Kioptrix Level 1.1 / 1.2 / 1.3 Comparison: Which Box Should You Tackle First for OSCP Prep?

Midnight Decisions: Which Kioptrix Box Should You Actually Start With?

It’s five minutes to midnight. You’ve got Kali open, your coffee’s gone lukewarm, and a dozen browser tabs are shouting about “OSCP-like VulnHub boxes.” Everyone’s got an opinion: “Start with Kioptrix!” — yeah, but which one? 1.1, 1.2, or 1.3? That naming scheme doesn’t help. You don’t have time to guess wrong.

This guide cuts through the noise.

You may be balancing work, limited lab time and a certification budget. Use these free legacy VMs to identify which fundamentals need practice before buying a course or exam package.

This comparison explains the learning themes of releases 1.1 through 1.3 and suggests a flexible practice order. They support foundational Linux and web skills; they are not current OSCP+ exam simulations or evidence of exam readiness.

---

🚨 The Problem

Kioptrix box names are confusing. Your time isn’t infinite. You need a start point — and a reason for it.

✅ The Promise

By the end of this article, you’ll know exactly which Kioptrix box to fire up first, how each maps to OSCP-style skills, and how to make every minute count toward your exam goal.

🧭 The Roadmap

We’ll go box-by-box, highlighting:

• Technical skills each teaches (foundational Linux and web practice)
• Estimated time investment (illustrative planning assumptions)
• Difficulty and payoff
• Where each box fits in your overall prep timeline

Then we’ll wrap with a 15-minute action plan you can use right now — not “eventually.”

No guesswork. Just a late-night game plan that moves you forward.

Why Kioptrix Still Matters for Foundational Practice

Kioptrix uses legacy software. The official release pages identify 1.1 (#2), 1.2 (#3), and 1.3 (#4). Use them for enumeration and evidence-based testing, then add modern Windows and Active Directory practice.

Here’s why that’s still rational in the OSCP+ era:

• Solid fundamentals: Kioptrix boxes force you to practice host discovery, port scanning, web enumeration, credential reuse, and Linux privilege escalation—all still core in OSCP+.
• Beginner-friendly difficulty: VulnHub itself tags the Kioptrix images as “easy” learning challenges. Several modern walk-throughs confirm they’re meant for beginners stepping into penetration testing for the first time.
• OSCP-like flavor: Multiple bloggers describe Kioptrix 1.1–1.3 as “OSCP-like” boot-to-root CTFs: you get a narrow scope, must chain enumeration → exploitation → privesc, and document what you did, just like the exam.

But there are limitations you should be honest about:

• No Active Directory or modern EDR.
• Older Linux stacks and web apps—valuable for learning, not representative of the latest corporate estates.
• Some exploits rely on older kernels or software versions you won’t see in 2025 production, though the methodology maps well.

The current OffSec exam guide includes an Active Directory set and strict reporting requirements. These legacy Linux VMs cover only part of that preparation.

So the realistic view is this: Kioptrix won’t pass the exam for you, but it’s a cheap, low-friction way to build the muscle memory you’ll need when you’re deep in OffSec’s PEN-200 labs, Hack The Box, Proving Grounds, or TryHackMe.

Kioptrix Level 1.1 / 1.2 / 1.3 at a Glance

First, let’s align on naming. VulnHub uses this slightly cursed convention:

• Kioptrix: Level 1.1 (#2), also called Level 2 → Commonly called Level 1.1.
• Kioptrix: Level 1.2 (#3), also called Level 3 → Commonly called Level 1.2.
• Kioptrix: Level 1.3 (#4), also called Level 4 → Commonly called Level 1.3.

Here’s the short version of the Kioptrix Level 1.1 / 1.2 / 1.3 comparison in OSCP language:

Box	Main Theme	Key Skills	Feels Like in OSCP World	Difficulty (Beginner View)
1.1 (Level 2)	Classic web + simple command injection	Port scanning, SQLi on login, basic RCE, Linux privesc	Your first “proper” OSCP-style Linux box	⭐ Easy–Low Medium
1.2 (Level 3)	CMS exploitation (LotusCMS) + credential reuse	Virtual hosts, CMS RCE, DB creds, password cracking	A multi-step web → DB → OS chain	⭐⭐ Solid Medium, still beginner-friendly
1.3 (Level 4)	SQLi + restricted shell + clever privesc	Login injection, credential discovery, restricted-shell analysis, database privileges	Your first “this feels like exam pressure” box	⭐⭐⭐ Medium with a few “aha” moments

A useful suggested order is 1.1 → 1.2 → 1.3. Difficulty depends on your experience and setup; the labels in this comparison are editorial guidance, not measured rankings.

