All labs
Every hands-on lab in the catalog. Prefer a guided route? Browse learning paths.
TEST: Video Edge (safe to delete)
A throwaway test edge to preview how a video renders inside a step.
Persistence: Golden & Silver Tickets
Forge Kerberos tickets for stealthy persistence — Golden Tickets from the krbtgt hash (any service, domain-wide) and Silver Tickets from a service account hash (one service) — with mimikatz and Rubeus.
DCSync & Domain Dominance
Abuse directory replication rights (DS-Replication-Get-Changes / -All) to pull the krbtgt and any account's hash straight from a DC with secretsdump -just-dc or mimikatz lsadump::dcsync — no code on the DC.
Credential Dumping (LSASS/SAM/NTDS)
Harvest secrets from the local SAM, live LSASS memory, and the domain's NTDS.dit using secretsdump and mimikatz to recover NTLM hashes and plaintext credentials.
Lateral Movement (PtH/PtT/WMI/PSExec)
Move between hosts without a cleartext password using Pass-the-Hash and Pass-the-Ticket via impacket psexec/wmiexec/smbexec and evil-winrm.
API & JWT Attacks
Attack REST APIs and JSON Web Tokens: endpoint enumeration, mass assignment, and JWT forgery via the alg:none trick and weak-HMAC cracking with jwt_tool and hashcat.
Detect C2 Beaconing
Red: launch a C2 implant that beacons back to your team server. Blue: detect the regular, low-and-slow callback pattern and tie the network connection back to the offending process.
Exploiting Databases (MySQL/MSSQL/Redis)
Attack exposed databases: weak-credential logins, dumping secrets, MSSQL xp_cmdshell command execution, and unauthenticated Redis abuse for RCE.
Command Injection
Inject OS commands through unsanitized input: chaining operators, blind detection, and out-of-band (OOB) exfiltration when there is no visible output.
ACL & Delegation Abuse
Weaponize dangerous AD object rights (GenericAll, WriteDACL, GenericWrite) and Kerberos delegation — unconstrained, constrained, and resource-based (RBCD) — using PowerView, impacket, and Rubeus S4U.
Timeline & Artifact Analysis
Build a forensic super-timeline from Windows artifacts (MFT, Prefetch, event logs, registry) with Plaso, then read it to reconstruct the full attack from initial access to objective and map each step to MITRE ATT&CK.
Detect & Respond to Ransomware Behavior
Red: run a benign ransomware simulation that mass-renames/encrypts files and deletes the shadow copies. Blue: detect the burst of file changes and the anti-recovery command, then contain the host.
Pivoting & Port Forwarding
Tunnel through a compromised host with chisel, ligolo-ng, SSH -L, and SOCKS proxies to reach and exploit an internal target you cannot route to directly.
LFI/RFI & Path Traversal
Read arbitrary files via path traversal and Local File Inclusion, pull in remote code with RFI, and escalate LFI to remote code execution through log poisoning and PHP wrappers.
Pass-the-Hash & NTLM Relay
The endgame of credential attacks: capture NetNTLMv2 challenge-responses with Responder, crack them offline (hashcat -m 5600), and when cracking fails, pass-the-hash with impacket - using the raw NT hash to authenticate without ever knowing the password.
Detecting Common Red-Team TTPs
Detect a full multi-stage red-team operation — recon to execution to persistence — across endpoint telemetry and produce the technique IDs and IOCs.
AD Password Spraying
Try one weak password across many accounts with crackmapexec to land a foothold, while respecting the domain lockout policy to avoid locking users out.
File Upload to RCE
Bypass file-upload filters (extension, content-type, magic bytes), plant a webshell, and turn an innocent upload form into full remote code execution.
Memory Forensics Basics
Acquire a memory image from a compromised Windows host and analyze it with Volatility 3: list processes, hunt for code injection with malfind, inspect network connections, and identify an injected process that disk artifacts never reveal.
Detect Lateral Movement
Red: move laterally with PsExec/WMI to execute commands on a remote host. Blue: detect the remote execution through the service the tool installs and the network logon it produces.
Manual Exploitation & Public Exploits
Find, read, and run a public exploit by hand with searchsploit: abuse a weak-credential Tomcat Manager to deploy a malicious WAR webshell and land RCE without leaning on a one-click Metasploit module.
Online Brute-Force & Password Spraying (Hydra)
When you can't get the hashes, you attack the login itself. Learn THC-Hydra for controlled online brute-force against SSH and HTTP login forms, the http-post-form failure-string syntax, and low-and-slow password spraying that flips brute force around to dodge account lockout.
Vulnerability Management with OpenVAS
Run an authenticated OpenVAS (Greenbone) scan, triage the findings by CVSS, map CVEs to remediations, and prioritize fixes by risk rather than by count.
