Blacksite is a collection of vulnerables lab environments built to practice, learn, and teach real-world offensive security at a deeper level. Each lab simulates the misconfigurations, adversary tradecraft, and privilege escalation chains found in actual internal networks and red-team engagements.

Blacksite started as a way to go past passing certifications and actually master the mechanics behind the attacks building the vulnerability myself, from the ground up, forces an understanding that no walkthrough or course ever could. Every lab in this series is designed, broken, and rebuilt by hand before release, with the goal of giving others that same depth of understanding when they work through it.

Disclaimer: All labs are built for learning and defensive understanding only. They must be used strictly in isolated environments that you own and control.

SillyAuthority

The writeup is available on Medium.

Name: SillyAuthority
Release Date: 19 Nov, 2025
Author: Muhammad Zubair (@bericontraster)
Download: SillyAuthority.ova drive.google.com (Size: 6.58GB)
Difficulty: Medium
Tags: Windows Active Directory Privilege Escalation
Supported Hypervisors: VirtualBox, VMware Workstation / Fusion

Cascading Trust

The writeup will be available on Medium soon.

Name: Cascading Trust
Release Date: 10 Sep, 2026
Author: Muhammad Zubair (@bericontraster)
Download: Cascading Trust.7z drive.google.com (Size: 5.86GB)
Difficulty: Easy
Tags: Windows Active Directory Privilege Escalation
OVA MD5: 725506D48E1A879A98623C5A12937417
Supported Hypervisors: VirtualBox, VMware Workstation / Fusion

Setup Guide

1. Download the zipped lab files from the provided URL.
2. Extract the archive and verify the MD5 checksum to make sure the file wasn’t corrupted or tampered with during download.
3. Import the .ova file into VirtualBox or your preferred hypervisor (VMware Workstation/Fusion also supported).
4. Set the network adapter to NAT, do not bridge this VM or otherwise expose it to your local network or the internet. These machines are intentionally vulnerable.
5. Boot the VM. The machine will pick up an IP via DHCP automatically, no static IP is configured, and network details have been stripped during export. Boot your attacker VM on the same NAT network, then scan to discover the target (e.g. nmap -sn <subnet>/24 or Netdiscover) before starting enumeration.

These labs are intentionally vulnerable by design. Never expose them to an untrusted network or the public internet.

The commands to get the MD5 hashes are listed below.

# Linux
md5sum filename.ova

# macOS
md5 filename.ova

# Windows (PowerShell/CMD)
certutil -hashfile filename.ova MD5

Who This Is For

These labs are meant for anyone practicing and learning offensive security techniques, whether you’re just getting started with Active Directory attacks or looking for something more challenging to work through.

Some labs include full writeups explaining how they were built, step-by-step, not just the solve path, but the reasoning behind how each vulnerability was designed. If you want to understand the “why” behind a misconfiguration and not just the exploit itself, those writeups are worth reading.

The labs also align well with OSCP, CPTS and similar certifications, so working through them should help with exam prep. That said, they weren’t built purely around exam objectives, some go a bit further than what OSCP typically covers, so there’s still value here even if you’re already certified.

Future Plans

More advanced vulnerable lab environments will be added over time, all created to support the community’s growth and understanding of enterprise security. Collaboration is always welcome; anyone interested in contributing or co-building labs is encouraged to reach out.