Remote Code Execution (RCE)

Cross-platform resources for Remote Code Execution (RCE): curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice Remote Code Execution (RCE): retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 222 challenges across 3 platforms — 104 HackTheBox · 15 PortSwigger · 103 TryHackMe. 104 with a Spanish writeup, 106 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — 2FA bypass using a brute-force attack (Apprentice) · 🇬🇧
2. PortSwigger — Broken brute-force protection, multiple credentials per request (Apprentice) · 🇬🇧
3. PortSwigger — DOM XSS in document.write sink using source location.search (Apprentice) · 🇬🇧
4. PortSwigger — DOM XSS in innerHTML sink using source location.search (Apprentice) · 🇬🇧
5. PortSwigger — DOM XSS in jQuery anchor href attribute sink using location.search source (Apprentice) · 🇬🇧 📹
6. PortSwigger — Flawed enforcement of business rules (Apprentice) · 🇬🇧

Curated resources

Source	Link
HackTricks	https://book.hacktricks.wiki/en/pentesting-web/command-injection.html

HTB machines practicing Remote Code Execution (RCE) (104)

Machine	OS	Difficulty	Writeup
AdmirerToo	Linux	HARD	🇪🇸 🇬🇧 📹
Altered	Linux	HARD	🇪🇸 🇬🇧 📹
Anubis	Windows	INSANE	🇪🇸 🇬🇧 📹
Apocalyst	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Atom	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Backdoor	Linux	EASY	🇪🇸 🇬🇧 📹
Backend	Linux	MEDIUM	🇪🇸 🇬🇧 📹
BackendTwo	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Bank	Linux	EASY	🇪🇸 🇬🇧 📹
Bankrobber	Windows	INSANE	🇪🇸 🇬🇧 📹
Bart	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Bastard	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Beep	Linux	EASY	🇪🇸 🇬🇧 📹
Blackfield	Windows	HARD	🇪🇸 🇬🇧 📹
Buff	Windows	EASY	🇪🇸 🇬🇧 📹
Cache	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Catch	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Celestial	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Chaos	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Conceal	Windows	HARD	🇪🇸 🇬🇧 📹
Control	Windows	HARD	🇪🇸 🇬🇧 📹
CrimeStoppers	Linux	HARD	🇪🇸 🇬🇧 📹
CrossFit	Linux	INSANE	🇪🇸 🇬🇧 📹
CTF	Linux	INSANE	🇪🇸 🇬🇧 📹
Curling	Windows	EASY	🇪🇸 🇬🇧 📹
Dab	Linux	HARD	🇪🇸 🇬🇧 📹
Devzat	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Doctor	Linux	EASY	🇪🇸 🇬🇧 📹
Ellingson	Linux	HARD	🇪🇸 🇬🇧 📹
Epsilon	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Europa	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Feline	Linux	HARD	🇪🇸 🇬🇧 📹
Fighter	Windows	INSANE	🇪🇸 🇬🇧 📹
Flujab	Linux	HARD	🇪🇸 🇬🇧 📹
Flustered	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Frolic	Linux	EASY	🇪🇸 🇬🇧 📹
Fulcrum	Linux	INSANE	🇪🇸 🇬🇧 📹
Grandpa	Windows	EASY	🇪🇸 🇬🇧 📹
Granny	Windows	EASY	🇪🇸 🇬🇧 📹
Hackback	Windows	INSANE	🇪🇸 🇬🇧 📹
Hancliffe	Windows	HARD	🇪🇸 🇬🇧 📹
Hawk	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Helpline	Windows	HARD	🇪🇸 🇬🇧 📹
Holiday	Linux	HARD	🇪🇸 🇬🇧 📹
Intelligence	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Jewel	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Joker	Linux	HARD	🇪🇸 🇬🇧 📹
Json	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Knife	Linux	EASY	🇪🇸 🇬🇧 📹
Laboratory	Linux	EASY	🇪🇸 🇬🇧 📹
Meta	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Monitors	Linux	HARD	🇪🇸 🇬🇧 📹
Monteverde	Windows	MEDIUM	🇪🇸 🇬🇧 📹
MultiMaster	Windows	INSANE	🇪🇸 🇬🇧 📹
Netmon	Windows	EASY	🇪🇸 🇬🇧 📹
Nibbles	Linux	EASY	🇪🇸 🇬🇧 📹
Nightmare	Linux	INSANE	🇪🇸 🇬🇧 📹
Nineveh	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Noter	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Object	Windows	HARD	🇪🇸 🇬🇧 📹
Obscurity	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Oouch	Linux	HARD	🇪🇸 🇬🇧 📹
OpenSource	Linux	EASY	🇪🇸 🇬🇧 📹
Optimum	Windows	EASY	🇪🇸 🇬🇧 📹
Overflow	Linux	HARD	🇪🇸 🇬🇧 📹
OverGraph	Linux	HARD	🇪🇸 🇬🇧 📹
Oz	Linux	HARD	🇪🇸 🇬🇧 📹
Pandora	Linux	EASY	🇪🇸 🇬🇧 📹
Pit	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Player	Linux	HARD	🇪🇸 🇬🇧 📹
Poison	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Quick	Linux	HARD	🇪🇸 🇬🇧 📹
RE	Windows	HARD	🇪🇸 🇬🇧 📹
RedCross	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Reel	Windows	HARD	🇪🇸 🇬🇧 📹
Reel2	Windows	HARD	🇪🇸 🇬🇧 📹
Remote	Windows	EASY	🇪🇸 🇬🇧 📹
RouterSpace	Linux	EASY	🇪🇸 🇬🇧 📹
Schooled	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Scrambled	Windows	MEDIUM	🇪🇸 🇬🇧 📹
ScriptKiddie	Linux	EASY	🇪🇸 🇬🇧 📹
Seal	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Sense	Linux	EASY	🇪🇸 🇬🇧 📹
Shibboleth	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Sniper	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Stacked	Linux	INSANE	🇪🇸 🇬🇧 📹
Static	Linux	HARD	🇪🇸 🇬🇧 📹
StreamIO	Windows	MEDIUM	🇪🇸 🇬🇧 📹
SwagShop	Linux	EASY	🇪🇸 🇬🇧 📹
Talkative	Linux	HARD	🇪🇸 🇬🇧 📹
Tally	Windows	HARD	🇪🇸 🇬🇧 📹
TartarSauce	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Teacher	Linux	EASY	🇪🇸 🇬🇧 📹
Time	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Toolbox	Windows	EASY	🇪🇸 🇬🇧 📹
Travel	Linux	HARD	🇪🇸 🇬🇧 📹
Unbalanced	Linux	HARD	🇪🇸 🇬🇧 📹
Undetected	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Union	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Unobtainium	Linux	HARD	🇪🇸 🇬🇧 📹
Validation	Linux	EASY	🇪🇸 🇬🇧 📹
Wall	Linux	MEDIUM	🇪🇸 🇬🇧 📹
Worker	Windows	MEDIUM	🇪🇸 🇬🇧 📹
Zetta	Linux	HARD	🇪🇸 🇬🇧 📹