Choose a box by the skill you want to practise: web input handling on 1.1, web-to-credential reasoning on 1.2, or restricted-shell and privilege analysis on 1.3.

What Kioptrix Level 1.1 Really Teaches You

Imagine a quiet evening: you scan the subnet, find the Kioptrix host, and suddenly see a handful of open ports—SSH, HTTP, maybe HTTPS, CUPS, MySQL. Nothing outrageous. It feels “small enough to handle”, which is exactly the point.

Across recent 1.1 walk-throughs, the rough path looks like this:

• Use netdiscover or arp-scan to find the target.
• Run a targeted nmap -sV -sC and note HTTP, HTTPS, and DB ports.
• Hit the web login, test simple SQL injection payloads, and confirm authentication bypass.
• Reach a “ping” interface that lets you run system commands—your first taste of command injection.
• Stabilize your shell, then enumerate kernel version, SUID binaries, and misconfigurations for privesc.

It’s not flashy. That’s why it’s valuable. Each step mirrors a tiny slice of what PEN-200 and the OSCP+ exam expect from you:

• Structured enumeration instead of random tool flailing.
• Translating a web vulnerability into system-level access.
• Looking for privilege escalation vectors like you’re running a mental checklist.

Show me the nerdy details

On Kioptrix 1.1, many write-ups walk through SQL injection on the login form using straightforward payloads like ' OR '1'='1. Once authenticated, a web interface calls ping and interpolates user input into a shell command. That’s your entry to remote command execution. From there, people typically upload a reverse shell via curl/wget or abuse the ping parameter directly, then escalate with a known local kernel exploit or a weakly configured service. The important pattern isn’t memorizing a specific exploit, but seeing the chain: data in → command execution → shell → root.

For many beginners, 1.1 is the first time they watch a simple form parameter turn into a root shell. That psychological shift—“oh, this is exactly how it happens in real life”—is priceless.

What Kioptrix Level 1.2 Adds on Top

Level 1.2 adds web application and credential reasoning. Its release instructions require mapping the target IP to kioptrix3.com in the attacker’s hosts file. Follow that required hostname setup; do not assume the image contains multiple virtual hosts.

Across recent write-ups, you’ll see a fairly consistent storyline:

• Enumeration uncovers HTTP plus a hostname like kioptrix3.com that you need to add to /etc/hosts.
• LotusCMS is identified via HTTP titles and responses, then hit with known exploits or a crafted RCE payload.
• Once you gain a low-privilege shell, you dig into config files, find MySQL credentials, and pivot into the database.
• Hashed passwords get dumped, cracked offline with hashcat or john, and reused for SSH or privilege escalation.

This is a fantastic training ground for OSCP-style “chaining”:

• You’re learning to recognize CMS fingerprints and version information from banners and page content.
• You practice host file manipulation and virtual host routing—common in real enterprise environments.
• You get hands-on with credential reuse across services, which shows up frequently in penetration test reports.

Keep track of how each credential was obtained and where it was actually accepted. A successful shell is not proof of exam readiness, and copying a password-cracking result is not the same as reproducing it.

What Level 1.3 Adds: Restricted-Shell Reasoning

Level 1.3 is where many OSCP candidates report their first “I’m stuck but also having fun” moment. The box leans heavily on SQL injection for initial access and then throws you into a restricted shell over SSH.

The common storyline goes something like this:

• Enumerate HTTP and find a login form vulnerable to SQL injection.
• Use SQLi to dump user credentials from the backend database.
• SSH in with those credentials, only to discover a restricted shell with very limited commands.
• Inspect the restricted shell’s permitted commands and available tools; test only a route supported by your observations.
• Once you land in a “normal” shell, you move to classic Linux privilege escalation to reach root.

This feels extremely OSCP-like for three reasons:

1. You’re punished for poor enumeration. Miss a parameter or table and you won’t have the right credentials.
2. You must think about shells as environments. Knowing that vi or less can spawn shells isn’t trivia—it’s exam material.
3. Your mental game matters. It’s easy to rage-quit when the restricted shell blocks your usual tools.

