Web
Intro to Web Security
Learn how attackers see the web, then find your first flags.
webhttpdevtools
Hacktivities
Learn cyber security, the hands-on way
Hack machines, investigate attacks and build real-world skills through guided, immersive rooms and paths for every level.
48Hands-on rooms
990Flags to capture
13Learning paths
// pick your next challenge
All rooms
48 rooms match your filters.
Linux
Linux Fundamentals
Get comfortable on the command line, the hacker home turf.
linuxbashcli
Network
Network Fundamentals
How data actually travels between machines.
networktcp-iposi
OSINT
OSINT Fundamentals
Find what is hiding in plain sight.
osintreconmetadata
Windows
Windows Fundamentals
The other operating system you will meet on every engagement.
windowscmdpowershell
Network
Networking Essentials
Speak the language of networks: the OSI model, the TCP handshake and the ports you meet every day.
networkositcp
Web
How the Web Works
Requests, responses, methods and status codes — the foundation every web hacker needs.
webhttpmethods
Cryptography
Cryptography Foundations
The CIA triad, and the crucial difference between encoding, hashing and encryption.
cryptohashingencoding
Blue Team
The Cyber Kill Chain
See an attack as a chain of stages — and learn where defenders can break it.
blueteamkillchaindefense
AI Security
Introduction to AI Security
Why AI is its own attack surface, and the OWASP LLM Top 10 that maps it.
aillmsecurity
Reverse Engineering
Game Hacking Fundamentals
The ethics and the core idea: game state is just numbers in memory.
gamehackingmemoryethics
Cloud
Cloud Security Fundamentals
The shared responsibility model and why identity, not the network, is the new perimeter.
cloudawsiam
Start Here
Welcome: How This Platform Works
What a room, task, flag and point are — and how to answer your very first question.
beginnerwelcomebasics
Start Here
Staying Legal & Safe
The single most important lesson: only ever test systems you own or are allowed to test.
beginnerethicslegal
Start Here
Setting Up Your Free Practice Lab
Two ways to start — browser-only, or a free isolated Kali Linux VM. Step by step.
beginnerlabkali
Start Here
The Linux Terminal, From Zero
What a terminal is, how to read the prompt, and ten commands you will use forever — try each one.
beginnerlinuxterminal
Start Here
Your Essential Toolkit
The handful of tools every beginner should know, what each one does, and how to install them.
beginnertoolsnmap
Start Here
Your First Hack: A Guided Walkthrough
Capture a real hidden flag on this very website, step by step. No tools required.
beginnerreconview-source
CTF
CTF: First Blood
A short challenge box to test what you have learned.
ctfencodingbase64
Web
🔒 Pro
Web Exploitation Basics
The three bugs you will find on almost every web app.
webxssidor
Network
🔒 Pro
Nmap Deep Dive
Master the scanner every pentester reaches for first.
networknmapscanning
Crypto
🔒 Pro
Cryptography 101
Tell encoding, hashing, and encryption apart, then break some.
cryptoencodinghashing
Passwords
🔒 Pro
Password Cracking
From captured hashes to plaintext passwords.
passwordshashcatjohn
Forensics
🔒 Pro
Digital Forensics Intro
Follow the artifacts a system leaves behind.
forensicsdfirstrings
Stego
🔒 Pro
Steganography
Messages hidden inside ordinary files.
stegolsbsteghide
AppSec
🔒 Team
Secure Coding for Teams
Build security in before it ships.
appsecowaspsecure-coding
Blue Team
🔒 Team
Incident Response Playbook
A calm, repeatable process when things go wrong.
blueteamincident-responsedfir
Web
🔒 Pro
SQL Injection In Depth
Understand why SQL injection happens, bypass a login, and extract data with UNION.
websqlidatabase
Web
🔒 Pro
Cross-Site Scripting (XSS)
Run JavaScript in someone else's browser — and learn the one rule that stops it.
webxssjavascript
AI Security
🔒 Pro
Prompt Injection & Jailbreaks
The number-one LLM risk: untrusted text becoming instructions the model obeys.
aillmprompt-injection
AI Security
🔒 Pro
Attacking the ML Pipeline
Poisoning, evasion, model extraction and inversion — name the attack, then stop it.
aimlpoisoning
Reverse Engineering
🔒 Pro
Memory Scanning & Editing
Find an unknown address by scanning and filtering, then follow pointers so it survives a restart.
gamehackingcheatenginememory
Windows
🔒 Pro
Windows Privilege Escalation
From a low-privilege user to SYSTEM by finding misconfigurations, not just exploits.
windowsprivescredteam
Web
🔒 Pro
API Hacking & SSRF
Test the API-first attack surface: IDOR, broken auth, and server-side request forgery.
apissrfweb
Cloud
🔒 Pro
Container & Kubernetes Security
Each layer adds power and a new place to get it wrong — with a high-impact hardening checklist.
dockerkubernetescontainers
Blue Team
🔒 Pro
Threat Hunting with MITRE ATT&CK
Assume breach, form a hypothesis, and hunt using a shared map of attacker behaviour.
blueteamthreathuntingmitre
Blue Team
🔒 Pro
Malware Analysis Fundamentals
Triage a sample safely with static and dynamic analysis, then turn it into shareable IOCs.
malwareanalysissandbox
Mobile
🔒 Pro
Mobile Application Hacking
The mobile attack surface: insecure storage, hardcoded keys, weak transport and the backend behind the app.
mobileandroidios
OSINT
🔒 Pro
OSINT Deep Dive
Run OSINT as a disciplined intelligence cycle, not a lucky search — with the sources professionals use.
osintreconwhois
Wireless
🔒 Pro
Wi-Fi & Wireless Attacks
Capture a WPA2 handshake and crack it offline — plus the defences that stop you.
wifiwpa2handshake
AppSec
🔒 Pro
Secure Code Review
Trace untrusted data from source to sink to find bugs before attackers do.
appsecsastsource-sink
Web
🔒 Pro
SQL Injection
Turn a login form into a database dump.
websqlidatabase
Linux
🔒 Pro
Linux Privilege Escalation
From a low shell to root.
linuxprivescsuid
Blue Team
🔒 Team
SOC Analyst Simulation
Sit in the blue team chair and work the alerts.
blueteamsocsiem
Reverse Engineering
🔒 Pro
Reverse Engineering & Anti-Cheat
Read compiled code with Ghidra, use static and dynamic analysis, and see how anti-cheat fights back.
reversinganticheatghidra
Windows
🔒 Pro
Active Directory Attacks
Chain small wins into a path to Domain Admin, and map it with BloodHound.
activedirectorykerberosbloodhound
Forensics
🔒 Pro
Memory Forensics
Capture RAM and use Volatility to find fileless malware, keys and connections the disk never saw.
forensicsvolatilityram
AI Security
🔒 Pro
AI Red Teaming
Systematically probe an LLM application for injection, jailbreaks and data leakage — with authorisation.
aillmredteam