New here? Start with this one.
We picked Phishing & Email Threat Analysis as the perfect first step — no experience needed. You'll learn the basics and earn your first win in about 15 minutes.
Spot the scam: catch a phishing email red-handed.
Analyze reported phishing emails, extract IOCs, and verify SPF/DKIM configurations.
Read the firewall's diary to find the bad guys.
Read and interpret basic firewall deny/allow logs, identify suspicious IPs, and generate a simple report.
Build your first alarm system for hackers.
Configure basic SIEM alert rules for failed logins, set severity thresholds, and triage your first alerts.
Play detective: identify a mystery virus.
Use static analysis tools to classify malware samples by type, extract hashes, and look up IOCs in public threat intel feeds.
Lock down a computer like a pro.
Audit an endpoint for missing patches, disabled antivirus, and weak configurations using a CIS benchmark checklist.
Map the network and guard the gates.
Entry-level network defense: discover hosts, analyze firewall logs, and configure SNMPv3 monitoring.
Lock the doors on a network switch.
Enable port security, configure MAC address sticky learning, and disable unused ports on a core switch.
Stop bad websites at the front door.
Configure DNS filtering, enable DNSSEC, and identify malicious domain queries in logs.
Build a secret tunnel between two offices.
Set up a basic site-to-site IPsec VPN, verify connectivity, and review tunnel logs.
Make a router hacker-proof.
Apply CIS-recommended hardening to routers and switches: disable Telnet, enable SSH, restrict SNMP communities.
Be the first responder when alarms go off.
Walk through NIST IR lifecycle: prepare, detect, contain, eradicate, recover. Document a simulated low-severity alert.
Quarantine a sick computer to stop the spread.
Identify a compromised workstation, isolate it from the network, and collect basic triage artifacts.
Bag and tag digital evidence like a CSI.
Learn chain-of-custody procedures, image a USB drive, and hash-verify the image using MD5/SHA256.
Sort real threats from false alarms.
Receive an AV alert, verify true/false positive status, escalate if needed, and fill out an incident ticket.
Catch someone trying every door at once.
Detect a low-and-slow password spray attack in authentication logs and block the offending IP range.
Scan a network for open cracks.
Run an unauthenticated Nessus scan against a single subnet and review the output for critical findings.
Rank dangers: which bug fixes first?
Evaluate five CVEs using the CVSS v3.1 calculator, rank them by environmental score, and recommend remediation priority.
Prove a computer's wounds are patched.
Confirm that KB patches are applied on Windows hosts, compare system versions to CVE advisories, and document compliance.
Find every open door on the network.
Use Nmap to audit all listening ports on the DMZ, compare results to the approved service list, and flag anomalies.
Write the report that gets bugs fixed.
Take raw scanner output and write an executive-friendly vulnerability report with risk ratings and remediation steps.
Slice the network into separate lanes.
Create VLANs for server, user, and guest traffic. Apply inter-VLAN routing policies.
Set up a dashboard that watches the network.
Configure SNMPv3 on network devices, set up a monitoring dashboard, and create threshold alerts.
Design the address map for three offices.
Design an IP addressing scheme for a three-site network using VLSM, allocating appropriate ranges per department.
Make the Wi-Fi safe for everyone.
Configure WPA3 on an access point, create a guest SSID with captive portal, and audit client associations.
Play network doctor and fix three outages.
Diagnose three simulated network outages using ping, traceroute, and show commands on a Cisco switch.
Be the boss of user accounts and rules.
Build an AD OU structure, apply security GPOs, and manage patch deployment via WSUS.
Turn a fresh Linux box into a fortress.
Secure a fresh Ubuntu server: disable root SSH, configure UFW, apply CIS Level 1 benchmarks, and set up fail2ban.
Save the day with a good backup.
Configure a daily backup job for critical files, test restoration to a sandbox, and document the recovery procedure.
Create, change, and lock out users.
Create, modify, and disable user accounts using AD and PowerShell scripts. Enforce password complexity policies.
Hand out digital ID badges to computers.
Stand up a basic internal PKI with a two-tier CA hierarchy, issue a TLS certificate to a web server, and verify the chain.
Dig through a hard drive for hidden files.
Browse an NTFS filesystem image using Autopsy; identify deleted files, timestamps, and metadata.
Reconstruct what someone did online.
Extract browser history, cookies, and downloads from a forensic image to reconstruct user activity.
Read a computer's diary for clues.
Filter Security, System, and Application event logs to identify login anomalies and service crashes.
Prove evidence wasn't tampered with.
Verify integrity of forensic evidence using MD5/SHA256 hashing, and complete a chain-of-custody form.
Watch data fly by and find leaked passwords.
Capture live traffic with Wireshark, filter by protocol, and identify plaintext credentials in the capture.
Stalk a target using only public info.
Use open-source tools (Shodan, Maltego, VirusTotal) to gather threat intelligence about a target domain.
Sort the clues: is it a real threat?
Classify a list of indicators (IPs, domains, hashes) by type and confidence level using a structured threat intel format.
Map hacker moves on the ATT&CK board.
Map a set of observed TTPs to the ATT&CK framework using Navigator, identify coverage gaps.
Wire up a feed of fresh threat intel.
Subscribe to a free threat feed, import IOCs into the SIEM, and create detection rules based on feed data.
Decode the tricks scammers use.
Review phishing campaigns, analyze social engineering TTPs, and produce an awareness report for end users.
Design a network that's hard to crack.
Identify security design principles (defense in depth, least privilege) and apply them to a simple network diagram.
Draw the lines attackers can't cross.
Identify trust boundaries in a three-tier web application and document data flows and control points.