Show me the nerdy details

Level 1.3 combines login injection and credential discovery with a restricted shell and database-assisted privilege escalation research. Keep these as leads to verify on the correct VM, not a universal sequence of UNION queries, hash cracking, sudo abuse or SUID exploitation. The release’s walkthrough list offers examples; record your own observations and resulting privileges.

Mentally, 1.3 is the moment you stop seeing a machine as “a puzzle with a trick” and start seeing it as a gritty little system that will fight you back unless your methodology is stable.

Time & Certification Budget Planning Around Kioptrix

Plan for lab access, exam attempts, retakes and taxes. Current options and prices are listed on OffSec’s pricing page. The available packages and conditions can change; check the current quote before paying.

The good news: Kioptrix is free, and you can run it locally. The trick is to slot it into your overall budget and timeline like a pro.

Self-Assessment Before Buying Training

Before you drop four figures, run this binary checklist:

• Linux navigation: Can you move confidently with cd, ls, grep and edit files in vim or nano? (Yes/No)
• Networking fundamentals: Do you understand basic TCP/UDP ports, subnets, and routing enough to interpret an nmap scan? (Yes/No)
• Basic web vulns: Have you manually tested for SQLi and command injection at least once on a lab target? (Yes/No)
• At least 3 boot-to-root boxes: Have you fully rooted 3+ beginner VMs (including at least one Kioptrix)? (Yes/No)
• Study budget room: Can you commit to a realistic weekly schedule and review progress? (Yes/No)

Use this as a self-assessment, not an official eligibility rule. Practise the skills you cannot yet explain, and choose a study schedule you can sustain. Completing three VMs or meeting an arbitrary hour total does not establish exam readiness.

Certification Budget Checklist

Option	Budget checks	Best fit
PEN-200 course package	Current price, access duration and included attempts	Structured course study
Learn One	Selected course, subscription term and renewal conditions	A longer study schedule
Exam-only option	Availability, attempts and expiration dates	Prepared independent learners
Retake or lab extension	Current fee, waiting period and eligibility	Contingency planning

Check the official product page and checkout for the current price, lab duration, attempt count, retake terms and any regional charges. Record the quote date before making a budget.

For any region, check the booking time zone and plan breaks around your normal sleep schedule. The current OSCP+ exam guide allows 23 hours and 45 minutes for the practical exam, followed by 24 hours for documentation. Use shorter lab sessions to build a sustainable routine.

Decision Map: Which Kioptrix Box Should You Tackle First?

Now to the core question: Which Kioptrix Level 1.x should you start with for OSCP prep? Let’s answer it with a simple decision card.

Decision Card: Start With 1.1, 1.2, or 1.3?

Your Situation (Be Honest)	Recommended First Box	Why
Brand-new to CTFs, can use Linux but haven’t rooted a box yet	Kioptrix 1.1	Shortest path to “scan → web vuln → root,” low chance of getting lost.
Comfortable with Linux and basic web vulns, rooted 2–3 easy boxes	Kioptrix 1.2	Introduces CMS exploitation, credential reuse, and more realistic web flows.
Already done multiple VulnHub / Hack The Box “Easy” boxes, know SQLi basics	Kioptrix 1.3	Gives you restricted shell pain and chained exploitation similar to exam pressure.
Revising close to exam; want fast warm-up	1.3 → 1.2 → 1.1 (speed run)	Start hardest and run backwards as confidence boosters in one weekend.

Illustrative plan: a learner with a full-time job could dedicate one session to recon, another to a single researched route, and a third to reporting. Review what you can reproduce without hints before selecting the next box; this is a planning example, not a reported exam outcome.

If you’re still unsure, use this tie-breaker:

• If you’re afraid of “breaking your confidence” → start with 1.1.
• If you’re bored by super-easy boxes → start with 1.2.
• If your exam is within 4–6 weeks → start with 1.3 as a stress rehearsal.

Building an OSCP-Style Lab Routine With Kioptrix

Kioptrix on its own is nice; Kioptrix inside a routine is powerful.

Here’s a simple weekly structure that works well for time-poor professionals:

• One weekday evening (90 minutes): pure recon and note cleanup; no exploitation allowed.
• One weekend block (3 hours): exploitation + privesc attempts on a single box.
• 15-minute “report drill”: write a mini-report for that box using OSCP-style headings.

