Information Leakage

Cross-platform resources for Information Leakage: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice Information Leakage: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 80 challenges across 2 platforms — 74 HackTheBox · 6 PortSwigger. 74 with a Spanish writeup, 74 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Authentication bypass via information disclosure (Apprentice) · 🇬🇧
2. PortSwigger — Information disclosure in error messages (Apprentice) · 🇬🇧
3. PortSwigger — Information disclosure on debug page (Apprentice) · 🇬🇧
4. PortSwigger — Source code disclosure via backup files (Apprentice) · 🇬🇧
5. HackTheBox — Admirer (Fácil) · 🇪🇸 🇬🇧 📹
6. HackTheBox — Bank (Fácil) · 🇪🇸 🇬🇧 📹

Curated resources

Source	Link
HackTricks	https://book.hacktricks.wiki/en/pentesting-web/information-leak.html

HTB machines practicing Information Leakage (74)

Machine	OS	Difficulty	Writeup
Acute	Windows	HARD	🇪🇸 🇬🇧 📹
Admirer	Linux	EASY	🇪🇸 🇬🇧 📹
Anubis	Windows	INSANE	🇪🇸 🇬🇧 📹
Apocalyst	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Backend	Linux	MEDIUM	🇪🇸 🇬🇧 📹
BackendTwo	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Bank	Linux	EASY	🇪🇸 🇬🇧 📹
Bart	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Beep	Linux	EASY	🇪🇸 🇬🇧 📹
Blocky	Linux	EASY	🇪🇸 🇬🇧 📹
Bolt	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Brainfuck	Linux	INSANE	🇪🇸 🇬🇧 📹
Cache	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Catch	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Curling	Windows	EASY	🇪🇸 🇬🇧 📹
Delivery	Linux	EASY	🇪🇸 🇬🇧 📹
DevOops	Linux	MEDIUM	🇪🇸 🇬🇧 📹
EarlyAccess	Linux	HARD	🇪🇸 🇬🇧 📹
Falafel	Linux	HARD	🇪🇸 🇬🇧 📹
Feline	Linux	HARD	🇪🇸 🇬🇧 📹
Flustered	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Frolic	Linux	EASY	🇪🇸 🇬🇧 📹
Fulcrum	Linux	INSANE	🇪🇸 🇬🇧 📹
Hackback	Windows	INSANE	🇪🇸 🇬🇧 📹
Haystack	Linux	EASY	🇪🇸 🇬🇧 📹
Heist	Windows	EASY	🇪🇸 🇬🇧 📹
Horizontall	Linux	EASY	🇪🇸 🇬🇧 📹
Intelligence	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Jerry	Windows	EASY	🇪🇸 🇬🇧 📹
Jewel	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Kotarak	Linux	HARD	🇪🇸 🇬🇧 📹
Laboratory	Linux	EASY	🇪🇸 🇬🇧 📹
Luke	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Mischief	Linux	HARD	🇪🇸 🇬🇧 📹
Monitors	Linux	HARD	🇪🇸 🇬🇧 📹
MultiMaster	Windows	INSANE	🇪🇸 🇬🇧 📹
Netmon	Windows	EASY	🇪🇸 🇬🇧 📹
Node	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Noter	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Obscurity	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Oouch	Linux	HARD	🇪🇸 🇬🇧 📹
OpenSource	Linux	EASY	🇪🇸 🇬🇧 📹
OverGraph	Linux	HARD	🇪🇸 🇬🇧 📹
Pandora	Linux	EASY	🇪🇸 🇬🇧 📹
Paper	Linux	EASY	🇪🇸 🇬🇧 📹
Pit	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Player	Linux	HARD	🇪🇸 🇬🇧 📹
Quick	Linux	HARD	🇪🇸 🇬🇧 📹
Reel	Windows	HARD	🇪🇸 🇬🇧 📹
Reel2	Windows	HARD	🇪🇸 🇬🇧 📹
Remote	Windows	EASY	🇪🇸 🇬🇧 📹
Resolute	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Safe	Linux	EASY	🇪🇸 🇬🇧 📹
Sauna	Windows	EASY	🇪🇸 🇬🇧 📹
Scrambled	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Seal	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Search	Windows	HARD	🇪🇸 🇬🇧 📹
SecNotes	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Sense	Linux	EASY	🇪🇸 🇬🇧 📹
Shrek	Linux	HARD	🇪🇸 🇬🇧 📹
Sink	Linux	INSANE	🇪🇸 🇬🇧 📹
SneakyMailer	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Sniper	Windows	MEDIUM	🇪🇸 🇬🇧 📹
SolidState	Linux	MEDIUM	🇪🇸 🇬🇧 📹
StreamIO	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Talkative	Linux	HARD	🇪🇸 🇬🇧 📹
Tally	Windows	HARD	🇪🇸 🇬🇧 📹
Teacher	Linux	EASY	🇪🇸 🇬🇧 📹
TimeLapse	Windows	EASY	🇪🇸 🇬🇧 📹
Unbalanced	Linux	HARD	🇪🇸 🇬🇧 📹
Unobtainium	Linux	HARD	🇪🇸 🇬🇧 📹
Validation	Linux	EASY	🇪🇸 🇬🇧 📹
Worker	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Zetta	Linux	HARD	🇪🇸 🇬🇧 📹

PortSwigger labs practicing Information Leakage (6)

Lab	Difficulty	Topic	Official
Authentication bypass via information disclosure	APPRENTICE	Information Disclosure	Open
Information disclosure in error messages	APPRENTICE	Information Disclosure	Open
Information disclosure on debug page	APPRENTICE	Information Disclosure	Open
Source code disclosure via backup files	APPRENTICE	Information Disclosure	Open
Information disclosure in version control history	PRACTITIONER	Information Disclosure	Open
Server-side template injection with information disclosure via user-supplied objects	PRACTITIONER	Server-Side Template Injection (SSTI)	Open

---

← Back to the full glossary

Last updated: 2026-08-24