Aftermath		Ranges:
NOC (OSCP-LK2)		Odyssey (harder but good practice)
		BitStream (harder but good practice)
		CTOS (harder but good practice)

		Priv Esc not in scope but good practice:
		Orion Corp
		ShadowGate
		ShadowGate2 (harder)
		Welcome (Assumed breach)
		Arasaka (Assumed breach)
		Anomaly (harder / range)
		Lumon Industries (Assumed breach)
		404 bank (Harder)
		NovaCart (Harder)

		AWS (Not in the exam)
		Sns_secrets
		Static

Linux	Windows	Active Directory and Networks
ClamAV	Kevin	Access
Pelican	Internal	Nagoya
Payday	Algernon	Hokkaido
Snookums	Jacko	Vault
Pebbles	Craft
Nibbles	Squid	Treat it like a small network
Hetemit	Nickel	SkillForge (Linux)
ZenPhoto	MedJed	Tux (Linux)
Nukem	Billyboss
Cockpit	Shenzi	Priv Esc not in scope but good practice:
Clue	AuthBy	Hutch
Extplorer	Slort	Resourced
Postfish	Hepet
Hawat	DVR4
Walla	Mice	AWS (Not in the exam)
PC	Monster	Pathway
Apex	Fish	Bossline
Sorcerer
Sybaris
Peppo
Hunit
Readys
HAWordy
Bullybox
Marketing
Exfiltrated
Fanatastic
QuackerJack
Wombo
Flu
Roquefort
Levram
Mzeeav
LaVita
Xposedapi
Zipper
Workaholic
Fired
Scrutiny
SPX
Vmdak
Mantis
BitForge
WallpaperHub
Zab
SpiderSociety
Flink
DevArmor
Outdated
Passport
Filebrowser

Linux	Windows	Active Directory and Networks
Sync	Escape	Baby
Data	Job	Baby2
Build	Job2	Breach
Forgotten	Lock	Sweep
Bamboo		Sendai

		Chains:
		Trusted
		Reflection
		Hybrid
		Lustrous

		Assumed Breach Scenarios:
		Heron (Chain)

Assumed Breach Active Directory Chains
First Contact (Chain 1)	Priv Esc not in scope:
Stolen (Chain 2)	Trustfall (Chain 6)
BleedWide (Chain 3)	Ricochet (Chain 8)
Inside Job (Chain 4)	Bloodhunt (Chain 9)
GroupThink (Chain 5)	Delegate (Chain 12)
Crosslink (Chain 7)
Replicant (Chain 10)
Cold Storage (Chain 11)

Linux	Windows	Active Directory and Networks	Other recommended rooms
Mr Robot	Steel Mountain	Attacktive Directory	SQL Injection Lab
Thompson	Year of the Owl	Attacking Kerberos	Linux Privilege Escalation
Kenobi	Retro	Wreath Network	Windows Privilege Escalation
GameZone	Alfred	Reset	Git Happens
Skynet	Relevant	Vulnnet: Active	NahamStore
Daily bugle	Blueprint	Enterprise
Lazy admin	Hackpark	Ledger
Tomghost	Weasel		Recommended paths
Rootme	AllSignsPoint2Pwnage	Assumed Breach Scenarios:	Cyber Security 101
CMesS	Anthem	Corp	Jr Penetration Tester
Ultratech		Lateral Movement and Pivoting	Offensive Pentesting
Internal		Exploiting Active Directory
Zeno
Boiler CTF
Wonderland
Year of the Jellyfish