P3N73S7 L4B :: NIGHTFALL - Showcase

Static Showcase

This is a preview of P3N73S7 LAB. The actual lab runs locally with Docker.

Get the Real Thing on GitHub

P3N73S7 L4B :: NIGHTFALL ::

Requirements to Run

• Docker Desktop installed and running
• ~8GB disk space for container images
• Python 3 with Flask
• macOS, Linux, or WSL2 on Windows

| NIGHTFALL |

Not just a lab - a conspiracy you'll uncover one hack at a time. Eight episodes teach real exploits while a story emerges: encrypted messages, evidence files, a missing whistleblower.

You'll learn: FTP backdoors, SSH brute forcing, WAR uploads, command injection, SQL injection, SMB exploits, and more.

Every command moves you closer to the truth.

The Forgotten Door

Exploit the infamous vsftpd 2.3.4 backdoor to gain initial access.

The Analyst

Brute force SSH credentials using Hydra and rockyou wordlist.

The Deployment

Upload a malicious WAR file to Tomcat Manager for code execution.

Shared Secrets

Exploit SambaCry (CVE-2017-7494) to upload and execute a shared library.

The Build Farm

Exploit DistCC daemon for remote code execution.

Input Validation

Command injection through web forms to achieve reverse shell.

The Query

SQL injection to bypass authentication and extract sensitive data.

Storefront

Modern SQL injection against OWASP Juice Shop e-commerce platform.

The Truth

Full story payoff and comprehensive skills review.