What you get
Guided labs to learn the basics, real Linux boxes to practice on, and a live arena when you want to test yourself against another person. Everything stays in one account.
Three sides, one platform
You can spend your time on one side or move between all three. Most people start on the offensive labs and pick up the rest as they go.
Offensive (Red Team)
Learn how attackers think and work. Web exploitation, recon, privilege escalation, network pivoting — practiced on real systems with clear objectives.
Defensive (Blue Team)
Harden your own Linux box, configure firewalls and monitoring, and watch for attacks. You learn defense by trying to keep someone out, not by reading slides.
Analysis (Purple Team)
Read the logs after an engagement. Understand what worked, what didn't, and where the defender saw the attacker. Each session leaves an audit trail you can study.
Offensive training
Web exploitation labs
Guided labs that walk you through SQL injection, IDOR, broken auth, SSRF, and the rest of the OWASP top ten on real applications. Each lab has clear objectives and flags.
Linux exploitation
Get a shell on a vulnerable Linux box and walk through privilege escalation, post-exploitation, and persistence on a real system you control.
Multi-step scenarios
Longer scenarios that chain a web exploit into a shell, then a shell into root. The kind of thing a real assessment looks like, broken into objectives you can solve in pieces.
Reconnaissance
Scan, enumerate, and map the surface of your target. The labs teach you what to look for; the cyber range lets you practice against your own boxes.
PvP mode
Optional. Take on another operator who is actively defending. Both sides start with the same baseline; you win by gaining a shell on their box first.
Bring your own tools
The cyber range gives you a Linux box with full root, so you can install nmap, sqlmap, Burp, Metasploit, or whatever else you usually work with.
Defensive training
System hardening
Spin up a Debian box with full root access and harden it the way you would in production. Patch services, lock down SSH, set up a firewall, and check your work.
Attack alerts
When you opt into PvP, you get notifications the moment someone probes your box. The same plumbing lets you practice writing your own detection rules.
Threat hunting
Read the logs, spot the patterns, and trace what actually happened during an engagement. Honeypots and log analysis are part of the toolkit.
Access control
Practice the parts of admin work that catch people out: file permissions, SSH key management, MFA on services, and least-privilege configuration.
Monitoring
Hook up log aggregation and basic SIEM-style alerting on your box. The labs include scenarios where you have to set this up before the attacker arrives.
Incident response
Snapshot a compromised box for forensic analysis, then restore from a known-good state. The same tools the labs use to grade you can show you what got missed.
Analysis & review
Engagement logs
Every session leaves a full record of what happened — commands run, requests sent, where you got in and where you got stuck. Read it after to see the whole picture.
Personal stats
Track the labs you've solved, your rank tier, and the techniques you've used most. Useful for spotting gaps in your own skill set.
Forensics practice
Some labs are scored on what you find after the fact: pcaps to analyse, disk images to comb through, suspicious processes to pin down.
Community & collaboration
Global chat
A common chat for everyone on the platform. Useful for asking questions, comparing approaches, and getting unstuck on a lab.
Private channels
Direct messages and small group chats. Handy for working through a path with a friend or comparing notes after a session.
Direct PvP
If you want to face a specific person rather than match through the queue, you can challenge them directly. Both sides have to opt in.
Learn library
Articles, walkthroughs, and references that go alongside the labs. New material is added as new paths ship.
Live sessions
While a session is running
Attack notifications
In PvP, you get a real-time alert when someone touches your box. The same signal lets you check the timing and source of every probe.
Live monitoring
See your box's resource use, open connections, and recent commands without leaving the dashboard. Useful for both sides of a session.
Per-lab guidance
Each lab carries its own brief, hint chain, and link out to the relevant Learn articles. Context is always one click away.
The environment
Fully isolated
Everything happens inside our own network. Nothing you do reaches outside systems, and we monitor for misuse so the platform stays safe and legal.
Realistic targets
The labs use real services and real CVEs, not toy reproductions. The cyber range uses the same images so what you learn carries over.
No clock
Sessions don't expire mid-attempt. You can put a lab down, come back tomorrow, and pick up where you left off.
Pick a starting point
You don't have to commit to a path. Try a few labs, see what you enjoy, and follow that thread.
Offensive (Red)
If you want to learn how attacks actually work — web exploitation, recon, privilege escalation — start here.
Defensive (Blue)
If you want to learn how to keep systems safe — hardening, monitoring, incident response — start here.
Planned learning paths
Curated paths that group labs into a sensible order, so you can pick a topic and walk it end to end. New paths ship as the catalog grows.
- ▸Offensive fundamentals
- ▸Defensive fundamentals
- ▸Incident response & threat hunting
- ▸DevOps & infrastructure security