All labs
Every hands-on lab in the catalog. Prefer a guided route? Browse learning paths.
XML External Entity (XXE) Injection
Abuse an XML parser that resolves external entities to read files off the server.
Unconstrained Delegation
Abuse a host trusted for unconstrained delegation to capture the domain controller's ticket and own the domain.
Resource-Based Constrained Delegation (RBCD)
Abuse a write over a computer object to configure delegation to it and take it over.
NTLM Relay
Relay a captured authentication to a host that does not require SMB signing and gain admin without cracking anything.
LLMNR and NBT-NS Poisoning
Poison broadcast name resolution to capture a NetNTLMv2 authentication and crack it offline.
Insecure Deserialization
Turn an untrusted serialized object into code execution on the server.
Cross-Site Request Forgery (CSRF)
Force a victim's browser to submit a state-changing request they never intended.
Constrained Delegation (S4U)
Abuse an account allowed to delegate to a service so you can impersonate any user to that service.
Abusing Windows Token Privileges
Use a dangerous token privilege such as SeImpersonate or SeBackup to become SYSTEM.
Abusing Windows Service Misconfigurations
Turn a weak service permission, unquoted path, or writable binary into code execution as SYSTEM.
Windows Privilege Escalation: Enumeration
Enumerate a Windows host for the service, permission, and token weaknesses that lead to SYSTEM.
Capstone: Windows Foothold to SYSTEM
From a low-privileged Windows shell, enumerate and escalate to SYSTEM by whichever path the host offers.
Abusing SUID and SGID Binaries
Use a SUID binary's own features to run commands as its owner, usually root.
Exploiting Sudo Misconfigurations
Turn a too-generous sudo rule into a root shell using the allowed program's own features.
Deep Service Enumeration
Go past the port scan: interrogate each service to learn exactly what it is and how to attack it.
Capstone: Map the Attack Surface
Combine passive and active recon into a single prioritised attack-surface map of an organisation.
Password Spraying and Credential Stuffing
Attack many accounts with a few likely passwords, staying under lockout thresholds.
Passive Recon and OSINT
Build a picture of a target from public sources alone, without sending a single packet to their infrastructure.
Offline Password Cracking
Recover plaintext passwords from captured hashes using wordlists, rules, and masks.
Capstone: Breach the Network
From an external position, enumerate the hosts, find the weak service, and gain your first shell inside.
Linux Privilege Escalation: Enumeration
Systematically enumerate a Linux host to find the one misconfiguration that gets you to root.
Capstone: Foothold to Root
From a low-privileged shell, enumerate and escalate to root by whichever path the host offers.
Kernel Exploits and Linux Capabilities
When configuration is clean, an outdated kernel or a dangerous file capability can still hand you root.
Forging Golden Tickets
With the krbtgt hash you can forge a Ticket Granting Ticket for any user, granting durable domain-wide access.
Exploiting Vulnerable Service Versions
Match an outdated service to a known vulnerability and use a public exploit safely to gain access.
Capstone: Full Domain Compromise
Chain everything you learned into one end-to-end path from a low-privileged foothold to durable domain dominance.
DNS and Subdomain Enumeration
Map an organisation's external footprint by discovering its subdomains and DNS records.
DCSync: Replicating Secrets from the Domain
Impersonate a domain controller's replication and pull password hashes, including krbtgt, straight from the directory.
Attacking Exposed Database Services
Turn an unauthenticated or weakly-secured database into data theft and, often, code execution on the host.
Capstone: From Hashes to Access
Given captured material and a login portal, recover a working credential and get in.
Credential Attack Fundamentals
Understand how passwords are stored and the difference between the online and offline attacks against them.
AS-REP Roasting
Recover crackable material for accounts that do not require Kerberos pre-authentication.
ADCS ESC1: Certificate Template Privilege Escalation
Abuse a misconfigured certificate template that lets a low-privileged user request a certificate as anyone.
Active Directory and Kerberos Fundamentals
The mental model an attacker needs: domains, forests, principals, and how Kerberos authentication actually works.
Active Directory Enumeration Basics
Map a Windows domain from a low-privileged foothold: users, groups, computers, and the service accounts that matter.
