🛡️ Self-hosted · Isolated · Ethics-first

Learn ethical hacking by actually doing it.

Six phases — from your first packet to Active Directory ranges, AI security and blue-team detection. Read the theory, take the quizzes, capture flags that are verified live.

Pick a destination, not a topic

Six phases, one path

Phase 1

Fundamentals

Networking, Linux, scripting, web basics.

Phase 2

Recon & Web

Scanning, enumeration, OWASP Top 10.

Phase 3

Exploitation

Privilege escalation, post-exploitation.

Phase 4

Advanced

Active Directory ranges, evasion, reporting.

Phase 5 · new

AI Security

LLM attack surface, prompt injection, agency.

Phase 6 · new

Blue Team

Log analysis, detection engineering, DFIR.

Everything the good platforms do

Multi-host lab ranges

Full isolated networks — domain controller, workstation, attacker box. Hosts resolve by name, so lateral movement is real.

Decay scoring & first blood

Challenges are worth more while few have solved them. Solve one first for a bonus. Difficulty balances itself.

Streaks that stick

Daily streaks with earned freeze tokens. Miss a day and a freeze covers you.

Rating, not just points

Rarity-weighted rating rewards hard solves over grinding.

Mystery challenges

Some never tell you the vulnerability class — because nothing in the real world is labelled.

Ethics by construction

Lab networks are created with no gateway. Not policy — architecture.

Live Docker labs & browser terminal: the on-demand container labs and in-browser shell run on the self-hosted backend (Node + Postgres + Docker) shipped in the project repo — an edge runtime has no Docker daemon. Everything else on this site is live right now.