Labs
Hands-on technical labs with step-by-step instructions. Organised by learning path from beginner to expert.
Generated from 135 content files · 126 free · 9 members · 0 unstated ·5 of them appear on no hand-written card today (html-css-lab, js-lab, sql-lab, kali-env-setup-ar, nmap-scanning-ar)
🚀 Zero to Hacker
17 labsDNS Enumeration with Python
Build a DNS reconnaissance tool from scratch in Python.
File Transfers
Move files between machines using HTTP, FTP, SCP, SMB, and base64 encoding.
Hydra Brute Force
Online password attacks against SSH, FTP, HTTP forms, and RDP with Hydra.
Kali Linux Environment Setup
Set up your Kali VM, configure tools, and prepare your hacking lab environment.
Metasploit Framework Basics
msfconsole, searching modules, setting options, running exploits, and Meterpreter.
Netcat Fundamentals
Netcat as a network Swiss army knife — listeners, file transfer, reverse shells.
Network Scanning with Nmap
Host discovery, port scanning, service detection, OS fingerprinting, and NSE scripts.
OSINT & Passive Reconnaissance
End-to-end passive recon on a target: DNS, WHOIS, Shodan, theHarvester.
Password Cracking Lab
Crack NTLM, SHA1, and bcrypt hashes offline using hashcat and John the Ripper.
Python Coding Lab
Socket programming, subprocess, file I/O, and building basic automation tools.
Service Footprinting
Banner grabbing and service enumeration across FTP, SSH, SMTP, SMB, and HTTP.
Wireshark Packet Analysis
Capture, filter, and dissect network traffic to understand protocols.
إعداد بيئة كالي لينكس
Set up your Kali VM, configure tools, and prepare your hacking lab environment.
فحص الشبكات باستخدام Nmap
Host discovery, port scanning, service detection, OS fingerprinting, and NSE scripts.
Linux Privilege Escalation
Linux and Windows privesc fundamentals using linpeas, winpeas, and manual methods.
Password Attacks & Credential Hunting
Pass-the-Hash, credential dumping with Mimikatz, and password spray techniques.
Reverse Shells
Bash, Python, PHP, PowerShell, and Meterpreter reverse shells with netcat handlers.
🕸️ Web Security
31 labsBurp Suite Basics
Intercept, modify, and replay HTTP requests using Burp Suite Community Edition.
Command Injection
OS command injection via semicolons, pipes, and backticks with filter bypass.
Cross-Site Scripting (XSS)
Reflected, stored, and DOM-based XSS with cookie theft and keylogger payloads.
Insecure Direct Object References (IDOR)
IDOR via predictable IDs, GUIDs, and horizontal vs vertical privilege escalation.
SQL Injection Deep Dive
Error-based, union-based, and basic SQLi with manual exploitation.
Web Application Recon
Directory busting, technology fingerprinting, and web attack surface mapping.
Web Fuzzing & Directory Brute Forcing
Fast directory, parameter, and vhost fuzzing with ffuf and SecLists.
Advanced SQL Injection
Second-order SQLi, stored procedures, and WAF bypass techniques.
Advanced XSS & CSRF
XSS chaining, CSP bypass, CSRF token theft, and SameSite attribute bypass.
Attacking Authentication Mechanisms
2FA bypass, brute force protection bypass, and credential stuffing.
Blind SQL Injection
Boolean-based and time-based blind SQLi with sqlmap and manual methods.
Broken Authentication & Sessions
Session fixation, prediction, and authentication logic flaws.
File Upload Vulnerabilities
Bypass extension filters, MIME type checks, and upload webshells.
Injection Attacks: XPath, LDAP & HTML-to-PDF
Exploit XML XPath and LDAP directory injection vulnerabilities.
Local & Remote File Inclusion
Path traversal, null byte injection, PHP wrappers, and remote file inclusion.
NoSQL Injection
MongoDB operator injection, authentication bypass, and data extraction.
OAuth & JWT Attacks
alg:none bypass, RS256→HS256 confusion, JWT cracking, and OAuth code theft.
Server-Side Template Injection (SSTI)
Detect and exploit Jinja2, Twig, and Freemarker SSTI for RCE.
SSRF Attacks
Internal service access, cloud metadata exploitation, and SSRF filter bypasses.
Subdomain Takeover
Enumerate dangling DNS, claim GitHub Pages and S3 buckets, exploit cookie scope.
Web Attacks: IDOR, XXE & Verb Tampering
XXE external entity injection, blind XXE via OOB, and mass IDOR testing.
WordPress Exploitation
WPScan, plugin CVEs, theme RCE, XML-RPC abuse, and brute force.
API & Web Service Attacks
REST API enumeration, BOLA, mass assignment, and API-specific fuzzing.
Attacking GraphQL
Introspection abuse, batching attacks, and GraphQL injection.
HTTP Misconfiguration Abuse
CORS, caching, host header injection, and HTTP/2 downgrade attacks.
