Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

Apache License HitCount

Hackits for javascript, PHP, HTML, password cracking, wifi cracking and more

About (or oxfat it you prefer) is a password-riddle (so called hackit) site. You could say it's Project Euler for it security or IT in general. This is a tribute site to the old Starfleet Academy Hackits site which has been offline for many years now.


It's licensed under GPL3 which means you can copy, sell, change 0xfat but all changes have to be public (also open source) and your code must be released under GPL3 as well.

What do I need to host my own instance?

The easy way using docker Docker

Run docker run --rm --name 0xf -p 8080:80 hascheksolutions/ and point your browser to http://localhost:8080

The harder way

  • A webserver running Apache or nginx
  • PHP 7.2 or higher
  • NodeJS for the TCP server levels
  • A (sub) domain
  • No database needed
  1. Download this repo:
  2. Unpack it to your web folder
  3. rename inc/ to inc/ and set the SALT value to some random string (used for user data encryption)
  4. Add a cronjob to start the TCP servers on reboot: @reboot cd /var/www/0xf/tcp_servers; ./

How to create your own level

  1. Go to data/levels and find the highest level.
  2. Make a copy of data/levels/template.php and rename it to data/levels/hackit<new level number>.php (eg. hackit36.php)
  3. Edit your level and test it on your site

You can make a pull request if you want your level on the official site.

Easy development

0xf supports development using the PHP-integrated webserver. So you can just download the code and from the main directory run php -S localhost:8080 and point your browser to http://localhost:8080


  • The site was originally created to be used by computer science teachers only. The creator Christian Haschek stated in his blog that hackits are the first thing he teaches new classes to spark flames for computer science and security.
  • The name 0xfat was actually a coincidence as the creator wanted to buy a short URL because he wanted to make short domains for his projects. Later this seemed unnecessary for him and he implemented his idea of a hackit site for his students under this domain.
  • Users can't change or recover their passwords because the site uses the user password to encrypt a text file which contains all info about a user. If a password is lost, there is no way (other than brute force) to recover the stats.