Kioptrix 1.1 vs 1.2 vs 1.3: Choose Your Next Lab

Choose Kioptrix 1.1 (#2) if you want to practise web input handling, 1.2 (#3) for hostname and credential reasoning, or 1.3 (#4) for restricted-shell analysis. If you have never set up a vulnerable VM, complete the original Level 1 setup guide first. These are different releases: original Level 1 (#1) is not Level 1.1 (#2).

This comparison helps you choose one learning goal and a useful session record. It does not rank current OSCP exam machines, predict completion time or establish exam readiness. Technical routes below contain solution hints; use the comparison and decision map first if you want fewer spoilers.

What this comparison can help you choose

Choose a legacy lab to practise a particular question, then keep evidence of what you actually learned. The suggested themes below are editorial learning goals, not measured difficulty scores or an official certification sequence.

These older Linux exercises support enumeration, web investigation, credential reasoning, and reporting. They do not provide a complete modern Windows or Active Directory curriculum. Check the current OffSec exam guide separately for exam requirements and restrictions.

If importing a VM, interpreting routes, or saving a scan is new to you, use the beginner roadmap and original Level 1 guide first. Original Level 1 (#1) is a separate release from 1.1 (#2).

Kioptrix 1.1, 1.2 and 1.3: release and goal comparison

The numbers identify releases. They do not establish that every learner will find 1.3 harder than 1.2, or that earlier releases must be completed first. Select one question you can investigate during your available sessions.

Level 1.1 (#2): investigate web behavior

The release listing contains both Kioptrix_Level_2-original.rar and Kioptrix_Level_2-update.rar. It explains that the first release had a web application bug. Record which archive you use before comparing results with a walkthrough.

Suggested task: save the observed HTTP response and describe one input-handling question. Keep the request, response, proposed explanation, and actual outcome separate. Do not assume a version banner or an unexpected login response proves a vulnerability.

Useful output: a short record linking one observation to the next test. If behavior differs from a solution, compare image version and configuration before repeating attempts.

Solution-theme hint

Web authentication and command-handling are useful investigation themes for this release. Treat them as research directions rather than a guaranteed route. For an independently authored full solution, use the community walkthrough index on the release page and record any assistance used.

Level 1.2 (#3): connect hostname and credential evidence

The Level 1.2 release instructions require a hosts-file entry pointing kioptrix3.com to the VM’s current lab IP. Make the change on the machine whose browser or tools send the request. A mapping on the host does not automatically configure a separate attacker VM.

Check the current address after a restart or DHCP change. Do not reuse an address from a screenshot or example. A missing mapping can produce broken links or unexpected application behavior; this is a setup question to resolve before a vulnerability claim.

Suggested task: link each application observation to the next supported check. If you discover lab credentials, record where they came from and which service actually accepted them. A discovered password, a recovered hash, and a successful login are different observations.

Useful output: a credential-use record with synthetic labels in the sharing copy, plus the resulting identity and any unresolved prerequisites. Keep actual lab secrets in your private notes.

Level 1.3 (#4): reason about shell restrictions

The Level 1.3 release page lists VMware and Hyper-V archives. It notes historical boot/addressing difficulties and a possible need for a Legacy Network Adapter with Hyper-V. Read the notes for your image and hypervisor; the download is a disk that may require creating a VM and attaching the existing drive.

Suggested task: if you reach a restricted session, record the exact command, response, user identity, and available capabilities. A rejected command does not by itself identify the restriction mechanism. Research a route only when your observations support its prerequisites.

Useful output: a before-and-after record of the permitted behavior and resulting privileges. Distinguish a more usable shell from a higher-privilege identity; they are not the same result.

Solution-theme hint

The release’s community walkthrough list includes login, limited-shell, and privilege research examples. Use those as assistance on the matching image. Do not assume an editor, pager, database feature, or kernel route is available simply because it worked in another write-up.

Plan time and any training purchase separately

Use your own observed session time, including notes and reporting, as the starting estimate. Include a separate setup allowance for image import, networking, and recovery. The planner below calculates a schedule from your inputs; it cannot predict mastery or the number of attempts you will need.

Before buying training, write down the gap it should fill. Check the provider’s current syllabus, access period, included attempts, expiry, renewal terms, and final price. OffSec’s official pricing page is a starting point for its current offers. No purchase or certification budget is required to use this comparison.