Active Service Discovery
Scan discovered hosts to find live services, versions, and the ones worth attacking.
Abusing Active Directory ACLs
Turn a dangerous access-control entry, like GenericAll or WriteDacl, into control of a privileged object.
Web Application Recon and Mapping
Fingerprint a web application and map its attack surface before you touch a single payload.
Capstone: Chain to Server Compromise
Combine recon, injection, and an upload or SSRF into a single chain that ends in code execution.
Triage and Live Response
Collect volatile evidence from a live host without trampling the scene.
Threat Hunting Fundamentals
Hunt proactively: form a hypothesis about attacker behaviour and go looking before an alert fires.
Capstone: Find the Undetected Intrusion
An adversary is in the environment and no alert fired. Hunt them down and hand the finding to detection engineering.
SSRF and Cloud Metadata Abuse
Make the server fetch a URL of your choosing and reach the cloud metadata service to steal credentials.
Capstone: Work a Live Intrusion
Take a fresh alert and run the full SOC workflow to scope an intrusion and recommend containment.
SIEM Fundamentals for the SOC
Understand what a SIEM does, how events flow through it, and where a detection actually lives.
Reverse Engineering Fundamentals
Read a compiled binary: static and dynamic analysis, the disassembly, and finding the logic that matters.
Analysing Process Injection
How code runs inside another process, and the artifacts each injection technique leaves for an analyst.
Post-Exploitation Fundamentals
You have a shell. Now establish situational awareness and operate without tipping off the defenders.
Capstone: Foothold to Objective
From a single foothold, persist, move laterally, and reach the objective while a blue team watches.
Phishing and Social Engineering Fundamentals
Why phishing works, the psychology it exploits, and the controls that stop it, studied in an isolated sandbox.
Email Authentication and Its Gaps
How SPF, DKIM, and DMARC stop spoofing, and the gaps attackers exploit when they are misconfigured.
Capstone: Run and Defend a Simulated Campaign
Run an authorised phishing simulation in the sandbox, measure it, and turn the results into concrete defences.
Establishing and Detecting Persistence
Survive a reboot the way attackers do, and learn exactly how each mechanism is hunted.
Obfuscation, Packing and Loaders
How payloads hide from static detection, and how an analyst unpacks and understands them anyway.
Mobile Static Analysis
Decompile a mobile app and read its code and resources for hardcoded secrets and weak logic.
Capstone: Assess a Mobile App End to End
Given only the app package, find the flaw that lets you access another user's account.
Mobile Dynamic Analysis and Traffic Interception
Run the app, intercept its API traffic, and inspect what it stores on the device.
Mobile Application Security Fundamentals
How mobile apps are built and where their security actually lives: the device, the app package, and the API behind it.
Memory Forensics
Analyse a memory image to find hidden processes, injected code, and network activity that disk cannot show.
Memory Corruption Basics
How a buffer overflow works: the stack, saved return address, and turning a crash into control of execution.
Offensive Tooling: Understand to Defend
How custom offensive tools are structured, and the telemetry each stage generates for defenders.
Capstone: Analyse a Custom Implant
Reverse and analyse an unknown custom tool end to end, then write the detection that catches it.
Onboarding Log Sources
Get the right telemetry into the SIEM: which sources matter, how to ship them, and how to confirm coverage.
Lateral Movement
Use recovered credentials to move from your foothold to another host, and see the trail it leaves.
Attacking IoT and OT Protocols
Abuse the unauthenticated control protocols that IoT and industrial devices speak.
IoT and OT Security Fundamentals
The attack surface of embedded and operational-technology devices, and why they are so exposed.
Capstone: Compromise the Connected Device
From the network, analyse a device's firmware and abuse its protocol to take control of it.
IAM Privilege Escalation
Chain permissive IAM permissions to grant yourself more access, up to full account control.
Firmware Extraction and Analysis
Unpack a device's firmware and analyse it for secrets, backdoors, and vulnerable components.
Modern Exploit Mitigations
Why yesterday's exploit no longer works: DEP, ASLR, stack canaries, and the ideas that get around them.
Capstone: Write a Working Exploit
Reverse a vulnerable program, find the bug, and build a reliable exploit that gains code execution.
