Vulnerable machines you can actually break.

A complete operating system — Linux, Windows, or a small Active Directory forest — deliberately built with a chain of real misconfigurations and vulnerabilities in it. You get a network address and nothing else. The work is the same work a penetration test is: enumerate what is listening, find the way in, get a shell as an unprivileged user, then escalate to root or Domain Admin.

There is no walkthrough running alongside you and no next button. A machine is solved when you produce the two flags that prove you actually got user and then root on it, which is a claim that cannot be made by following along. Writeups exist, and unlock automatically once you have solved a box yourself.

Yes, and it is the only place you should. Every machine runs sandboxed under gVisor and network-segmented from every other user's instance, so an exploit cannot reach another competitor, the platform, or anything outside the lab. Attacking systems you do not have written permission to test is a criminal offence in most countries — the point of a lab is that the permission is already given.

A very easy or easy Linux box. They are built to be solved with nmap, a web exploit you can find by reading the application, and a privilege escalation that a standard enumeration script will point at. Windows and Active Directory boxes assume you already know what a shell looks like.

No. Every machine's flags are unique to you: they are HMAC-signed against your own user and your running instance, so a flag someone else was given simply does not verify against your solve. There is no shared answer key to pass around — the only way to get your flag is to actually root your box.

You need something to attack from — Kali or Parrot in a virtual machine is the usual answer, and both ship with everything these boxes require. You connect to the lab network over WireGuard; the configuration file is generated for you once you have an account.