Real Kali Linux tooling in your browser. Hands-on labs, guided paths and expert courses that take you from curious to operator.
Free to start
No credit card needed
0+
Courses
0+
Kali Linux Tools
0+
CTF Challenges
0+
Challenge Formats
Real-world CTF challenges — web security, cryptography, forensics, reverse engineering, and network hacking.
You've found a command injection vulnerability on a server. **Question:** What netcat command would you use to set up a listener on port 4444 to catch a reverse shell? The flag is the exact netcat command (common format). **Flag format:** CYBERLAB{nc_<options>_<port>} **Note:** This is educational - never use against systems without permission!
The login page at `vuln.cyberlab.local/login` is vulnerable to SQL injection. **Your mission:** 1. Bypass the login without knowing credentials 2. Access the admin dashboard 3. Find the flag displayed after successful login **Remember the classic:** ``` Username: admin'-- Password: anything ``` Think about how SQL queries work and how to manipulate them.
A file was found on a suspect's computer. The investigator says there might be something hidden inside. **File location:** `/challenges/stego/hidden.jpg` Or use this simulated scenario: The flag is hidden using ROT13 encoding in this text: ``` PLOOREYN0{e0g13_vf_whfg_n_fuvsg} ``` **Note:** ROT13 shifts each letter by 13 positions in the alphabet. Find and submit the hidden flag.
The web server at `web.cyberlab.local` has a hidden admin panel. **Your mission:** 1. Use directory enumeration to find hidden paths 2. Locate the admin panel 3. Find the flag in the admin page **Tools to use:** dirb, gobuster, or nikto Remember: Common paths include /admin, /administrator, /login, /backup, etc.
During a penetration test, you found a password hash in the database: ``` 5f4dcc3b5aa765d61d8327deb882cf99 ``` **Your mission:** 1. Identify the hash type 2. Crack the hash 3. The cracked password is part of the flag **Flag format:** CYBERLAB{cracked_<password>} Use tools like hashcat, john, or online hash databases.
Welcome to your first challenge! Someone encoded a secret message using Base64. Can you decode it? **Encoded message:** ``` Q1lCRVJMQUJ7YjRzM182NF9pc19ub3RfM25jcnlwdDEwbn0= ``` **Hint:** Base64 is an encoding scheme, not encryption. Use the `base64` command or online tools to decode it. Submit the decoded flag in the format: CYBERLAB{...}
Every orbit is a real foundation lab — deployed, exploitable, and waiting. Hover to pause, click to jump in.
Each category comes with real vulnerable machines, guided hints, and step-by-step walkthroughs. Hack real websites. Crack real ciphers. Own real systems.
SQL injection, XSS, CSRF, SSRF, authentication bypass, IDOR & OWASP Top 10.
Beginner → Expert
flag{w3b_4pp_pwn3d}
Port scanning, packet capture, man-in-the-middle, ARP spoofing, firewall evasion.
Intermediate → Expert
flag{p4ck3t_sn1ff3r}
Hash cracking, cipher analysis, RSA attacks, steganography, encoding/decoding.
Beginner → Hard
flag{cr4ck3d_1t_0p3n}
File carving, memory analysis, disk forensics, hidden data in images/audio.
Beginner → Advanced
flag{h1dd3n_1n_pl41n_s1ght}
Binary analysis, malware reversing, decompilation, anti-debug bypass, patching.
Advanced → Insane
flag{b1n4ry_wh1sp3r3r}
Open-source intelligence, subdomain discovery, social engineering, geolocation.
Beginner → Hard
flag{y0u_found_m3}
Buffer overflow, ROP chains, heap exploitation, format string attacks, shellcode.
Advanced → Insane
flag{sh3llc0d3_d3pl0y3d}
AWS/GCP/Azure misconfigurations, IAM privilege escalation, S3 bucket exposure.
Intermediate → Expert
flag{cl0ud_c0nqu3r0r}
Real Vulnerable Websites Included
Each web challenge gives you a real deployed vulnerable web application to attack — login pages, APIs, admin panels, e-commerce sites and more. No simulations — actual HTTP requests, actual exploits, actual flags.