HTTP Request Smuggling
CL.TE and TE.CL desync attacks to bypass front-end security controls.
Insecure Deserialization
Java, PHP, and Python deserialization gadget chains for RCE.
JavaScript Deobfuscation
Unpack obfuscated JS, extract hidden endpoints, and reverse client-side logic.
Modern Web Exploitation
Prototype pollution, web cache poisoning, and client-side path traversal.
Server-Side Request Forgery & Attacks
Advanced SSRF chains, XXE, and server-side prototype pollution.
White-Box Web Exploitation: Auth Bypass to RCE
Code review-driven RCE finding in PHP, Python, and Java web applications.
🏰 Infrastructure & AD
21 labsActive Directory LDAP Enumeration
ldapsearch, windapsearch, and manual LDAP queries to map AD structure.
AD Enumeration with BloodHound
SharpHound collection, BloodHound graph analysis, and finding attack paths.
AD Enumeration with CrackMapExec
CME for SMB enumeration, credential testing, and lateral movement.
AD Enumeration with PowerView
PowerView functions for enumerating users, groups, ACLs, and SPNs.
Kerberos Attacks
Kerberoasting, ASREPRoasting, Pass-the-Ticket, and Golden/Silver tickets.
NTLM Relay Attacks
Responder, NTLMrelayx, and relay chains for credential capture and relay.
Windows Privilege Escalation
Services, tokens, registry, DLL hijacking, and AlwaysInstallElevated.
Active Directory Trust Attacks
SID history injection, foreign principal abuse, and cross-forest attacks.
AD Certificate Services (ADCS) Attacks
ESC1–ESC8 ADCS misconfigurations for certificate-based domain compromise.
Application Whitelisting Bypass
AppLocker rule bypass via trusted paths, DLL side-loading, and COM objects.
Attacking Enterprise Networks
Full attack chain from external foothold to domain admin in a lab network.
Command & Control with Sliver
Deploy and operate the Sliver C2 framework for red team engagements.
DACL Attacks in Active Directory
GenericAll, WriteDACL, GenericWrite, and AddMember for privesc.
MSSQL, Exchange & SCCM Attacks
Linked server abuse, MSSQL xp_cmdshell, Exchange privilege escalation.
Pivoting, Tunneling & Port Forwarding
Proxychains, SSH tunneling, Chisel, and Ligolo for network pivoting.
Supply Chain Attacks
Build process compromise, dependency confusion, and package hijacking.
Windows Evasion Techniques
AMSI bypass, PowerShell logging bypass, and process injection methods.
Windows Lateral Movement
PSExec, WMI, WinRM, DCOM, and token impersonation for lateral movement.
WMI Tradecraft & Analysis
WMI for persistence, lateral movement, and stealthy code execution.
🛡️ Defensive
12 labsSOC Alert Triage with a SIEM
Work a realistic alert queue: classify, investigate, and escalate findings.
Threat Detection with Splunk
Write SPL queries, build dashboards, and create detection rules in Splunk.
Windows Event Log Analysis
Key event IDs for logon, process creation, lateral movement, and privilege use.
IDS/IPS Detection Engineering
Snort/Suricata rule writing, tuning, and evasion-aware detection.
Linux Forensics
Disk acquisition, filesystem timeline, log analysis, and bash history forensics.
Malicious Document Analysis
Analyse malicious Office documents, PDFs, and macros with olevba and remnux.
Memory Forensics with Volatility
Analyse infected memory dumps: find malware, C2 IPs, injected code, and creds.
Process Injection & Detection
Detect DLL injection, process hollowing, and reflective injection in EDR logs.
Threat Hunting with Elastic
Hypothesis-driven hunting in Elastic/Kibana using KQL and EQL.
User Behavior Forensics
UEBA concepts, detecting insider threats, and anomalous account activity.
Windows Attacks & Defense
Attack and detect common Windows attack patterns in a paired lab environment.
YARA & Sigma for Defenders
Write YARA malware signatures and Sigma detection rules for SIEM platforms.
💣 Exploit Dev
10 labsDynamic Malware Analysis with WinDbg
Dynamic binary analysis with WinDBG, setting breakpoints, and inspecting memory.
Egghunters & Custom Shellcoding
Egghunter technique for small buffer spaces and custom shellcode writing.
Format String Vulnerabilities
Read stack memory, leak canaries, and perform arbitrary writes with %n.
Introduction to Binary Fuzzing
AFL++, libFuzzer, and coverage-guided fuzzing to discover binary vulnerabilities.
Linux Process Injection & Detection
ptrace-based injection, LD_PRELOAD abuse, and /proc/mem manipulation.
Return Oriented Programming (ROP)
Bypass NX/DEP with ROP gadget chains, ret2libc, and ASLR defeat via info leaks.
SEH-Based Buffer Overflows
Structured Exception Handler overflow exploitation with POP/POP/RET chains.
