Every challenge on the rangeEvery challenge on the range

Scope, rules of engagement, legal and compliance documents, and professional conduct, worked through as scenarios.

• ENGAGE-01

  Read the Scope

  PT0-003 1.1 Scope, rules of engagement and target selection

  Difficulty 1 of 4: Beginner

  30 min, 200 pts

• ENGAGE-02

  Who Said You Could?

  PT0-003 1.1 Governance, risk and compliance: regulatory and contractual documents, legal restrictions (PT0-003 Domain 1)

  Difficulty 1 of 4: Beginner

  30 min, 200 pts

• ENGAGE-03

  Pick the Approach

  PT0-003 1.2 Assessment types, threat modeling and the shared responsibility model

  Difficulty 2 of 4: Intermediate

  35 min, 200 pts

• ENGAGE-04

  Do the Right Thing

  PT0-003 1.2 Professionalism and integrity: escalation, confidentiality, conflicts of interest, limiting invasiveness (PT0-003 Domain 1)

  Difficulty 2 of 4: Intermediate

  30 min, 200 pts

OSINT, DNS and service enumeration against planted, in-lab targets.

• EVADE-01

  Scanning Past the IDS

  nmap, nc or curl

  PT0-003 3.1 Vulnerability discovery (stealth scans); 2.4 Tools (Nmap)

  Difficulty 3 of 4: Advanced

  45 min, 200 pts

• NET-01

  SMB and SNMP Enumeration

  smbclient or enum4linux, snmpwalk or snmp-check

  PT0-003 2.2 Enumeration (protocol enumeration, share enumeration)

  Difficulty 2 of 4: Intermediate

  45 min, 150 pts

• RECON-01

  Passive OSINT — Apex Dynamics

  web search, whois/RDAP, theHarvester, Amass, Shodan (free tier)

  PT0-003 2.1 Information gathering (passive reconnaissance, OSINT)

  Difficulty 1 of 4: Beginner

  45 min, 100 pts

• RECON-02

  DNS Enumeration — apexdynamics.ctf

  dig, nslookup, host, dnsrecon, fierce

  PT0-003 2.1 Information gathering (DNS lookups); 2.2 Enumeration (DNS enumeration)

  Difficulty 1 of 4: Beginner

  45 min, 100 pts

• RECON-03

  Network and Service Discovery

  nmap, netcat, curl

  PT0-003 2.2 Enumeration (service discovery, host discovery); 2.4 Tools (Nmap)

  Difficulty 2 of 4: Intermediate

  60 min, 150 pts

• RECON-04

  Packet Analysis

  Wireshark, tshark

  PT0-003 2.1 Information gathering (network sniffing); 2.4 Tools (Wireshark/tcpdump)

  Difficulty 2 of 4: Intermediate

  45 min, 125 pts

• RECON-05

  Script Modification — Recon Automation

  Python 3, Bash, PowerShell

  PT0-003 2.3 Modify scripts for reconnaissance and enumeration

  Difficulty 3 of 4: Advanced

  75 min, 175 pts

Scanning, triage, and spotting exploitable misconfigurations and CVEs.

• VULN-01

  Unauthenticated Vulnerability Scanning

  Nikto, nmap NSE, OpenVAS/Greenbone (optional)

  PT0-003 3.1 Vulnerability discovery (network scans, unauthenticated scans); 3.2 Analyze scan output

  Difficulty 2 of 4: Intermediate

  60 min, 150 pts

• VULN-02

  Authenticated Vulnerability Scanning

  curl, nmap NSE, OpenVAS/Greenbone (optional, with credentials configured)

  PT0-003 3.1 Vulnerability discovery (authenticated vs. unauthenticated scans); 3.2 Analyze scan output

  Difficulty 2 of 4: Intermediate

  60 min, 175 pts

• VULN-03

  Web Vulnerability Discovery

  Nikto, Burp Suite, nmap NSE, curl

  PT0-003 3.1 Vulnerability discovery (application scans, DAST, Nikto); 3.2 Analyze scan output; 4.5 Web application attacks (discovery phase)