Play this out over 3–4 weeks:

1. Week 1: Kioptrix 1.1 (recon → exploit → privesc → report).
2. Week 2: Kioptrix 1.2.
3. Week 3: Kioptrix 1.3.
4. Week 4: A more modern OSCP-like box on Hack The Box, OffSec Proving Grounds, or TryHackMe.

By the end of this cycle, you’ve rehearsed the full OSCP pattern four times.

Mini Calculator – How Many Weeks Until You Finish 20 OSCP-Style Boxes?

There is no universal preparation-hour benchmark. Use the estimator with your own observed hours per box; it is simple workload arithmetic, not a forecast of passing or a recommendation to complete a fixed number of machines.

Infographic: Kioptrix Roadmap vs OSCP Skills

Defensive Lessons from These Labs

• Inventory exposed services and retire unsupported software.
• Restrict database privileges and avoid credential reuse.
• Verify application input handling and service permissions.

These lab examples do not establish breach-frequency percentages.

FAQ

1. Which Kioptrix box is closest to an actual OSCP+ exam machine?

None of these legacy VMs is a verified match for current exam targets. Level 1.3 is useful for restricted-shell and chained-access practice, while Windows and Active Directory need separate study. Use the official exam guide for requirements.

2. Can I skip 1.1 and 1.2 and go straight to 1.3?

You can, but you’ll lose a gentle ramp. Doing 1.1 → 1.2 → 1.3 builds momentum and lets you debug your workflow before hitting the hardest box. Your 60-second action: decide whether you want a confidence ramp (do all 3) or a stress-test (start at 1.3) and write that choice at the top of your study plan.

3. How many times should I repeat each Kioptrix box before exam day?

For most people, once mindfully and once quickly per box is enough. Use the second run to practice speed and reporting, not new techniques. Your 60-second action: next to each Kioptrix entry in your tracker, add two checkboxes—“slow run” and “speed run”—and tick them as you go.

4. How does this fit with the cost and timeline of OSCP+?

If you’re planning a PEN-200 bundle or Learn One subscription, treat Kioptrix as a pre-bundle warm-up. Aim to finish all three boxes before your paid lab access starts, so those 90 days or 12 months are used for harder content. Your 60-second action: check your target purchase date for OffSec, then count back 3–4 weeks and label that block “Kioptrix trilogy.”

5. What if I keep getting stuck on enumeration or privesc in these boxes?

That’s normal, and frankly, expected. Focus on improving your checklists rather than memorizing solutions. After each stuck session, list three things you didn’t check (e.g., SUID binaries, cron jobs, unusual services) and bake them into your next run. Your 60-second action: create a 10-item “Did I check this?” list for enumeration and privesc and keep it open while doing Kioptrix.

6. Are Kioptrix boxes enough practice for the OSCP+ exam by themselves?

No. These VMs practise Linux and web fundamentals. They do not provide complete Windows or Active Directory coverage. Compare modern course and lab content with the current exam guide; do not assume every platform or subscription includes AD environments.

Conclusion: Your Next 15 Minutes

We all start with the same quiet question: Should I begin with Kioptrix Level 1.1, 1.2, or 1.3? It feels small—but it’s the first step toward something much bigger.

Now that you’ve seen how each box connects to real OSCP+ skills, where they fall on the difficulty curve, and how they realistically fit into your time and budget for your schedule, it’s time to land the plane.

Here’s your 15-minute wrap-up checklist:

• Pick your first box using this simple guide:
  → 1.1 if you want to build strong fundamentals.
  → 1.2 if you’re ready to chain exploits.
  → 1.3 if you want to simulate exam pressure.
• Block four time slots on your calendar—one for each Kioptrix level, and one for a modern machine. Four focused sessions. That’s your foundation.
• Set a budget anchor using the cost breakdown table. This protects you from surprises later and keeps your OSCP+ journey financially sustainable.
• Create or refine your notes template. Use clear, exam-style headings. Start writing like you’re already reporting to the OffSec exam panel.

And if everything else feels like too much right now, just do this one thing:
Say out loud, “Tomorrow night, I’m doing Kioptrix [X]—from recon to report.”
That single decision shifts you from vague ambition into real momentum.

Reviewed 12 October 2026 against the linked VulnHub release listings and current OffSec exam and pricing pages. Difficulty and session plans are suggestions. No new exploit run was performed for this editorial review.

🔗 Kioptrix Level 1 Walkthrough 🔗 Kioptrix Labs Beginner Roadmap