| Active | Kerberoasting · SMB (139/445) · Group Policy Preferences (GPP) | 4 |
| Arctic | Directory / Path Traversal · Cracking Hashes (hashcat / John) | 3 |
| Blue | EternalBlue (MS17-010) | 4 |
| Bounty | File Upload Vulnerabilities · Directory fuzzing · IIS (Microsoft Web Server) | 4 |
| Buff | Buffer Overflow (BoF / ROP) · Remote Code Execution (RCE) | 3 |
| Curling | Information Leakage · Remote Code Execution (RCE) | 3 |
| Devel | IIS (Microsoft Web Server) | 4 |
| Driver | Password Guessing SCF Malicious File Print Spooler Local Privilege Escalation… | 4 |
| Forest | Cracking Hashes (hashcat / John) · DNS zone transfer · BloodHound · DCSync | 4 |
| Grandpa | WebDAV · IIS (Microsoft Web Server) · Remote Code Execution (RCE) | 3 |
| Granny | WebDAV · IIS (Microsoft Web Server) · Remote Code Execution (RCE) | 3 |
| Heist | Information Leakage · SMB (139/445) | 3 |
| Jerry | Information Leakage | 3 |
| Legacy | EternalBlue (MS17-010) | 4 |
| Love | Server-Side Request Forgery | 3 |
| Netmon | Information Leakage · OS Command Injection · Remote Code Execution (RCE) | 3 |
| Optimum | HttpFileServer (CVE-2014-6287) · Remote Code Execution (RCE) | 4 |
| Remote | Remote Code Execution (RCE) · Information Leakage | 4 |
| Return | Abusing Printer Abusing Server Operators Group Service Configuration… | 4 |
| Sauna | Information Leakage · Cracking Hashes (hashcat / John) · BloodHound · GetNPUsers (Impacket) · AutoLogon credentials · winPEAS · DCSync | 3 |
| ServMon | Local File Inclusion (LFI) · Directory / Path Traversal · Port Forwarding / Pivoting | 3 |
| TimeLapse | Information Leakage · Port Forwarding / Pivoting · SMB (139/445) | 3 |
| Toolbox | SQL Injection · Port Forwarding / Pivoting · Remote Code Execution (RCE) | 3 |