Our AI Guided Solver watches you hack — and when you're stuck, it automatically runs the right tools, shows every command, explains each step, and teaches you how the vulnerability works. You don't just get the flag — you learn exactly how it was found.
Auto-Enumeration
AI runs nmap, gobuster, nikto automatically on the target and maps all attack surface.
Smart Exploit Selection
Picks the right tool (SQLMap, Burp, Hydra) based on what it finds — no manual guessing.
Learn While You Watch
Every command is explained. See WHY each step is taken, not just what to type.
Flag + Full Writeup
Get the flag AND a full step-by-step writeup you can save and revisit later.
Connect via VPN to isolated lab networks. Each machine is a real Linux/Windows server with actual vulnerabilities. Your traffic stays inside the lab — no real systems are ever at risk.
Fully Isolated
No internet access from lab
Auto Reset
Fresh machine every session
OpenVPN Config
1-click .ovpn download
Instant Deploy
Lab ready in under 30s
VPN Lab Connection
Isolated hacking environment
Protocol
OpenVPN
Network
10.10.14.0/24
Lab Type
Isolated
A fresh challenge drops every 24 hours. Weekly CTFs offer harder machines for bigger rewards. Solve them first for bonus XP, climb the leaderboard, and win exclusive badges.
Daily Challenge
Resets every 24 hours
Exploit a weak JWT secret to forge admin tokens.
Weekly CTF
Compete for top position
Compromise a full Linux machine — user then root.
Streak Bonus: Solve 7 daily challenges in a row to earn a 3X XP multiplier for an entire week.
Structured paths from beginner to expert. Video + text + hands-on labs.
Master the foundations of cybersecurity from zero — CIA Triad, threat actors, attack types, malware families, social engineering, network security fundamentals, cryptography essentials, security frameworks, incident response, and defense-in-depth strategies. The ultimate starting course for every aspiring security professional.
Your complete launchpad into ethical hacking — understand hacking phases, legal frameworks, build your own hacking lab with VirtualBox & Kali Linux, master Linux CLI, networking fundamentals, reconnaissance, scanning, enumeration, and vulnerability assessment. From zero to hacker mindset.
Master Linux from scratch for cybersecurity and ethical hacking — Kali Linux setup, terminal mastery, file system navigation, user & permission management, networking commands, bash scripting, process control, package management, log analysis, and automating hacking workflows. The #1 skill every hacker needs.
Learn Python from scratch with a cybersecurity focus — scripting, network programming, web scraping, exploit development, password cracking, forensics automation, and building your own hacking tools.
Master web application security from scratch — learn OWASP Top 10, XSS, SQL Injection, CSRF, SSRF, authentication bypass, API hacking, and build a career in bug bounty hunting using Burp Suite, FFUF, Nuclei, and more.
Master the art of social engineering and open source intelligence — phishing, pretexting, OSINT tools, people/domain investigation, dark web research, and professional red team operations.
Nmap, Metasploit, Burp Suite, SQLMap & more — sandboxed, zero setup, instant execution.
Network Scanner
Exploit Engine
Web Proxy
SQLi Automation
Packet Capture
GPU Cracking
WiFi Security
Dir Brute Force
Battle in real-time multiplayer matches. Use hacking tools as weapons to capture flags, defend servers, and dominate global leaderboards.
Race to capture flags using real hacking tools.
100 hackers. Last team standing wins!
One team attacks. One defends. Breach or hold!
Control the server. First to 1000 pts wins!
20+ tools including Nmap, Metasploit, Burp Suite — run in your browser with real output.
Team-based hacking battles with 4v4 CTF, Battle Royale, Attack/Defend modes.
Structured learning paths combining video lectures, reading, quizzes, and live labs.
Progressive difficulty from beginner SQL injection to expert binary exploitation.
Share writeups, ask questions, join live CTF events, and network with professionals.
All labs run in isolated sandboxes. No risk of real-world harm. OSCP/CEH prep.
No credit card required
No credit card required
The quieter you become, the more you can hear.
— Kali Linux
BackTrack Motto
Start learning ethical hacking on ZeroDaysHack. Free forever for Foundation challenges. No credit card needed.