  Difficulty 2 of 4: Intermediate

  60 min, 150 pts

• VULN-04

  Static Application Security Testing (SAST)

  bandit (Python SAST), manual code review

  PT0-003 3.1 Vulnerability discovery (SAST, source code analysis); 3.2 Analyze scan output

  Difficulty 3 of 4: Advanced

  60 min, 200 pts

• VULN-05

  Finding Validation

  manual analysis, the target hosts from earlier challenges to cross-check evidence

  PT0-003 3.2 Analyze output (false positives, validating results); 4.1 Prioritize attacks (CVSS, CVE, EPSS)

  Difficulty 3 of 4: Advanced

  60 min, 200 pts

Web, network, Active Directory, container and cloud-misconfiguration exploitation.

• AI-01

  Prompt Injection

  curl, browser dev tools

  PT0-003 4.9 Specialized systems (AI attacks, prompt injection)

  Difficulty 2 of 4: Intermediate

  60 min, 200 pts

• AI-02

  Model Manipulation

  curl, browser dev tools

  PT0-003 4.9 Specialized systems (AI attacks, model manipulation)

  Difficulty 3 of 4: Advanced

  60 min, 250 pts

• ATTACK-01

  VLAN / Network Segmentation Attack

  nmap, python3/scapy (already on Kali), tcpdump

  PT0-003 4.2 Network attacks (VLAN hopping, multihomed hosts)

  Difficulty 3 of 4: Advanced

  75 min, 250 pts

• ATTACK-02

  On-Path (MITM) Attack

  arpspoof (dsniff), tcpdump, Wireshark

  PT0-003 4.2 Network attacks (on-path attack)

  Difficulty 3 of 4: Advanced

  75 min, 250 pts

• ATTACK-03

  Authentication Attacks

  curl, Hydra or a custom script, seclists wordlists

  PT0-003 4.3 Authentication attacks (dictionary, brute-force, password spraying)

  Difficulty 2 of 4: Intermediate

  60 min, 200 pts

• ATTACK-04

  Pass-the-Hash

  impacket (smbclient.py), CrackMapExec/NetExec, smbclient

  PT0-003 4.3 Authentication attacks (pass-the-hash); 4.2 Network attacks (relay attack); 5.2 Lateral movement

  * Needs the optional Active Directory lab

  Difficulty 4 of 4: Expert

  90 min, 300 pts

• ATTACK-05

  Host Privilege Escalation

  ssh, sudo -l, find (SUID enumeration), GTFOBins reference

  PT0-003 4.4 Host-based attacks (privilege escalation, Linux)

  Difficulty 3 of 4: Advanced

  75 min, 250 pts

• ATTACK-06

  Credential Dumping and Process Injection (Concepts)

  PowerShell, icacls, sc.exe

  PT0-003 4.4 Host-based attacks (privilege escalation, credential dumping, process injection)

  * Needs the optional Windows targets

  Difficulty 4 of 4: Expert

  75 min, 300 pts

• ATTACK-07

  Web Application Exploitation

  Burp Suite, curl, browser dev tools

  PT0-003 4.5 Web application attacks (SQL injection, XSS, directory traversal, command injection)

  Difficulty 3 of 4: Advanced

  120 min, 400 pts

• ATTACK-08

  Blind SQL Injection with sqlmap

  sqlmap

  PT0-003 4.5 Web application attacks (SQL injection, sqlmap)

  Difficulty 3 of 4: Advanced

  60 min, 200 pts

• ATTACK-09

  Session Token Prediction

  curl or Burp Suite

  PT0-003 4.5 Web application attacks (session hijacking)

  Difficulty 2 of 4: Intermediate

  45 min, 150 pts

• CLOUD-01

  Cloud Metadata Service (SSRF)

  curl, Burp Suite

  PT0-003 4.6 Cloud-based attacks (metadata service attacks); 4.5 Web application attacks (SSRF)