PortSwigger labs practicing Remote Code Execution (RCE) (15)

Lab	Difficulty	Topic	Official
2FA bypass using a brute-force attack	APPRENTICE	Authentication Vulnerabilities	Open
Broken brute-force protection, multiple credentials per request	APPRENTICE	Authentication Vulnerabilities	Open
DOM XSS in document.write sink using source location.search	APPRENTICE	Cross-Site Scripting (XSS)	Open
DOM XSS in innerHTML sink using source location.search	APPRENTICE	Cross-Site Scripting (XSS)	Open
DOM XSS in jQuery anchor href attribute sink using location.search source	APPRENTICE	Cross-Site Scripting (XSS)	Open
Flawed enforcement of business rules	APPRENTICE	Business Logic Vulnerabilities	Open
Remote code execution via web shell upload	APPRENTICE	File Upload Vulnerabilities	Open
Source code disclosure via backup files	APPRENTICE	Information Disclosure	Open
Broken brute-force protection, IP block	PRACTITIONER	Authentication Vulnerabilities	Open
Bypassing GraphQL brute force protections	PRACTITIONER	GraphQL	Open
DOM XSS in document.write sink using source location.search inside a select element	PRACTITIONER	Cross-Site Scripting (XSS)	Open
Forced OAuth profile linking	PRACTITIONER	OAuth Authentication	Open
Password brute-force via password change	PRACTITIONER	Authentication Vulnerabilities	Open
Remote code execution via polyglot web shell upload	PRACTITIONER	File Upload Vulnerabilities	Open
Remote code execution via server-side prototype pollution	PRACTITIONER	Prototype Pollution	Open

