Learn cybersecurity, hands-on
Start from your very first command and learn how computers and websites work, the common mistakes that make them unsafe, and how to fix them. You learn by doing, on practice systems built for it.
Desktop browser · Nothing to install · No account needed to start
How it works
Each stage is a short lesson plus a practice lab. Inside the lab you complete
challenges; each one you solve reveals a FLAG{…} code that
proves you did it. Every stage ends with the same question: how would you
prevent this? Stuck? Every challenge has hints, from a gentle nudge to
near-solution.
Stages marked Runs in your browser need nothing installed. Work through the stages in order.
Practise responsibly
The labs here are made to be tested, and everything stays on your own computer. Only ever test systems you own, or have written permission to test. Trying these techniques on other people's websites is illegal in most countries.
Chapter 1 · Foundations
How computers and networks work. Free, and right in your browser.
Linux Fundamentals
Your very first commands. No experience needed — everything is explained as you go.
Networking Basics
How computers find and talk to each other — and how to see what's really travelling between them.
Crypto basics
Tell encoding, hashing and encryption apart, verify files and signatures, and check a website's certificate.
Chapter 2 · Web security
One free stage, then four paid stages available together for $24 once. Build on Chapter 1 and check every fix.
How Websites Work
See what really travels between your browser and a website — and what sites accidentally give away.
Logins and Sessions
Find out how the bakery checks your password, remembers you, and forgets you when you log out.
Who Can See This? (IDOR)
Being logged in doesn't mean you can read every account. Find the missing checks, then test the fix.
SQL Injection
Follow the shop's search into a database, find where input changes a command, then check a safer version.
Cross-site Scripting (XSS)
See what happens when a customer review becomes code in a visitor's browser, then keep it as text.
Get Chapter 2 · $24 once. One payment unlocks all four paid stages. Yours to keep, no subscription.
Before you begin
Where does the lab run?
The Linux computer runs in your browser tab. Fictional lab services stay inside it. Closing the tab discards the computer.
Do I need to install anything?
No. Use a recent desktop browser with WebAssembly support. The first lab downloads about 9 MB. On a phone, you can email yourself the link to open on a computer.
Where is my progress saved?
In this browser, on this device. Signing in does not sync it. Clearing browser storage removes saved progress.
Is this a subscription?
No. One payment buys Chapter 2. Chapter 1 and How Websites Work are free.