Drill one technique
at a time.
PwnKata is LeetCode for offensive security. Open a live, isolated target in your browser, exploit the seeded weakness, capture the flag — then do it again on a fresh variant until it's muscle memory.
SUID binary privilege escalation
A standard user has a shell. One root-owned binary carries the setuid bit — find it, abuse it, read the protected flag.
Recover the flag at /root/flag.txt and submit it.
Built on verified content — not invented numbers.
Three steps, then repeat.
No sprawling multi-step machines — just the one skill, drilled until it sticks.
Pick a technique
Choose a single TTP from the catalog — sudo misconfig, SUID abuse, SQL injection, Kerberoasting, and more.
Open the target
A live, isolated target opens in your browser. Enumerate the host or service; simulated dependencies are labeled in the catalog.
Capture & repeat
Read the flag, submit it, and a fresh seeded variant spins up instantly. Drill the reps until it's automatic.
From one rep to exam pressure.
Atomic drills make execution automatic. The ladder grades the space between a single drill and a full machine — the connective tissue OSCP and CPTS actually test — on the same verified targets.
- Rep
Atomic drill
One technique, executed clean.
Start where the skill is isolated. The objective is named, the flaw is one primitive, and a fresh variant lands every solve until execution is automatic.
- Blind
Blind identification
An unnamed target. Find the weakness yourself.
Hide the label and you get a real box's first problem: enumerate, identify which primitive applies, then execute. Blind solves weigh heavier on your dashboard.
- Triage
Distractors & rabbit-holes
Plausible dead ends. Don't burn the clock.
Decoys — a dead cron, a NOEXEC binary, fake creds — are planted alongside the real path, each proven inert. You practice triage: spotting the rabbit hole before it costs you.
- Chain
Multi-step chain
Foothold → privesc on one host.
Verified atomic drills welded into the shape of a standalone exam box. One terminal flag plus checkpoint tokens for partial credit — the connective tissue the certs actually test.
- Sprint
Exam Sprint
Timed battery → readiness report.
A wall-clock battery of unseen blind items weighted by an exam blueprint. The payoff is a diagnostic readiness report — solved-vs-attempted by skill area, time outliers, and a verdict.
Map the catalog to your exam.
The catalog is sourced and tagged against the OSCP and CPTS syllabi. Pick your exam and drill the techniques it tests — then prove you're ready with a timed sprint.
Make the primitives automatic before exam day.
- Linux privilege escalation
- Web application attacks
- Active Directory
- Enumeration & service attacks
Build the methodology into muscle memory.
- Privilege escalation
- Web exploitation
- Active Directory
- Service enumeration
Own the domain, then explain how you did it.
- External recon & web foothold
- Active Directory to Domain Admin
- Privilege escalation
- Service enumeration
Make web exploitation a reflex.
- Recon & content discovery
- Injection attacks
- File & inclusion attacks
- Server-side attacks
- Client-side & access control
Recognition over recall.
Walkthroughs teach you one path once. PwnKata rebuilds the same technique on a fresh variant every rep, so what sticks is the primitive — not a memorised command.
An actual shell on an actual box.
Every drill is a live Linux target you exploit for real. The same enumeration, the same primitives, the same payoff you'd get on an engagement — minus the setup.
- A fresh, single-use box per session, destroyed on solve
- Fully isolated — you're attacking a throwaway, safely
- Standard tooling — bring your real workflow
The flaw moves. The skill stays.
Solve a drill and the box is destroyed and reborn from a new deterministic seed — a different binary, account, or path. You can't pattern-match your way through; you have to actually recognise the technique.
- Deterministic seeds — reproducible, never random-feeling
- Every seed is proven solvable before it ships
- Reset and re-roll in one click
A readiness report, not a vibe.
An Exam Sprint sequences unseen blind reps and chains under a wall-clock budget weighted by an exam blueprint — then tells you, by skill area, whether you're actually ready. Find the gap here, before you spend a real exam attempt on it.
- Solved-vs-attempted by skill area
- Time-per-item outliers flagged as possible rabbit holes
- A readiness verdict you can act on
65 techniques across 6 domains, and growing.
59 live today — Linux privesc, web exploitation, Active Directory, network services, and cloud. Pick one and start a rep.
File Capability Privilege Escalation
Linux file capabilities can grant one binary more power than intended. Drill finding and abusing that mistake.
easysudo -l Privilege Escalation
A misconfigured sudo rule is one of the most common real-world Linux privesc paths. Drill it until `sudo -l` is the first thing your fingers type.
easySUID Binary Privilege Escalation
A stray SUID bit on the wrong binary is an instant root. Drill enumerating and abusing SUID binaries until it's automatic.
easySQL Injection: Auth Bypass
Drill authentication-bypass SQL injection by matching the payload to the query context.
easyOS Command Injection
Find where user input reaches a shell, then pick a payload form that survives the filter and response style.
mediumSSRF via URL Parameter
Make the server fetch what it shouldn't. Internal targets are simulated safely inside the drill.
mediumWindows PowerUp Local Privilege Escalation
Use PowerUp on a real Windows Server target to find and abuse a weak service DACL.
mediumWindows Manual Local Privilege Escalation
Escalate on a real Windows Server VM by hand — no PowerSploit, no shortcuts.
mediumKerberoasting
Kerberoasting is a workflow: identify the right SPN, request the ticket, crack offline, and prove the credential works.
hardAS-REP Roasting
Find the account with Kerberos pre-authentication disabled, then turn that misconfiguration into a credential.
mediumAD Graph Enumeration Simulator
AD Graph Enumeration Simulator distilled into repeatable single-technique reps on isolated targets.
mediumSNMP Community Strings
A valid community string is only the first step. Walk the tree and identify the OID that proves impact.
easySMB Share Enumeration and Loot
SMB Share Enumeration and Loot distilled into repeatable single-technique reps on isolated targets.
easyFTP Anonymous Enumeration
FTP Anonymous Enumeration distilled into repeatable single-technique reps on isolated targets.
easyBuilt for reps, not for show.
Sprawling CTF machines and video courses have their place. For building reflexes on a specific technique, focused repetition wins.
| PwnKata | Sprawling CTF machines | Video courses | |
|---|---|---|---|
| Scope | One technique per drill | Many skills at oncehard to isolate the gap | Passive, broad |
| Repetition | ✓ Fresh variant every rep | One-and-done box | Re-watch the clip |
| Feedback | Instant flag check + solution | Write-up, eventually | Quiz, maybe |
| Exam readiness | ✓ Timed sprints + report | No signal | No signal |
| Anti-memorisation | ✓ Seeded, proven solvable | Walkthrough-shaped | Single example |
Start free. Go Pro when the cap gets in your way.
Every live technique is free to drill. Upgrade for unlimited reps and the full ladder.
- Every live technique
- 5 drills per 24 hours
- Real isolated boxes
- Progress, streaks & accuracy
or $144/year — two months free
- Everything in Free
- Unlimited drills — no daily cap
- Blind, distractors, chains & Exam Sprints
- Priority access to new techniques
Founding cohort: $99/year while it lasts · billed securely via Stripe — no card stored by us.
Questions, answered.
Is this real exploitation or just a simulation?
Do I need to install or VPN into anything?
Is PwnKata good for OSCP, CPTS, or PNPT prep?
Aren't single-technique drills just training wheels?
Is it safe to run real exploits in the browser?
What's free versus paid?
Can I use my own tools and workflow?
Stop reading walkthroughs. Start drilling.
Spin up a real box and capture your first flag in the next two minutes — free.
Start drilling free →