AS-REP Roasting
Find accounts that do not require Kerberos pre-authentication (DONT_REQ_PREAUTH), grab their AS-REP with impacket-GetNPUsers, and crack it offline with hashcat mode 18200.
IDOR & Broken Access Control
Manipulate object identifiers and roles to read other users' data and reach admin-only functions: horizontal and vertical privilege escalation via IDOR and missing authorization.
Hunting in Endpoint Logs
Run a hypothesis-driven threat hunt across Sysmon endpoint telemetry to surface LOLBin abuse and anomalous parent-child process chains.
Zeek & Network Metadata
Investigate with Zeek's connection logs instead of full packets: read conn.log, dns.log, and http.log to spot C2 beaconing and DGA/tunneling DNS, and pull the IOCs that drive your hunts.
Metasploit Fundamentals
Drive msfconsole end to end: search for a module, set options, run an exploit, and operate a meterpreter session to loot the target.
Detect Kerberoasting & AD Attacks
Red: Kerberoast service accounts from Kali to crack their passwords offline. Blue: detect the burst of anomalous TGS (service-ticket) requests and the weak RC4 encryption that gives the attack away.
Vulnerability Identification
Turn the service versions you fingerprinted into concrete CVEs and confirm them with nmap --script vuln and OpenVAS.
Cracking with John & Wordlist Crafting
John the Ripper is Hashcat's CPU-first sibling and the king of unusual hash formats. Learn john's single/wordlist/incremental modes and --format, then craft targeted wordlists with cewl (scrape a site) and crunch (generate by pattern), and build Hashcat masks for structured guessing.
Broken Authentication & Session Attacks
Attack login and session handling: credential brute-forcing with Hydra, authentication logic bypasses, and exploiting weak or predictable session tokens.
Kerberoasting
Request service tickets for accounts with a Service Principal Name, then crack the RC4-encrypted TGS offline with hashcat mode 13100 to recover the service account's cleartext password.
Endpoint Forensics with Velociraptor
Use Velociraptor and its VQL query language to hunt a live Windows endpoint at scale: surface persistence (autoruns, scheduled tasks), running processes, and network artifacts, and pull out the IOCs that confirm an intrusion.
Windows Hardening & Sysmon
Harden the Windows advanced audit policy and deploy a tuned Sysmon configuration to generate high-fidelity endpoint telemetry for detection.
Intrusion Detection with Suricata
Stand up Suricata as a signature-based IDS, dissect and write detection rules, enable them, and triage the resulting alerts down to the firing SID in eve.json and fast.log.
Exploiting Vulnerable Web Services
Identify outdated middleware and server-side CVEs, then exploit Log4Shell (CVE-2021-44228) via a JNDI lookup to gain remote code execution on a Java web service.
Detection Engineering & Sigma Rules
Author a portable Sigma detection rule, convert it to your SIEM's query language, deploy it, and validate that it actually fires on real telemetry.
Web & DNS Enumeration
Brute-force directories, virtual hosts, and subdomains with gobuster and ffuf, and pull DNS apart with dig, dnsenum, and zone transfers.
Cross-Site Scripting (XSS)
Inject JavaScript into web apps via reflected, stored, and DOM-based XSS, then weaponize it to steal session cookies and hijack accounts.
Cracking with Hashcat
Hashcat is the world's fastest password recovery tool. Learn the two attacks you reach for daily - straight dictionary (-a 0) and rule-based mangling - against NTLM and MD5 using the rockyou wordlist, plus how to read --show, --status, and the potfile.
Detect a Web-Exploit Chain
Red: drop a webshell through a file-upload exploit. Blue: detect the exploitation attempt and the tell-tale child process the web service spawns when the shell runs.
BloodHound & Attack Paths
Collect AD relationship data with SharpHound, ingest it into BloodHound, and follow the graph to find the shortest path from your foothold to Domain Admin.
Linux Hardening & Baselining (CIS, Lynis)
Audit a Linux host with Lynis, read its hardening index, and remediate toward a CIS Benchmark baseline by fixing SSH, kernel, and auth controls.
Packet Analysis with Wireshark
Dissect a malicious packet capture in Wireshark: build display filters, follow TCP/HTTP streams, and extract IOCs like exfil destinations and malware User-Agents.
Windows Event-Log Analysis
Read Windows like an analyst: reconstruct a complete logon-plus-process-execution sequence from the Security and Sysmon event logs, distinguishing normal activity from an attacker's footprints.
Port & Service Scanning with Nmap
Enumerate open ports and fingerprint the services behind them: TCP connect vs SYN scans, UDP, version detection, and default NSE scripts.
Incident Response Process & Triage
Walk the NIST/PICERL incident-response lifecycle and perform first-responder triage of a compromised Windows host: where to look, what to collect, and how to spot a rogue process and persistence.
