Explore Hacktivities
Discover and join cybersecurity labs, challenges, and training exercises
Featured Labs
View All FeaturedFirmware Teardown and Security Analysis - Lumentec
Perform comprehensive security analysis of IoT firmware by extracting filesystems, identifying operating systems, and di...
Harwell - Phishing Email Malware Analysis
Investigate a suspicious phishing email containing malicious attachments. Perform email header analysis, extract and fin...
Blue Team Investigation with Wireshark (Forensics)
You are a blue team analyst investigating a network attack on SafeDrive Insurance captured in a PCAP file. Using Wiresha...
Splunk SOC Investigation: Multi-Stage Attack Walkthrough
Investigate a sophisticated multi-stage attack against HarborLine's infrastructure using Splunk. Analyze 6,665 events to...
All Labs
Active Directory Attacks: From Anonymous Access to Domain Admin
This lab guides you through a complete Active Directory takeover starting from network reconnaissance. You'll discover an anonymous SMB share containing credentials, enumerate AD Certificate Services, and exploit ESC1 misconfiguration to escalate privileges. The exercise demonstrates real-world atta...
GraphQL API Security Assessment - CTF
Assess the security of a GraphQL-based fitness application API. Perform reconnaissance to discover the target, exploit introspection to map the attack surface, crack JWT tokens, and abuse broken access controls to escalate privileges. Conclude by leveraging SSRF to access internal services.
Firmware Teardown and Security Analysis - Lumentec
Perform comprehensive security analysis of IoT firmware by extracting filesystems, identifying operating systems, and discovering embedded credentials. Learn to uncover hardcoded secrets, private keys, and misconfigurations that create attack vectors in smart devices. This lab simulates real-world f...
Harwell - Phishing Email Malware Analysis
Investigate a suspicious phishing email containing malicious attachments. Perform email header analysis, extract and fingerprint the payload, identify the malware's configuration including command-and-control infrastructure, and document host-based indicators of compromise. This lab simulates a real...
Android APK Static Analysis Fundamentals
Perform comprehensive static analysis on an Android application package (APK) for a fictional food-delivery startup. Learn to extract and examine app structure, manifest configurations, hardcoded secrets, and cryptographic implementations. Discover common security misconfigurations that attackers ex...
Web Portal Exploitation: BrewMaster Coffee Co.
This lab simulates a penetration test against BrewMaster Coffee Co.'s hastily deployed staff portal. You'll perform reconnaissance, exploit SQL injection vulnerabilities to bypass authentication, extract credentials from the database, and escalate privileges through misconfigured sudo permissions. T...
Blue Team Investigation with Wireshark (Forensics)
You are a blue team analyst investigating a network attack on SafeDrive Insurance captured in a PCAP file. Using Wireshark, you will analyze attacker behavior including port scanning, brute force authentication, SQL injection, IDOR enumeration, and XSS attacks. This lab teaches systematic PCAP analy...
Splunk SOC Investigation: Multi-Stage Attack Walkthrough
Investigate a sophisticated multi-stage attack against HarborLine's infrastructure using Splunk. Analyze 6,665 events to reconstruct the complete attack timeline from initial reconnaissance through privilege escalation and data exfiltration. Build detection rules and map findings to MITRE ATT&CK.
Linux System Administration
Dive into the administrative core of Linux — the layer where the most consequential security decisions happen. This lab covers the full lifecycle of user accounts and group privileges, authentication log analysis, process inspection and control, service hardening with systemd, and scheduled task aud...
Linux Networking for Cybersecurity
Extend your Linux terminal skills into the networking domain — a critical layer in both offensive and defensive security operations. This lab covers how to inspect network interfaces and routing tables, trace packet paths, perform DNS analysis, monitor live connections and captured traffic, and esta...
Linux Terminal Skills
Building on foundational Linux knowledge, this lab takes your terminal skills to the next level with focused, security-driven practice across five core areas: advanced file and directory management, permissions and ownership, pipes and redirection, searching and text processing, and composing multi-...
Linux Fundamentals for Cybersecurity
Gain the essential Linux skills that underpin nearly every role in cybersecurity — from SOC analysis and incident response to penetration testing and digital forensics. This lab walks you through the Linux filesystem, terminal navigation, file operations, log analysis, network inspection, and permis...
Exploring the MITRE ATT&CK Framework
Get familiar with one of the most widely referenced frameworks in the cybersecurity industry. This lab walks you through the core concepts behind the MITRE ATT&CK framework — from understanding the structure of tactics and techniques to exploring how organizations use it to map their defensive cover...
Nmap Network Scanning Fundamentals
This lab provides comprehensive hands-on training in Nmap, the industry-standard network scanning tool. You will learn to discover live hosts, identify open ports and services, detect operating systems, and leverage advanced scanning techniques. By the end, you will be able to conduct professional-g...
PowerShell for Security
This lab introduces PowerShell from a security analyst's perspective, covering how commands are structured, how to chain them together using the pipeline, and how to save and run scripts. You'll also explore execution policy — what it means, how to audit it, and why its configuration matters during...
Logs Fundamentals: Getting Start With Cybersecurity
Logs are the backbone of every security investigation — and knowing how to read them is an essential skill for any blue team role. This beginner-friendly lab walks you through the core concepts of log analysis, from understanding log structure and severity levels to locating event records across Lin...
Wireshark Analysis Fundamentals
This lab teaches foundational packet analysis skills using Wireshark to investigate network traffic. You will analyze ICMP, TCP, HTTP, and TLS protocols by applying display filters, identifying connection patterns, and extracting forensic artifacts. Through hands-on exercises, you'll develop the cor...
Windows Event Log Fundamentals
Windows Event Logs are among the most valuable sources of evidence available to security analysts — yet many practitioners don't know how to use them effectively. This beginner-friendly lab walks you through the structure of Windows logging, the significance of key security event categories, and how...
Network Traffic Investigation
Resolving real-world alerting gaps by diving deep into live network traffic. Across three interconnected investigations, you'll expose a rogue Active Directory network harboring malware, trace an actively infected Windows host communicating with an external command-and-control server, and gather evi...
Encrypted Traffic Malware Investigation
Step into a real-world incident response scenario at a financial institution where anomalous outbound connections have triggered security alerts. This investigation challenges you to decrypt encrypted network traffic, identify malicious file downloads, and trace command-and-control communications li...
PowerShell for Digital Forensics
Discover how to leverage native Windows capabilities for effective digital forensics and incident response. This hands-on lab introduces you to powerful scripting techniques for collecting system artifacts, analyzing user activity, and extracting critical evidence from Windows environments. You'll b...
WannaCry Ransomware Investigation
Analyze a real-world ransomware incident by examining volatile memory artifacts from an infected system. In this investigation, you'll uncover malicious processes, trace encryption activity, identify persistence mechanisms, and reconstruct the complete attack timeline. Through hands-on RAM analysis,...
Windows Memory Forensics
Investigate compromised Windows systems by analyzing volatile memory dumps to recover evidence that disappears when systems power down. This hands-on lab teaches you to extract running processes, active network connections, credential information, and command history from RAM snapshots. You'll uncov...
Email Security Fundamentals
Explore the essential techniques for recognizing fraudulent emails in this foundational exercise. You'll examine email headers, understand authentication protocols like SPF, DKIM, and DMARC, and learn how attackers craft deceptive messages. By analyzing a real-world example, you'll develop practical...