Evasion Techniques and Their Detection
The families of evasion that blind endpoint sensors, and the telemetry that still catches each.
Capstone: Catch What Evaded the EDR
An intrusion slipped past the endpoint product. Reconstruct it from the telemetry the evasion did not blind, and harden the detection.
How EDR Works
The telemetry sources and hooks a modern endpoint detection product uses to see what runs on a host.
Disk and Timeline Forensics
Recover artifacts from a disk image and build a super-timeline that orders the attacker's actions.
DFIR Fundamentals
The incident-response process and the order of volatility that decides what you collect first.
Capstone: Reconstruct the Intrusion
Given a compromised host, run the full DFIR process to reconstruct the attack and produce the key findings.
Writing Detection Rules
Turn a known attacker behaviour into a detection that fires on the real thing and stays quiet otherwise.
Cross-Site Scripting (XSS)
Get the application to run your JavaScript in another user's browser and steal their session.
Cloud Credential Theft
Find and abuse the many places cloud credentials leak: code, metadata, environments, and misconfigured storage.
Cloud Attacker Fundamentals
How cloud identity and access work, and why misconfigured IAM, not exploits, is the usual way in.
Capstone: Take Over the Cloud Account
From a single leaked credential, enumerate, steal more, and escalate IAM to full account control.
Hunting Specific ATT&CK Techniques
Take a named MITRE ATT&CK technique and build a repeatable hunt for it across your estate.
Alert Triage and Investigation
Work an alert like a SOC analyst: scope it, decide true or false positive, and reconstruct what happened.
TEST: Video Edge (safe to delete)
A throwaway test edge to preview how a video renders inside a step.
Persistence: Golden & Silver Tickets
Forge Kerberos tickets for stealthy persistence — Golden Tickets from the krbtgt hash (any service, domain-wide) and Silver Tickets from a service account hash (one service) — with mimikatz and Rubeus.
DCSync & Domain Dominance
Abuse directory replication rights (DS-Replication-Get-Changes / -All) to pull the krbtgt and any account's hash straight from a DC with secretsdump -just-dc or mimikatz lsadump::dcsync — no code on the DC.
Credential Dumping (LSASS/SAM/NTDS)
Harvest secrets from the local SAM, live LSASS memory, and the domain's NTDS.dit using secretsdump and mimikatz to recover NTLM hashes and plaintext credentials.
Lateral Movement (PtH/PtT/WMI/PSExec)
Move between hosts without a cleartext password using Pass-the-Hash and Pass-the-Ticket via impacket psexec/wmiexec/smbexec and evil-winrm.
ACL & Delegation Abuse
Weaponize dangerous AD object rights (GenericAll, WriteDACL, GenericWrite) and Kerberos delegation — unconstrained, constrained, and resource-based (RBCD) — using PowerView, impacket, and Rubeus S4U.
Pass-the-Hash & NTLM Relay
The endgame of credential attacks: capture NetNTLMv2 challenge-responses with Responder, crack them offline (hashcat -m 5600), and when cracking fails, pass-the-hash with impacket - using the raw NT hash to authenticate without ever knowing the password.
Detecting Common Red-Team TTPs
Detect a full multi-stage red-team operation — recon to execution to persistence — across endpoint telemetry and produce the technique IDs and IOCs.
AD Password Spraying
Try one weak password across many accounts with crackmapexec to land a foothold, while respecting the domain lockout policy to avoid locking users out.
File Upload to Remote Code Execution
Abuse a permissive upload feature to place a web shell and run commands on the server.
Online Brute-Force & Password Spraying (Hydra)
When you can't get the hashes, you attack the login itself. Learn THC-Hydra for controlled online brute-force against SSH and HTTP login forms, the http-post-form failure-string syntax, and low-and-slow password spraying that flips brute force around to dodge account lockout.
Vulnerability Management with OpenVAS
Run an authenticated OpenVAS (Greenbone) scan, triage the findings by CVSS, map CVEs to remediations, and prioritize fixes by risk rather than by count.
AS-REP Roasting
Find accounts that do not require Kerberos pre-authentication (DONT_REQ_PREAUTH), grab their AS-REP with impacket-GetNPUsers, and crack it offline with hashcat mode 18200.
