Every target in the lab exists to be compromised. Nothing you touch here belongs to anyone else — that is the entire point.
The hardest part of learning offensive security legally is finding somewhere to practise. The Cyber Lab is that somewhere: isolated networks, deliberately vulnerable applications and scripted incidents, running on infrastructure built for the purpose.
Web application
A reporting application where the session logic trusts a value it should not. Reach another tenant's data without valid credentials, then ship the fix.
2–3 hours
Web application
Six endpoints, six injection contexts — SQL, NoSQL, command, LDAP, template and header. Each one wants a different technique and a different fix.
3–4 hours
Incident response
A Linux host that has been compromised. Work out how they got in, what they did, what persists, and what you would tell the client.
4–6 hours
Network
Six hosts across three segments. Start with a foothold on the DMZ and reach the internal database — documenting every hop.
5–8 hours
Active Directory
A small Windows domain with a realistic set of misconfigurations. Go from a low-privileged user to Domain Admin, then write the hardening plan.
8–12 hours
Mixed
Nothing here is critical on its own. Three low-severity issues chain into full compromise — the exercise is seeing the chain.
6–10 hours
Every exercise brief states exactly which hosts are in scope. Testing anything outside that range — including other students' instances — ends lab access. This isn't bureaucracy; scope discipline is the skill that separates a professional tester from a liability, and it's assessed like everything else.
Chained exploitation across a full environment — pivoting, privilege escalation, and professional reporting.
Objective-based adversary simulation — planning, execution, detection awareness and the debrief.
The harder classes of web vulnerability — deserialisation, request smuggling, prototype pollution and chain…
We build private ranges for internal security training. Tell us the skill level and the stack you run.
Prefer a form? Request security assistance
Pick a channel and you'll go straight to a conversation with our team. For a compromised system, WhatsApp is usually fastest.
Request security assistanceStructured form — tell us what happened and we'll come back to you.
