Kyvera logoKyvera
Browse Products
Mission Command

Browse the lab board like a campaign map, not a catalog.

Public labs still launch fast, but the surface now frames each mission as part of a wider operator climb: route, reward, clearance, and the next staged objective.

Operator Progression

Campaign Rank

Lv.16

Live Missions

4

XP Cache

1880 XP

Follow the suggested path if you want the cleanest mission loop, or skip straight into a live sandbox without breaking the browse-first funnel.

Next Mission Cue

Network Recon and Scanning

Turn raw surface area into the next attack decision.

Reward

+100 XP

Pathfinder Recon

Window

20 min

Tier 01

Launch Network Recon and Scanning
Mission Map

Campaign route with live clearance gates

2 sealed
1
Next Mission
Live

Tier 01

Network Recon and Scanning

20 min
+100 XP

No clearance required. This is the public entry mission.

2
Unlocked
Live

Tier 01

Linux Privilege Escalation

45 min
+250 XP

Recommended after clearing Network Recon foundations.

3
Unlocked
Live

Tier 02

OWASP Top 10 - Web Exploitation

60 min
+300 XP

Recommended after securing Linux escalation basics.

4
Unlocked
Live

Tier 02

Active Directory Attack Paths

90 min
+400 XP

Recommended after clearing the OWASP strike run.

Locked
Preview

Tier 03

AWS Cloud Security - Misconfigurations

75 min
+380 XP

Unlocks after the AD attack-path campaign stage.

Locked
Preview

Tier 03

Buffer Overflow - 32-bit x86

120 min
+450 XP

Unlocks after the Cloud Security briefing route.

Campaign Tiers
Tier 01
2/2

Recon Foundations

350 XP in this band

Tier 02
2/2

Web App Security

700 XP in this band

Tier 03
0/2

Cloud Security

830 XP in this band

Difficulty Bands
Beginner
1

Fast recon and high-clarity first wins.

Intermediate
2

More than one signal to chain before the reward drops.

Advanced
3

Longer missions with higher-stakes proof and deeper unlocks.

Filter Mission Board
Access Mode
Next Mission
Beginner
Live Sandbox
Lv.1
Tier 01Network mission

Network Recon and Scanning

Turn noisy network space into a real attack map.

Objective

Turn raw surface area into the next attack decision.

Reward Charge22%

Reward

+100 XP

Pathfinder Recon

Mission Window

20 min

Ingress Clearance

Unlock Requirement

No clearance required. This is the public entry mission.

Proof Artifact

Network map, prioritized host list, and recon notes.

Objective Chain
1

Discover hosts and enumerate exposed services.

2

Confirm the most promising foothold target.

Final Objective

Package findings into a concise attack plan.

nmap
netcat
recon
port-scan
Launch MissionMission Brief
Unlocked
Intermediate
Live Sandbox
Lv.2
Tier 01Linux mission

Linux Privilege Escalation

Pivot from a low-privileged shell to full root access.

Objective

Break containment and take root cleanly.

Reward Charge56%

Reward

+250 XP

Rootline Operator

Mission Window

45 min

Host Elevation Clearance

Unlock Requirement

Recommended after clearing Network Recon foundations.

Proof Artifact

Root flag, escalation notes, and a cleanup checklist.

Objective Chain
1

Baseline the host and enumerate privilege boundaries.

2

Exploit one viable escalation path end-to-end.

Final Objective

Capture proof and write the remediation note.

SUID
sudo
cron
GTFOBins
Launch MissionMission Brief
Unlocked
Intermediate
Live Sandbox
Lv.3
Tier 02Web mission

OWASP Top 10 - Web Exploitation

Work through the bugs employers actually ask about.

Objective

Break the app, prove impact, and package clean findings.

Reward Charge67%

Reward

+300 XP

Exploit Chain Runner

Mission Window

60 min

Application Strike Clearance

Unlock Requirement

Recommended after securing Linux escalation basics.

Proof Artifact

Captured findings, exploit screenshots, and a vuln-to-fix mapping.

Objective Chain
1

Fingerprint the app surface and attack map.

2

Exploit at least two core OWASP issues.

Final Objective

Record remediation notes alongside proof of impact.

SQLi
XSS
IDOR
SSRF
Launch MissionMission Brief
Unlocked
Advanced
Live Sandbox
Lv.4
Tier 02Windows mission

Active Directory Attack Paths

Move through a Windows domain like an operator, not a tourist.

Objective

Map the domain and push a full attack path to admin.

Reward Charge89%

Reward

+400 XP

Domain Breach Architect

Mission Window

90 min

Enterprise Pivot Clearance

Unlock Requirement

Recommended after clearing the OWASP strike run.

Proof Artifact

Domain compromise proof, path graph, and priority remediation list.

Objective Chain
1

Collect domain intel and identify high-value principals.

2

Exploit the most efficient credential attack path.

Final Objective

Validate domain compromise and summarize the blast radius.

Kerberoasting
BloodHound
Pass-the-Hash
DCSync
Launch MissionMission Brief
Locked
Advanced
Briefing Mode
Lv.4
Tier 03Cloud mission

AWS Cloud Security - Misconfigurations

Hunt IAM abuse and cloud pivots before attackers do.

Objective

Trace IAM drift into a real cloud takeover path.

Reward Charge84%

Reward

+380 XP

Cloud Drift Hunter

Mission Window

75 min

Cloud Pivot Clearance

Unlock Requirement

Unlocks after the AD attack-path campaign stage.

Proof Artifact

Cloud attack chain diagram and priority hardening checklist.

Objective Chain
1

Profile exposed resources and workload identity.

2

Map the privilege escalation chain in AWS.

Final Objective

Prepare the hardening actions you will validate live.

AWS
IAM
S3
SSRF
Open BriefingMission Brief
Locked
Advanced
Briefing Mode
Lv.4
Tier 03Binary mission

Buffer Overflow - 32-bit x86

Control EIP, shape the stack, and make the binary listen.

Objective

Take over the binary path before the live VM unlocks.

Reward Charge100%

Reward

+450 XP

Stack Breaker Initiate

Mission Window

120 min

Exploit Dev Clearance

Unlock Requirement

Unlocks after the Cloud Security briefing route.

Proof Artifact

Exploit plan, offsets, and pre-launch runbook.

Objective Chain
1

Map the vulnerable function and crash path.

2

Document offset control and payload layout.

Final Objective

Stage the checklist for the live exploit session.

GDB
pwndbg
shellcode
ret2libc
Open BriefingMission Brief
Public Start Preservation

Launch now. Save continuity later.

The public mission entry CTA stays primary. Account creation only appears when you want saved streaks, protected notes, roadmap linkage, and recruiter-facing proof.

Create Free AccountOpen Member Labs