Reviewed October 16, 2026. This is an editorial planning worksheet, not a benchmark, an official platform rating or a validated difficulty calculator. No named machine is assigned a tested score, expected solve time or success probability.
Choose a lab by its prerequisites and the skill you want to practice, then update the choice using your own evidence. A known CVE can require difficult build and configuration checks; a guided identity exercise can be more approachable than an unfamiliar web puzzle. Exploit category alone cannot predict how long you will need.
Use Ratings as Context, Not a Personal Forecast
A platform label may describe its intended audience or community experience. Your experience also depends on prior knowledge, available hints, documentation, environment setup and whether the goal is a guided repetition or an independent assessment. Keep the publisher’s label separate from your own assessment rather than declaring either one universally correct.
Seven Questions Before You Choose
- What specific skill will this exercise train?
- Which prerequisites are stated by the publisher?
- Can the environment run on your available hardware?
- Is the task guided, hinted or independent?
- What starting access and permissions are provided?
- What result will count as useful evidence this session?
- Can you stop and resume without losing the state?
Replace a Universal Tier Ladder with a Profile
| Dimension | Record | Why it matters |
|---|---|---|
| Knowledge | Familiar / partly familiar / new | A simple-looking task may require an unfamiliar prerequisite. |
| Guidance | Steps / hints / independent | A guided result is different evidence from an independent result. |
| Environment | Working / uncertain / blocked | Setup delay should not be mistaken for security difficulty. |
| Chain | Known stages / unknown transitions | Dependencies can create new questions between stages. |
| Session goal | One observable result | Progress need not mean full compromise. |
Do not total these labels into a pass score or a predicted duration. The profile makes assumptions visible; it does not measure intrinsic difficulty. Mark unknown fields as unknown. Avoid reading a complete solution solely to assign a category if independent discovery is the skill you want to practice.
For Web Tasks, Name the Behavior You Need to Understand
Distinguish technology identification, authentication, authorization, input handling and application workflow. The OWASP Web Security Testing Guide provides testing topics and methods; it does not validate this planning worksheet or rank machines by solve time. Use its categories to describe a task precisely rather than calling known software “fast” and custom logic “slow.”
For example, an authorization exercise may ask whether one test account can access another account’s object. A predictable identifier is only a lead; the permitted request and response establish the behavior. Pick a controlled, authorized question and keep the expected protection separate from the observed result.
For Authentication and Logic, Define Accounts and State
Write down which test account, role, object and workflow state apply. If you cannot explain those relationships, a small prerequisite exercise may be the next useful task. More guessing at passwords does not resolve an unclear authorization model. Use the web evidence checks for examples of observations and limits.
For Local Privilege Tasks, Record Starting Context
Linux versus Windows is not a universal difficulty comparison. Identify the starting account, effective permissions, service ownership and available tools. An unusual permission or old version is not a confirmed route. If a prerequisite is unfamiliar, label that knowledge gap rather than assigning the machine a higher objective tier.
For Identity Labs, Scope One Relationship
Record the provided identity, domain context, access and intended relationship to inspect. A first useful result might be an explained group relationship or permission boundary, not administrator access. The AD profiling evidence guide separates observed membership and permissions from a proven access path. Guidance level and starting access can matter more than the broad “AD” label.
Use a Planning Note Instead of a Difficulty Formula
Hypothetical example: you have a 90-minute block, but compatibility is unverified and the target’s prerequisite protocol is new. Choose either environment validation or one introductory protocol task as the goal. Do not infer that a weighted score of “CVE + chain + OS” predicts completion. There is no calibrated dataset behind such a formula here.
Choose a Learning Mode That Matches the Goal
For learning a new concept, a guided task may be useful. For checking independent reasoning, choose unfamiliar work with appropriate prerequisites and record assistance. For revisiting an error, reproduce a small earlier finding from notes. These modes are different purposes, not a ranking of learner worth. Change mode when it no longer answers the question.
Treat Chains as Dependencies, Not a Numeric Multiplier
A sequence can require keeping track of identities, credentials, services and starting conditions. Count the transitions you can explain and mark the uncertain ones. Two steps do not imply twice the time or a fixed increase in difficulty. A blocked prerequisite can dominate the whole task; hints can also reduce that uncertainty.
Budget Available Time Without Predicting a Finish
If you have three scheduled hours, a hypothetical plan is 60 minutes for prerequisites, 90 for a focused exercise and 30 for notes: 60 + 90 + 30 = 180 minutes. Those allocations are choices, not measured requirements. If setup consumes the exercise block, log that result and revise the next session instead of calling the plan a failure.
Keep a Log That Can Correct Your Assumptions
- Before
- Publisher label, expected prerequisite, guidance level, environment status and session question.
- After
- Actions attempted, evidence obtained, assistance used, actual time by task and unresolved question.
- Next
- Repeat, study a prerequisite, change the environment or choose another task—with a reason.
Compare similar sessions cautiously. Familiarity, hints and environment changes can explain a faster result. This log supports planning; no improvement percentage or time saving is claimed. Record an unsolved but well-understood task as useful evidence rather than hiding it.
Common Selection Questions
What is best for a beginner?
A task with clear prerequisites, a working environment and suitable guidance. No exploit category guarantees an easy win.
Should I avoid chains?
No. Break a chain into questions and plan a resume point. Choose its scope according to the skill you need.
Does a fast solve prove readiness?
No. Distinguish memorized, guided and independent results, then review current assessment requirements separately.
Choose One Task and Record Why
These checkboxes do not score a machine or save a record. Use the profile to explain your choice, then update it when the evidence changes. The point is better planning, not a universal tier label.