Learning tracks
Pick your weapon.
Each track is a structured curriculum from foundational concepts to advanced exploitation. Boxes scale in difficulty. Track completion comes with a private writeup vault and a Discord role.
□
Break out of the box.
Container Escape
Docker.sock exposure, privileged containers, capability abuse, mount escapes, and kernel CVEs. Get to root on the host.
3 boxes listed·~7.5 hrs estimated
⬡
Take the cluster.
Kubernetes Offense
RBAC abuse, etcd exposure, kubelet API attacks, service account theft, admission controller bypass. Cluster-admin or bust.
3 boxes listed·~7.5 hrs estimated
◇
Poison the pipeline.
CI/CD Compromise
GitHub Actions injection, runner abuse, OIDC trust misconfigs, malicious dependencies, build poisoning. Own everything downstream.
2 boxes listed·~5 hrs estimated