Each lab drops you into a realistic, authorised scenario: shadow IT on a finance network, a workstation beaconing to C2, a cryptominer on a server, a Log4Shell-vulnerable container. You type the tool's real commands into a simulated terminal, complete objectives, then answer scenario questions. Every lab ends with how to install the tool and practise for real.
Network
Nmap FREE
Shadow IT on the finance network: Discover hosts, open ports and services on networks you're authorised to assess.
Wireshark / tshark FREE
Is WS-077 beaconing?: See exactly what's crossing the wire and spot malware calling home.
Zeek PRO
Where did the data go?: Turn raw traffic into rich, searchable logs for threat hunting.
Suricata PRO
Catch the beacon with your own rule: Detect attacks in network traffic with signatures, and write your own.
SIEM & Detection
Wazuh FREE
Brute force⦠and then a success?: An open-source SIEM and XDR: collect logs, detect attacks, respond automatically.
Sigma PRO
Detect encoded PowerShell in every SIEM: Write a detection once, run it in any SIEM.
Malware & Forensics
YARA FREE
Which attachment is the ransomware?: Describe malware by its patterns and hunt for it across files.
Volatility 3 PRO
The macro that phoned home: Investigate a memory dump: processes, command lines, connections and injected code.
Endpoint
DevSecOps
Trivy FREE
Can shop-api 1.4 ship on Friday?: Scan container images, code and Kubernetes manifests for vulnerabilities and misconfigurations.
Semgrep PRO
Review the orders service before release: Find security bugs in source code with fast, readable rules.
Gitleaks FREE
Did someone commit cloud keys?: Find passwords, keys and tokens committed to Git, then stop it happening again.
Checkov PRO
Review the data-lake Terraform: Catch cloud misconfigurations in Terraform before they're deployed.