Choose a release from your current question

• Setup is the blocker: pause release selection and work through the Level 1 setup guide.
• You want to investigate web input behavior: choose 1.1 and identify its archive version.
• You want to connect application findings and credential use: choose 1.2 and verify hostname resolution first.
• You want to explain a restricted session: choose 1.3 and keep a clear capabilities-and-identity record.
• You are reviewing a familiar VM: reproduce an observation from your own notes and disclose any hints. Faster completion may reflect memorization.

The optional order 1.1 → 1.2 → 1.3 is a convenient study sequence, not a prerequisite. You can repeat a release or choose a different environment when it addresses a clearer gap.

Build a flexible routine and calculate your workload

Use three stages: investigate one question, test a supported hypothesis, then review and report. Split them across sessions if needed. End each session with the saved evidence, an unresolved question, and a resume point.

For example, schedule a short setup check, a focused investigation, and a separate reporting session. These are editorial planning suggestions, not completion deadlines. Advance when you can explain your evidence rather than when a week has elapsed.

Record the outcome before choosing another lab

Release and exact archive:
Host, hypervisor, and snapshot:
Confirmed lab target and scope:
Question investigated:
Observed evidence and saved file:
Hypothesis and prerequisites:
Actual test result and identity:
Hint or solution used:
Remediation lesson and retest idea:
Unresolved question and next session:

A failed attempt is a useful outcome when the record explains why you stopped. Keep originals outside snapshots you may restore. Share a redacted copy rather than private credentials or unrelated data.

Connect the evidence to a defensive lesson

For each confirmed finding, state the affected component, the actual impact, and a relevant fix. Examples to investigate include input handling, service permissions, unsupported software, and credential reuse. A restriction or a banner alone is not a confirmed vulnerability.

Write how you would verify the fix. Do not recommend installing an obsolete lab-era version on a production system merely because an old advisory calls it a fixed release.

Before-session checklist

Mark items you have manually reviewed. This page does not inspect the VM or save your selections.

Correct release, archive version, and host compatibility checked

Intended lab network and target identity confirmed

All adapters and routes reviewed; vulnerable VM has no unintended outward route

Snapshot and notes are ready; evidence can be retained outside the VM

One question, session length, and stopping point chosen

0 of 5 preparation items marked reviewed.

FAQ

1. Which Kioptrix box is closest to an actual OSCP+ exam machine?

None of these legacy VMs is a verified match for current exam targets. Level 1.3 is useful for restricted-shell and chained-access practice, while Windows and Active Directory need separate study. Use the official exam guide for requirements.

2. Can I skip 1.1 and 1.2 and go straight to 1.3?

Yes. Choose the release matching the question you want to investigate. If VM networking or Linux basics are the blocker, repair those first. The suggested numeric order is an editorial study option, not a prerequisite or measured difficulty ladder.

3. How many times should I repeat each Kioptrix box before exam day?

There is no measured repeat count here. Repeat when you cannot explain a step, reproduce the result from your own notes or distinguish a hint from an observation. On a later run, record what you did independently and what still needed help.

4. How does this fit with the cost and timeline of OSCP+?

Use Kioptrix to identify gaps before choosing training. Record the course objectives, current access period, included attempts, expiry and renewal terms from the official offer. There is no requirement here to complete these three VMs before buying a course.

5. What if I keep getting stuck on enumeration or privesc in these boxes?

First classify the blocker: image import, network/addressing, application behavior, or an unsupported hypothesis. Save the exact error and change one condition at a time. Use a small hint when needed, then repeat the step from your own notes; record what the hint supplied.

6. Are Kioptrix boxes enough practice for the OSCP+ exam by themselves?

No. These VMs practise Linux and web fundamentals. They do not provide complete Windows or Active Directory coverage. Compare modern course and lab content with the current exam guide; do not assume every platform or subscription includes AD environments.

Choose one learning question for your next session

Select the release matching the skill you want to investigate, check its setup notes, and open a session record. A useful first session can end with a verified setup or one well-supported observation; it does not have to end with root.

Reviewed October 24, 2026. Release-specific setup facts were checked against the linked VulnHub entries. Learning goals and schedule allowances are editorial aids. No new VM run, exploit validation, measured difficulty comparison, or exam-readiness assessment was performed for this revision.

Continue with the beginner roadmap, original Level 1 guide, or Level 3 setup guide, according to your next question.