BreachLabs-Tracks - My BreachLab Writeups

项目说明

BreachLabs Writeups

A collection of my personal writeups for challenges from BeachLabs.

🛠️ Fair AI Use Disclosure:

I would like to preface this that this project has used AI for the original structure of documentation, e besides that has been typed by hand through hours of research. Each level has a ridiculous amount of time spent into building its structure and structuring its information.

📋 About BreachLab

BreachLab is an intuiti for learning linux exploitation through multiple challenges related to different areas of information technology and cybersecurity through hands-on challenges in categories like system exploitation, information gathering, pentesting, software security, AI exploitation, DFIR, counter forensics, blue teaming, red teaming, mobile security, binary exploitation and RE, and more. It's basically an e of O.

Rules of Engagement for the platform, as stated on the BreachLab website:

A free training ground for real offensive and defensi. The labs stay open because operators behave like operators.

Standing Orders

1 - Respect other operators.

Harassment, discrimination, or bad-faith conduct gets you removed. No grey area — the community is the asset.

2 - No spoilers.

Stuck? Use the per-track help threads on Discord — read the pinned #helprules first. Never drop passwords, flags, or hints in chat; the rooms are mirrored and spoiler tags don't survive.

3 - Leave the box clean.

No junk in /tmp, no half-finished payloads in shared dirs. The labs are shared infrastructure, not your scratch space — clean up when you close out.

4 - No brute force.

Automated guessing on passwords, flag submission, or SSH ingress is out of bounds. Read the system, don't flood it — we rate-limit and you'll get caught.

5 - Don't attack the platform.

The wargames are the target. The web app, host, database, and other operators' accounts are out of scope. Found a real vuln there? DM @ato for a Hall-of-Fame slot.

Writeups · Creators

1 - Teach technique, ne answers.

Writeups and are welcome when they teach the method — not the literal password or flag. Share technique-focused content in writeups.

2 - If it earns, give back.

BreachLab runs on donations. If content built on our tracks made you revenue, the donate page is right there.

3 - Credit BreachLab.

A link back or a name-drop in the description. That's it.

Using BreachLab means you've read these and you're in. No checkbox.

📚 Categories

| Path | Link | Status | Challenges Completed | Description |
|----------|--------|--------|---------------------|--------------|
| Ghost | Ghost Path Link | 🟢 Started | 22 & 5 | Where every operator starts, in two parts. Ghost I is Linux and shell fundamentals. Ghost II, Secrets Sprawl, is CI/CD pipeline exploitation from foothold to supply chain. Real boxes, graded server side. |
| Phantom | Phantom Path Link | 🟡 Planning | 0 | Post-exploitation, in two parts. Phantom II Cloud Native is li levels from container to Kubernetes to cloud account, graded server side, not a quiz. Phantom I Post-Exploitation is coming. |
| Specter | Specter Path Link | 🟡 Planning | 0 | Recon & initial access — how you get in. A four-part series: OSINT, network & wireless, defence e & disruption, and social engineering. Specter I (OSINT, 14 levels) and Specter II (network & wireless, eight levels) are live; III–IV are planned. |
| Mirage | Mirage Path Link | 🟡 Planning | 0 | Web application exploitation, in two parts. Mirage I — the full ladder from recon to AI, 41 browser targets: client trust, broken access control, BaaS/RLS, auth & tokens, the injection family, XSS, SSRF, deserialization, GraphQL, and AI/LLM attacks. Mirage II — the ad sequel, 12 targets: cache deception, request smuggling, parser desync, HTTP/2 downgrade, single-packet races, and deserialization RCE. |
| Cipher | Cipher Path Link | ⚫ Una | 0 | Cryptography and password attacks. Hash cracking, TLS exploitation, padding oracle, RSA , JWT forgery, credential stuffing. |
| Nexus | Nexus Path Link | ⚫ Una | 0 | CI/CD and supply chain. Git secrets, pipeline poisoning, dependency confusion, container registry attacks, IaC exploitation. |
| Oracle | Oracle Path Link | ⚫ Una | 0 | AI/LLM security. Prompt injection, jailbreaking, data exfiltration through LLMs, agent exploitation, RAG poisoning, model attacks. |
| Wraith | Wraith Path Link | ⚫ Una | 0 | Windows and Acti. PowerShell, token impersonation, Kerberoasting, pass-the-hash, DCSync, Golden Ticket, AMSI bypass, GPO abuse. |
| Shadow | Shadow Path Link | ⚫ Una | 0 | Anonymity, OPSEC, and darknet. Tor, , anonymous communications, cryptocurrency privacy, counter-forensics, attribution resistance. |
| Sentinel | Sentinel Path Link | 🟡 Planning | 0 | Blue team — the full SOC-to-DFIR arc. Log analysis & SIEM hunting, alert triage, incident response, endpoint & Windows forensics, memory & disk DFIR, malware analysis, network detection, threat hunting, CTI & attribution, detection engineering (Sigma/YARA/Suricata), cloud & identity detection, and detection-dri. A purple-team through-line has you detect the exact TTPs you attacked in Ghost, Phantom, Mirage and Specter. |
| Prism | Prism Path Link | ⚫ Una | 0 | Apple security. macOS SIP/TCC/Gatekeeper bypass, Keychain extraction, iOS jailbreak fundamentals, app analysis, AirDrop exploitation. |
| Venom | Venom Path Link | ⚫ Una | 0 | Red team operations. C2 frameworks, implant de, payload delivery, infrastructure setup, EDR bypass, campaign planning, purple teaming. |
| Flux | Flux Path Link | ⚫ Una | 0 | Binary exploitation and reverse engineering. Stack o, ROP, heap, shellcoding, mitigation bypass, malware RE, firmware analysis, exploit de. |

📖 How to Use

1. Browse by path
2. Find the challenge you're working on
3. Read the writeup after attempting the challenge yourself. Every writeups has been truncated to remove any flags, it only outlines the steps, as well as additional informations/general knowledge that are useful, you WILL need to do each step to get this type of information, this is to ensure that even if someone uses the writeups, they're still learning a lot.
4. Learn and understand the techniques

📄 License

Licence CC BY-NC-SA 4.0 - Creati License

项目信息

开发语言：未知

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕My BreachLab Writeups展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。