| Date | Machine | Operating system | Difficulty | Skills |
|---|---|---|---|---|
| 2022-10-08 | OpenSource | Linux | EASY | Local File Inclusion (LFI) · Information Leakage · Port Forwarding / Pivoting · File Upload Vulnerabilities · Remote Code Execution (RCE) |
| 2022-10-01 | Scrambled | Windows | MEDIUM | Information Leakage · Cracking Hashes (hashcat / John) · Insecure Deserialization · Kerberoasting · GetNPUsers (Impacket) · SMB (139/445) · Remote Code Execution (RCE) |
| 2022-09-28 | Noter | Linux | MEDIUM | SSTI (Server-Side Template Injection) · Information Leakage · OS Command Injection · Directory fuzzing · Remote Code Execution (RCE) · JSON Web Tokens (JWT) |
| 2022-09-17 | StreamIO | Windows | MEDIUM | Remote File Inclusion (RFI) · Local File Inclusion (LFI) · Information Leakage · Cracking Hashes (hashcat / John) · SQL Injection · BloodHound · AS-REP Roasting · SMB (139/445) · Remote Code Execution (RCE) |
| 2022-08-27 | Talkative | Linux | HARD | Information Leakage · Port Forwarding / Pivoting · Remote Code Execution (RCE) · File Upload Vulnerabilities |
| 2022-08-20 | TimeLapse | Windows | EASY | Information Leakage · Port Forwarding / Pivoting · SMB (139/445) |
| 2022-08-13 | Retired | Linux | MEDIUM | Local File Inclusion (LFI) · Buffer Overflow (BoF / ROP) · Port Forwarding / Pivoting |
| 2022-08-06 | OverGraph | Linux | HARD | Subdomain Enumeration · Cross-Site Scripting (XSS) · Information Leakage · SQL Injection · File Upload Vulnerabilities · Directory fuzzing · GraphQL Vulnerabilities · Server-Side Request Forgery · SUID binaries · Remote Code Execution (RCE) · JSON Web Tokens (JWT) |
| 2022-07-30 | Late | Linux | EASY | SSTI (Server-Side Template Injection) · Subdomain Enumeration · File Upload Vulnerabilities |
| 2022-07-23 | Catch | Linux | MEDIUM | SSTI (Server-Side Template Injection) · Information Leakage · SQL Injection · Remote Code Execution (RCE) |
| 2022-07-16 | Acute | Windows | HARD | Information Leakage · Cracking Hashes (hashcat / John) · Port Forwarding / Pivoting |
| 2022-07-09 | RouterSpace | Linux | EASY | OS Command Injection · linPEAS · Remote Code Execution (RCE) |
| 2022-07-02 | Undetected | Linux | MEDIUM | Subdomain Enumeration · Cracking Hashes (hashcat / John) · Remote Code Execution (RCE) |
| 2022-06-25 | Phoenix | Linux | HARD | Cracking Hashes (hashcat / John) · SQL Injection · File Upload Vulnerabilities · WordPress Exploitation |
| 2022-06-18 | Paper | Linux | EASY | Information Leakage · WordPress Exploitation |
| 2022-06-11 | Meta | Linux | MEDIUM | Subdomain Enumeration · File Upload Vulnerabilities · Port Forwarding / Pivoting · Remote Code Execution (RCE) |
| 2022-06-04 | Timing | Linux | MEDIUM | Local File Inclusion (LFI) · File Upload Vulnerabilities |
| 2022-05-28 | AdmirerToo | Linux | HARD | Remote Code Execution (RCE) · Subdomain Enumeration · Server-Side Request Forgery |
| 2022-05-23 | Jail | Linux | INSANE | Buffer Overflow (BoF / ROP) |
| 2022-05-21 | Pandora | Linux | EASY | Remote Code Execution (RCE) · Information Leakage · Port Forwarding / Pivoting · SQL Injection · SNMP Enumeration |
HackTheBox catalog
Recently retired
The 20 most recent machines by retirement date. Updated on every catalog regeneration.
The 20 most recent machines by retirement date. Updated on every catalog regeneration.
Last updated: 2026-06-07