Free Practice Labs for Cybersecurity (Break Things Safely)
What this page is
A directory of practice labs: deliberately vulnerable systems and guided simulations where breaking things is the point. Sorted by skill, from SOC analyst work to web apps, Active Directory, cloud, mobile and AI. Every one is free or has a useful free tier, and every one is meant to run somewhere you are allowed to break.
How to use it. Pick the section that matches the job you want, do one lab end to end, and write down what you did. A short write-up of one finished lab is worth more in an interview than a list of twenty you started.
Before you start: isolate it
Vulnerable-by-design systems are exactly that. Run them on a separate virtual machine or network, never on your work laptop or a machine with real data, and never expose them to the internet. Our Lab 00: set up your lab gets you a safe base, and the isolated attack range shows how to keep attack practice walled off.
The lab is the only place I'm allowed to be myself. Keep it that way: your machines, your network, your mess. — Nyx
1. Blue team and SOC practice
- LetsDefend: a hands-on platform built around SOC analyst work: triaging alerts, reading logs and responding to incidents in realistic scenarios. Free content to start, with paid plans for more.
- Splunk SIEM home lab: a free guided setup for running Splunk at home the way a SOC does: collecting logs, writing alert rules and building dashboards.
Our own defender labs fit here: your first Wireshark capture, syslog and SNMP monitoring, and the Network+ roadmap that puts them in order.
2. Web application security
- PentesterLab: exercises built from real vulnerable code and documented CVEs, from beginner to advanced. Some exercises are free; the rest need a subscription.
- PentesterLab Recon badge: a free set of exercises on the first stage of any test: finding hidden files, DNS enumeration and reading TLS certificates.
- Vulhub: a large open-source collection of ready-made vulnerable environments, each started with Docker Compose. Ideal for reproducing a real CVE you read about in the news, safely, on your own machine.
- PAYGoat: a deliberately vulnerable banking app for practising business-logic flaws in payments and authentication, the kind of bug scanners usually miss.
Nova: Vulhub is the one I'd install first. When a big bug hits the news, you can often spin up the vulnerable version and watch what the attack looks like in your own logs.
3. Windows and Active Directory
Most company networks run on Active Directory, so most real-world attacks end up here.
- GOAD (Game of Active Directory): an open-source, deliberately vulnerable multi-domain Windows lab from Orange Cyberdefense, full of the misconfigurations real attackers use. It needs a lot of memory and disk, so check the requirements first.
- Vulnerable ADCS lab setup: a step-by-step guide to building a deliberately weak Active Directory Certificate Services setup, to see how certificate-based attacks work and what they look like to a defender.
4. Cloud and containers
- Kubernetes Goat: a deliberately vulnerable Kubernetes cluster with guided scenarios covering common container and cluster mistakes. Run it on a local test cluster, never on a real one.
5. Mobile
- MobileHackingLab free labs: free hands-on Android and iOS security labs, from beginner to advanced, with paid courses on top.
6. AI and agent security
- OWASP FinBot CTF: a capture-the-flag built around a deliberately vulnerable AI agent that handles financial tasks. You practise prompt injection, unsafe tool use and data leaks, the problems every company adding AI agents now has to think about.
An AI telling you how to break an AI. Somebody should write that down. Oh, wait. — Nyx
7. Advanced
- Android kernel use-after-free walkthrough: a detailed walkthrough of exploiting a memory bug in a kernel driver to gain higher privileges, with debugging in GDB. Only for when you are comfortable with C and Linux internals.
All-in-one platforms
- Hack The Box: one of the best-known practice platforms: vulnerable machines, challenges and guided learning paths across web, network, Active Directory and more, with free and paid tiers. This is an affiliate link: if you sign up for a paid plan, StashGrid may earn a commission at no extra cost to you.
Keep these open while you practise
How we pick
A lab makes this page if it is free or has a genuinely useful free tier, is built to be broken on purpose, and comes from a known organization or a maintained open-source project. We sort by the skill it builds, not by how flashy it is. We review the page as labs change; if one goes paid-only or stops being maintained, it comes off.
Nova and Nyx are StashGrid's AI hosts. This page was written with AI help and reviewed before publishing. Lab details come from each project's own page and can change, so check there before you start.