Windows Heap Exploitation
Heap spray, use-after-free, and Windows heap internals for exploitation.
Windows Stack Buffer Overflows (x86)
Full 32-bit Windows stack overflow with mona.py and custom shellcode.
📡 Wireless
9 labsBypassing Wi-Fi Captive Portals
MAC spoofing, DNS tunnelling, and other captive portal evasion techniques.
Cracking WPA/WPA2 Networks
Capture 4-way handshake and crack with hashcat GPU-accelerated wordlists.
WEP Wireless Attacks
IV collection and statistical WEP key recovery with aircrack-ng.
Wi-Fi Evil Twin Attacks
hostapd-wpe captive portal, SSL strip, and credential capture via rogue AP.
WiFi Hacking with Aircrack-ng
Monitor mode, packet capture, deauth attacks, and WPA2 handshake cracking.
WPS Attacks
Reaver and Bully WPS PIN brute force against vulnerable routers.
📱 Mobile
3 labs☁️ Cloud
2 labs🌐 Networking
11 labsDHCP Configuration Lab
Cisco IOS DHCP server and relay agent configuration.
IP Subnetting Mastery
IP addressing, CIDR notation, and subnet calculation practice.
NAT & PAT Lab
Configure static NAT, dynamic NAT, and PAT overload.
Port Security Lab
Configure port security, sticky MAC addresses, and violation modes.
Spanning Tree Protocol (STP)
STP operation, root bridge election, and port states.
Static Routing Lab
Static route configuration, floating routes, and troubleshooting.
VLANs & Trunking Lab
Configure VLANs, trunk ports, and inter-VLAN routing on Cisco switches.
Access Control Lists (ACLs)
Standard, extended, and named ACLs for network traffic filtering.
EIGRP Routing Lab
Configure and verify EIGRP routing including neighbour adjacency and metrics.
IPv6 Configuration Lab
IPv6 addressing, EUI-64, SLAAC, and dual-stack configuration.
OSPF Routing Lab
OSPF areas, DR/BDR election, and route summarisation.
🤖 AI Security
14 labsAdversarial AI Evasion Under a Query Budget
Evade a phishing classifier you can train in seconds, but only through the API and only within a query budget — the way a real attacker has to.
AI Data & Model Attacks: The Backdoor That Passes Every Test
Plant a backdoor in training data, keep clean accuracy at 95%, flip every triggered input, and prove the model passes its tests anyway.
AI Lab: LLM-Assisted Log and Alert Triage
Run an LLM over a labelled alert corpus and find out where it helps, where it lies, and what it costs.
AI Lab: Model Supply Chain — When torch.load Is Remote Code Execution
A downloaded model file can own your machine on load. Prove it safely, then build the scan-and-refuse controls that stop it — and load only what you trust.
AI Lab: Securing a RAG Pipeline
Build a RAG stack on CPU, break it four ways, then drive the hidden attack tests from fail to pass.
AI Lab: Unbounded Consumption
Turn a summarisation pipeline into a cost bomb, then defuse it with four controls and re-plot the curve.
Excessive Agency
Exploit an agent with an unrestricted shell tool, then add an allowlist and approval gate and prove the same attack now fails. Before/after transcript grading.
Hidden Context Exposure
Extract a decoy API key from a system prompt, then re-architect so the secret is never in context. Flag capture plus a hidden pytest on every context payload.
LLM Output & Application Attacks
Insecure output handling: turn model output into XSS and command injection, then prove the fix blocks it. A two-stage grader script you run locally.
Prompt Injection Attacks
Direct and indirect prompt injection against a RAG chatbot you build yourself, graded on a canary flag string.
AI Lab: EU AI Act Article 50 Transparency in Code
Sign an asset with c2patool, verify it, tamper with it and watch verification fail — then implement the Article 50(1) chatbot disclosure. Graded on the verification exit code.
AI Lab: Satisfy a NIST RMF MEASURE Subcategory with garak
Scan llama3.2:1b with garak under Docker Compose, then turn the report into a NIST AI RMF MEASURE 2.7 evidence record. Graded on the artefact and the metric being in range.
AI-Augmented Penetration Testing
AI as the tester's tool: four genuine accelerants, the boundaries you never cross, and a graded checker that catches fabricated findings.
Mapping an Incident to MITRE ATLAS
Map a public AI incident to ATLAS techniques, emit a Navigator layer, render a heat map, and grade it against MITRE's own data.
🎮 Game Hacking
2 labs🕳️ Uncatalogued
3 labsHTML & CSS Lab
Build real webpages from scratch. 15 exercises that take you from basic tags to a complete styled portfolio page — all you need is a text editor and a browser.
JavaScript Lab
Interactive JavaScript exercises — variables, DOM manipulation, events, arrays, APIs, and 5 browser mini-projects you build from scratch.
SQL Coding Lab
Hands-on SQL exercises from basic queries to complex JOINs and aggregations. Work through 20 challenges on a real database schema — no install required.