TryHackMe rooms practicing Remote Code Execution (RCE) (103)

Room	Difficulty	Type	Access	Official
History of Malware	INFO	Walkthrough	🟢 Free	Open
OverlayFS - CVE-2021-3493	INFO	Walkthrough	🟢 Free	Open
25 Days of Cyber Security	EASY	Walkthrough	🟢 Free	Open
Advent of Cyber 1 [2019]	EASY	Walkthrough	🟢 Free	Open
Advent of Cyber 2 [2020]	EASY	Walkthrough	🟢 Free	Open
Advent of Cyber 2022	EASY	Walkthrough	🟢 Free	Open
Advent of Cyber 2023	EASY	Walkthrough	🟢 Free	Open
Advent of Cyber 2024	EASY	Walkthrough	🟢 Free	Open
Advent of Cyber 3 (2021)	EASY	Walkthrough	🟢 Free	Open
Anonforce	EASY	Challenge	🟢 Free	Open
Atlassian CVE-2022-26134	EASY	Walkthrough	🟢 Free	Open
AWS Basic Concepts	EASY	Walkthrough	🟢 Free	Open
Badbyte	EASY	Walkthrough	🟢 Free	Open
Basic Pentesting	EASY	Challenge	🟢 Free	Open
Bolt	EASY	Walkthrough	🟢 Free	Open
Broken Access Control	EASY	Walkthrough	🟢 Free	Open
Cloud Security Pitfalls	EASY	Walkthrough	🟢 Free	Open
Common Attacks	EASY	Walkthrough	🟢 Free	Open
Cyborg	EASY	Challenge	🟢 Free	Open
Enumeration & Brute Force	EASY	Walkthrough	🟢 Free	Open
Exploit Vulnerabilities	EASY	Walkthrough	🔵 VIP	Open
Fowsniff CTF	EASY	Challenge	🟢 Free	Open
Google Dorking	EASY	Walkthrough	🟢 Free	Open
h4cked	EASY	Challenge	🟢 Free	Open
How Websites Work	EASY	Walkthrough	🟢 Free	Open
Hydra	EASY	Walkthrough	🟢 Free	Open
Ice	EASY	Walkthrough	🟢 Free	Open
Intro PoC Scripting	EASY	Walkthrough	🟢 Free	Open
Intro to Logs	EASY	Walkthrough	🟢 Free	Open
Intro to SSRF	EASY	Walkthrough	🔵 VIP	Open
Introduction to CryptOps	EASY	Walkthrough	🟢 Free	Open
Introduction to OWASP ZAP	EASY	Walkthrough	🟢 Free	Open
JPGChat	EASY	Challenge	🟢 Free	Open
Jupyter 101	EASY	Walkthrough	🟢 Free	Open
kiba	EASY	Challenge	🟢 Free	Open
Learn Rust	EASY	Walkthrough	🟢 Free	Open
Linux Logging for SOC	EASY	Walkthrough	🟢 Free	Open
Linux Strength Training	EASY	Walkthrough	🟢 Free	Open
MS Sentinel: Deploy	EASY	Walkthrough	🔵 VIP	Open
MS Sentinel: Detect	EASY	Walkthrough	🔵 VIP	Open
MS Sentinel: Ingest Data	EASY	Walkthrough	🔵 VIP	Open
MS Sentinel: Just Looking	EASY	Challenge	🔵 VIP	Open
Network Security Essentials	EASY	Walkthrough	🟢 Free	Open
OhSINT	EASY	Challenge	🟢 Free	Open
Overpass	EASY	Challenge	🟢 Free	Open
OWASP Juice Shop	EASY	Walkthrough	🟢 Free	Open
OWASP Mutillidae II	EASY	Walkthrough	🟢 Free	Open
OWASP Top 10 2025: IAAA Failures	EASY	Walkthrough	🟢 Free	Open
Pentesting Fundamentals	EASY	Walkthrough	🟢 Free	Open
Phishing Analysis Fundamentals	EASY	Walkthrough	🟢 Free	Open

Showing 50 of 103. The full catalog has the rest.

Related skills

• /en/skills/lfi
• /en/skills/rfi
• /en/skills/shellshock

---

← Back to the full glossary

Last updated: 2026-08-17