Hunting in Endpoint Logs
Run a hypothesis-driven threat hunt across Sysmon endpoint telemetry to surface LOLBin abuse and anomalous parent-child process chains.
Cracking with John & Wordlist Crafting
John the Ripper is Hashcat's CPU-first sibling and the king of unusual hash formats. Learn john's single/wordlist/incremental modes and --format, then craft targeted wordlists with cewl (scrape a site) and crunch (generate by pattern), and build Hashcat masks for structured guessing.
Kerberoasting Service Accounts
Request Kerberos service tickets for accounts with an SPN and crack them offline to recover the service account password.
Windows Hardening & Sysmon
Harden the Windows advanced audit policy and deploy a tuned Sysmon configuration to generate high-fidelity endpoint telemetry for detection.
Detection Engineering & Sigma Rules
Author a portable Sigma detection rule, convert it to your SIEM's query language, deploy it, and validate that it actually fires on real telemetry.
Cracking with Hashcat
Hashcat is the world's fastest password recovery tool. Learn the two attacks you reach for daily - straight dictionary (-a 0) and rule-based mangling - against NTLM and MD5 using the rockyou wordlist, plus how to read --show, --status, and the potfile.
Finding Attack Paths with BloodHound
Turn raw directory data into a graph and let it compute the shortest path from your foothold to Domain Admin.
Linux Hardening & Baselining (CIS, Lynis)
Audit a Linux host with Lynis, read its hardening index, and remediate toward a CIS Benchmark baseline by fixing SSH, kernel, and auth controls.
Windows Event-Log Analysis
Read Windows like an analyst: reconstruct a complete logon-plus-process-execution sequence from the Security and Sysmon event logs, distinguishing normal activity from an attacker's footprints.
Alert Triage & Investigation
Work a fired alert end to end the way a Tier-1 analyst does: pivot from the alert to the host, to the process, to a verdict - extracting IOCs and reaching a defensible disposition.
Dashboards & Alerting
Turn raw events into actionable signal: build a Wazuh dashboard for visibility and write a custom detection rule that fires when a condition you define is met.
Building a SIEM with Wazuh
Stand up a Wazuh SIEM from scratch: deploy the manager, enroll a Linux and a Windows agent, and confirm that events are flowing and being decoded end to end.
SOC Fundamentals & Log Sources
Learn what a Security Operations Center does and get fluent in the canonical log sources every analyst lives in: authentication logs, Sysmon, firewall, and web server logs - and the specific events that actually matter.
MITRE ATT&CK for Defenders
Map adversary behaviors to MITRE ATT&CK tactics and techniques, and use the matrix to measure and close detection coverage gaps.
SQL Injection
Turn an unsanitised query parameter into a full read of the application's database.
Hashing & Identifying Hashes
Before you can crack a credential you have to know what it is. Learn to fingerprint MD5, SHA-family, NTLM, and bcrypt hashes by length and structure, and confirm with hashid and hash-identifier so you pick the right Hashcat/John mode every time.
AD Fundamentals & Enumeration
Learn the building blocks of Active Directory — domains, forests, OUs, groups, and SIDs — then enumerate a target domain with crackmapexec, ldapsearch, and enum4linux-ng.
Bash & Scripting Basics for Offense
Turn the shell into a weapon: variables and quoting, pipes and redirection to parse tool output, loops and conditionals for host sweeps, and writing your first recon one-liner.
Using the Purple Edge Lab
Get comfortable with the Purple Edge lab: what an ephemeral, locked playground is, how to connect over VPN and the web console, how to find your Kali box's lab IP, and the etiquette of a shared training environment.
Networking & Protocols for Attackers
See the network the way an attacker does: IP addressing and ports, TCP vs UDP, the protocols and default ports you'll meet on every engagement, and how to inspect live connections.
Linux Command Line for Hackers
Master the Linux shell from an attacker's seat: navigate the filesystem, read and search files, understand permissions, and combine tools to hunt for secrets.
Linux File Permissions 101
Learn how Linux file permissions work — read/write/execute, owner/group/other, and how to read and change them with chmod and chown.