FTP, SSH & Telnet Attacks
Abuse anonymous FTP, grab service banners on FTP/SSH/Telnet, and brute-force login credentials with Hydra to gain a remote shell.
Alert Triage & Investigation
Work a fired alert end to end the way a Tier-1 analyst does: pivot from the alert to the host, to the process, to a verdict - extracting IOCs and reaching a defensible disposition.
Automated Enumeration (LinPEAS/WinPEAS/pspy)
Run linpeas, winpeas, and pspy to triage privilege-escalation misconfigurations at speed, read their colour-coded output, and confirm one concrete escalation on each OS.
Dashboards & Alerting
Turn raw events into actionable signal: build a Wazuh dashboard for visibility and write a custom detection rule that fires when a condition you define is met.
Building a SIEM with Wazuh
Stand up a Wazuh SIEM from scratch: deploy the manager, enroll a Linux and a Windows agent, and confirm that events are flowing and being decoded end to end.
SOC Fundamentals & Log Sources
Learn what a Security Operations Center does and get fluent in the canonical log sources every analyst lives in: authentication logs, Sysmon, firewall, and web server logs - and the specific events that actually matter.
Windows Privesc: Unquoted Paths & DLL Hijacking
Exploit an unquoted service path with a writable intermediate directory, and abuse Windows DLL search order to drop a malicious DLL a privileged process loads, both leading to SYSTEM.
MITRE ATT&CK for Defenders
Map adversary behaviors to MITRE ATT&CK tactics and techniques, and use the matrix to measure and close detection coverage gaps.
Windows Privesc: Tokens & UAC Bypass
Abuse SeImpersonatePrivilege with the Potato family and PrintSpoofer to impersonate SYSTEM from a service account, then bypass UAC to elevate an admin-but-filtered token to high integrity.
SQL Injection
Exploit SQL injection from the ground up: error-based extraction, UNION-based data dumping, and blind boolean/time techniques, then automate the whole thing with sqlmap.
Hashing & Identifying Hashes
Before you can crack a credential you have to know what it is. Learn to fingerprint MD5, SHA-family, NTLM, and bcrypt hashes by length and structure, and confirm with hashid and hash-identifier so you pick the right Hashcat/John mode every time.
Windows Privesc: Services & Registry
Escalate to SYSTEM on Windows by abusing a service whose binary or configuration a standard user can modify, and by weaponizing the AlwaysInstallElevated registry policy via a crafted MSI.
Linux Privesc: Kernel & Vulnerable Services
When config is locked down, the code itself is the target: identify the kernel/service version and exploit a known flaw such as PwnKit (CVE-2021-4034) in Polkit's pkexec to get root.
AD Fundamentals & Enumeration
Learn the building blocks of Active Directory — domains, forests, OUs, groups, and SIDs — then enumerate a target domain with crackmapexec, ldapsearch, and enum4linux-ng.
Active Host Discovery
Find which hosts are actually alive using ICMP, ARP, and TCP ping sweeps with Nmap's host-discovery (-sn) mode.
Linux Privesc: cron, PATH & Capabilities
Escalate to root three ways: hijack a writable root cron script, abuse a relative-PATH lookup in a privileged binary, and exploit a file with cap_setuid set.
Linux Privesc: SUID & sudo
Turn a low-privileged shell into root by abusing SUID-root binaries via GTFOBins and exploiting misconfigured (NOPASSWD) sudo rules.
SMB Enumeration & Exploitation
Enumerate SMB null sessions, shares, and users with enum4linux and smbclient, locate sensitive shares, then exploit a vulnerable SMB service for a shell.
Web Recon & Content Discovery
Map a web app's attack surface: brute-force directories and virtual hosts with gobuster/ffuf, mine robots.txt, and loot an exposed .git directory.
Passive Recon & OSINT
Gather a target's footprint without touching it: WHOIS, DNS records, certificate transparency, Google dorks, and document metadata.
Bash & Scripting Basics for Offense
Turn the shell into a weapon: variables and quoting, pipes and redirection to parse tool output, loops and conditionals for host sweeps, and writing your first recon one-liner.
Using the Purple Edge Lab
Get comfortable with the Purple Edge lab: what an ephemeral, locked playground is, how to connect over VPN and the web console, how to find your Kali box's lab IP, and the etiquette of a shared training environment.
Networking & Protocols for Attackers
See the network the way an attacker does: IP addressing and ports, TCP vs UDP, the protocols and default ports you'll meet on every engagement, and how to inspect live connections.
Linux Command Line for Hackers
Master the Linux shell from an attacker's seat: navigate the filesystem, read and search files, understand permissions, and combine tools to hunt for secrets.
Linux File Permissions 101
Learn how Linux file permissions work — read/write/execute, owner/group/other, and how to read and change them with chmod and chown.