  Difficulty 3 of 4: Advanced

  60 min, 250 pts

• CLOUD-02

  IAM Misconfiguration

  AWS CLI (pre-installed on Kali)

  PT0-003 4.6 Cloud-based attacks (IAM misconfigurations)

  Difficulty 4 of 4: Expert

  75 min, 300 pts

• CLOUD-03

  Container Escape

  ssh, docker CLI (inside the container)

  PT0-003 4.6 Cloud-based attacks (container escape, workload runtime attacks)

  Difficulty 4 of 4: Expert

  90 min, 300 pts

• CRYPTO-01

  Hashes, Encodings and Certificates

  hashid or name-that-hash, openssl, base64, xxd or CyberChef, john or hashcat (optional)

  PT0-003 4.3 Authentication attacks (password cracking, hashcat, John the Ripper); 4.1 Prioritize attacks (vulnerable encryption methods)

  Difficulty 2 of 4: Intermediate

  60 min, 200 pts

• CRYPTO-02

  Cracking Password Hashes

  hashcat or john, hashid or name-that-hash, rockyou.txt

  PT0-003 4.3 Authentication attacks (dictionary attacks, hashcat, John the Ripper); 4.1 Prioritize attacks (vulnerable encryption methods)

  Difficulty 2 of 4: Intermediate

  60 min, 200 pts

• MOB-01

  Static APK Analysis: Finding a Hardcoded API Key

  jadx

  PT0-003 4.9 Specialized systems (mobile attacks: information disclosure, MobSF, Frida)

  Difficulty 1 of 4: Beginner

  30 min, 100 pts

• SE-01

  Phishing Analysis

  a text editor or `less`, your browser's view-source, careful reading

  PT0-003 4.8 Social engineering attacks (phishing)

  Difficulty 1 of 4: Beginner

  45 min, 150 pts

• WEB-01

  Banner Grabbing and Server Misconfiguration

  curl

  PT0-003 2.1 Information gathering (banner grabbing, information disclosure)

  Difficulty 1 of 4: Beginner

  30 min, 100 pts

• WIFI-01

  Cracking a WPA2 Handshake

  hashcat

  PT0-003 4.7 Wireless attacks (WPA cracking, Aircrack-ng)

  Difficulty 2 of 4: Intermediate

  45 min, 150 pts

Privilege escalation, pivoting, and moving between compromised hosts.

• POST-01

  Initial Post-Exploitation Enumeration

  standard Linux enumeration commands (id, ps, netstat/ss, find)

  PT0-003 5.2 Lateral movement (enumeration after access)

  Difficulty 2 of 4: Intermediate

  45 min, 150 pts

• POST-02

  Persistence

  crontab, systemctl, find

  PT0-003 5.1 Persistence

  Difficulty 3 of 4: Advanced

  60 min, 200 pts

• POST-03

  Lateral Movement

  ssh

  PT0-003 5.2 Lateral movement (pivoting); 4.3 Authentication attacks (credential reuse)

  Difficulty 3 of 4: Advanced

  60 min, 250 pts

• POST-04

  Artifact Cleanup

  standard shell commands

  PT0-003 5.4 Cleanup and restoration

  Difficulty 2 of 4: Intermediate

  30 min, 150 pts

• POST-05

  Attack Narrative and Remediation

  a text editor, your notes from every prior challenge

  PT0-003 1.4 Components of a penetration test report; 1.5 Findings and remediation; 5.1-5.4 Post-exploitation synthesis

  Difficulty 3 of 4: Advanced

  90 min, 300 pts

• SYS-01

  Steganography: Hidden in Plain Sound

  Python 3 (stdlib only), a hex editor or xxd (optional)

  PT0-003 5.3 Staging and exfiltration (steganography, alternate data streams)

  Difficulty 2 of 4: Intermediate

  45 min, 150 pts