Read the brief.
Open a terminal.
Capture the flag.
Every room here runs against a real, always-on target — not a simulation. You get a terminal, a live recon panel, and one objective per task.
Learn by doing, not by reading
Every lesson pairs real instruction with a real target — you're never just watching.
Real Terminals, Real Targets
No simulations. Every room gives you an actual shell on an always-on target server you can attack for real.
AI Tutor, Every Page
Stuck? Ask the built-in tutor — it knows what lesson you're on and can explain any concept or command out loud.
XP, Levels & Streaks
Earn XP for every task, level up, keep a daily streak, and climb the leaderboard as you learn.
Vulnerable Apps to Hack
Practice against purpose-built vulnerable web apps — SQL injection, broken auth, hidden admin panels, and more.
Learning Paths
Pick a path and work through it room by room.
Web Recon Fundamentals
Start here: map a target's attack surface before you ever try to break anything.
Map the Site
Use a real terminal against a live target to enumerate directories and build a site map before touching anything else.
Find the Hidden Page
Use a real directory scanner against a live target to find a page that should not be publicly accessible.
Exploit a Login Form
Apply what you know about recon to find a login page, then use a simple brute-force technique to gain access.
Linux Basics
Learn to navigate and interact with Linux — the OS that runs almost every server you will ever hack.
Navigate the File System
Learn the essential Linux commands for moving around a file system — the foundation of everything you will do on a target server.
Find the Hidden File
Use the find command to search an entire file system for files you cannot see with a normal directory listing.
Read Restricted Files
Learn about Linux file permissions and how misconfigured permissions can expose sensitive data.
Network Scanning
Discover what is running on a network before you try to exploit anything.
Your First Nmap Scan
Learn to use nmap — the most important network reconnaissance tool — to discover what is running on a target.
Port Discovery
Go beyond the default nmap scan and discover services running on non-standard ports.
Service Fingerprinting
Identify exact software versions running on open ports — the information needed to search for known vulnerabilities.
Web Vulnerabilities
Learn the most common web application vulnerabilities and how attackers exploit them.
What is SQL Injection
Understand what SQL injection is, why it works, and how to recognize it — no exploitation required yet.
Bypass a Login
Use a basic SQL injection payload to bypass a login form that is vulnerable to the attack you learned about.
Extract the Database
Go beyond login bypass and use SQL injection to dump data from the database — the technique attackers use to steal credentials.
Ready to start hacking?
Pick your first room above — no signup wall, no credit card, just a terminal and a target.
View your profile