Home › Lab
Lab
Hands-on cybersecurity labs — guided walkthroughs you can follow start to finish, plus curated external ranges worth your weekend. Everything here runs against legal targets: deliberately vulnerable machines and platforms built to be attacked.
New to this? Follow the guided ladder. Lab 00 sets up your practice environment in about twenty minutes, Lab 01 runs your first scan, then the OverTheWire series takes you from your first shell through your first web hacking one small step at a time — each a copy-paste walkthrough with progress you can track.
Working on AI? The LLM security lab spins up a deliberately vulnerable model on your own machine and walks the OWASP LLM Top 10 — prompt injection, system-prompt leakage, excessive agency.
Want a bigger playground? The curated entries below point to ranges like Hack The Box, LetsDefend and GOAD — honestly labelled, no fluff.
Lab 02 — Bandit 0 to 5: your first shell on someone else’s machine
BeginnerTime ~45 minTarget OverTheWire BanditLevels 0 → 5Needs a terminal 0 / 6 steps The goal By the end of this you will have connected to…
Lab 01 — Your First Scan
BeginnerTime ~25 minTool nmapTarget scanme.nmap.orgNeeds Lab 00 0 / 5 steps Where you are allowed to point this. The target in this lab, scanme.nmap.org, is a…
Lab 00 — Set Up Your Lab
Start from a laptop with nothing installed and finish with a safe, self-contained Kali machine you can practise in. No prior setup assumed — every click…
Hack The Box
Hands-on platform for security training and practice. Offers a mix of capture-the-flag challenges, vulnerable machines, and labs across web, network, and system topics. Useful for building…
PentesterLab
Hands-on platform for learning web application security through realistic vulnerable code and documented CVEs. Covers exploitation techniques and code review methodology. Useful for developers who want…
PentesterLab — Recon badge (free)
A hands-on lab covering reconnaissance fundamentals: file discovery, DNS enumeration, TLS certificate analysis, and target surface mapping. Designed for people building recon skills from scratch. Free…
Kubernetes Goat — vulnerable K8s cluster
Kubernetes Goat is a deliberately vulnerable cluster built for security training. It gives you a sandboxed environment where you can practice attacking and defending Kubernetes setups…
LetsDefend — SOC analyst simulations
Hands-on platform where you run through SOC workflows: alert triage, log analysis, incident response. Built around realistic scenarios rather than multiple choice. Good for people learning…
MobileHackingLab — free mobile labs
Hands-on lab environment for mobile security testing. Covers beginner-to-advanced scenarios including pentesting and injection attacks. Free tier available, browser-based access, good for building practical skills without…
PAYGoat — vulnerable FinTech app
Deliberately vulnerable banking app designed to teach business logic exploitation. Walk through common flaws in payment systems, authentication, and fund transfers in a controlled environment. Good…