Turn rules into a security blueprint.
Translate business requirements into security controls using NIST 800-53, document in a security plan template.
Pick the locks that actually hold.
Compare symmetric and asymmetric algorithms, evaluate TLS versions in use, and recommend secure configurations.
Lock down a leaky cloud storage bucket.
Review AWS shared responsibility model, identify misconfigured S3 buckets, and apply least-privilege IAM policies.
Learn how cyber cops bag evidence.
Identify digital evidence types, proper seizure procedures, and legal considerations for computer crime investigations.
Trace a fake email back to its source.
Analyze email headers to trace origin, identify spoofed addresses, and correlate with known threat actors.
Build a suspect profile from public posts.
Use OSINT tools to build a profile of a suspected cybercriminal from public social media and forum activity.
Write the report that holds up in court.
Write a factual, legally defensible investigation report from a set of digital evidence artifacts.
Follow the breadcrumbs in the logs.
Analyze proxy and firewall logs to identify unauthorized data access and build a basic incident timeline.
Scout a target without getting caught.
Conduct passive and active reconnaissance on a target range using whois, DNS enumeration, and Nmap.
Master the hacker's command line.
Master essential Linux commands for offensive operations: file manipulation, process inspection, and basic networking.
Automate the boring stuff with Python.
Write basic Python and Bash scripts to automate port scanning, file hashing, and log parsing tasks.
Spy on a website's traffic with Burp.
Use Burp Suite Community edition to intercept HTTP traffic, modify requests, and identify input fields for testing.
Build your hacker toolkit from scratch.
Configure a Kali Linux attack workstation, update tools, configure anonymization, and verify lab connectivity.
Hunt port scans and chase SIEM alerts.
Detect port scans with firewall logs, run vulnerability scans against the server farm, and investigate SIEM alerts.
Write rules that catch multi-step attacks.
Build multi-event correlation rules in Splunk to detect brute force, lateral movement, and privilege escalation patterns.
Learn what's normal, then catch the weird.
Establish normal baselines for user and device behavior, then detect anomalies indicating insider threats.
Write your own hacker-detection rules.
Write custom Snort/Suricata rules to detect specific attack patterns observed in threat intelligence feeds.
Find the spy beaconing home in a PCAP.
Analyze a 48-hour PCAP for C2 beaconing, data staging, and exfiltration attempts. Produce IOC list.
Build walls between network zones.
Configure VLAN segmentation, harden firewall rules, and deploy 802.1X port authentication.
Clean up a messy firewall rulebook.
Audit an existing firewall ruleset, remove shadowed and redundant rules, and document the change.
Turn down the noise on a loud alarm.
Reduce false positives on a production IPS sensor by adjusting sensitivity thresholds and suppressing known-good signatures.
Guard the front door that shares the load.
Configure a reverse proxy/load balancer with SSL termination, HTTP security headers, and DDoS rate limiting.
Make the network that never sleeps.
Configure HSRP/VRRP for router redundancy, test failover, and document RTO/RPO for the network segment.
Stop a ransomware attack in its tracks.
Receive a ransomware alert, perform immediate containment, identify affected hosts, and begin eradication.
Fight back against a phishing blitz.
Respond to a large-scale phishing campaign: identify victims, reset credentials, block IOCs, and send user notifications.
Catch a coworker gone rogue.
Correlate AD, VPN, and file server logs to identify unauthorized after-hours access to sensitive data.
Spot a hacker hopping between computers.
Identify Pass-the-Hash and Pass-the-Ticket attacks within Windows event logs; block attacker lateral movement.
Survive a flood of fake traffic.
Execute a DDoS response playbook: identify attack type, implement rate limiting, engage upstream ISP blackholing.
Run a full scan-and-fix loop.
Enumerate all zones with Nmap, run NSE scripts, and produce a remediation report.
Scan deeper with real login credentials.
Run credentialed Nessus scans against Windows and Linux hosts; compare results to unauthenticated scans.
Hunt the OWASP Top 10 on a website.
Run OWASP ZAP against a web application, identify OWASP Top 10 findings, and prioritize remediations.
X-ray a Docker image for hidden bugs.
Scan Docker images with Trivy, identify vulnerable base images, and apply image hardening techniques.
Decide which 200 bugs to fix first.
Take scanner output from 200+ findings, apply business context to prioritize critical remediations, and build a remediation roadmap.
Stand up your own threat intel hub.
Deploy MISP, import threat feeds, tag IOCs, and share intelligence with a simulated ISA partner.
Profile a real nation-state hacker crew.
Research a nation-state APT group using Cyber Kill Chain and ATT&CK, and produce a threat profile document.
Watch a virus misbehave in a sandbox.
Detonate malware in a sandbox, document behavioral IOCs (registry, network, file), and map to ATT&CK techniques.
Hunt hackers hiding in normal tools.
Hunt for LOLBin abuse (PowerShell, WMI, MSHTA) using endpoint telemetry and Sigma rules.
Brief the team on what the bad guys want.
Produce a finished tactical intelligence report using the Diamond Model, suitable for an operations team briefing.
Stop attackers from hijacking the internet's roads.
Configure BGP prefix filtering, RPKI, and route dampening to prevent route hijacking.
Lock down the routes between routers.
Deploy OSPF across a multi-area network with MD5 authentication, summarization, and stub areas.
Make the fast lane for video calls.
Implement QoS policies to prioritize VoIP and video traffic, verify with simulation tools.
Steer the whole network with software.
Deploy an OpenDaylight SDN controller, configure southbound interfaces, and push flow rules to virtual switches.
Predict when the network will run out of room.
Analyze 90-day utilization trends using SNMP data, identify bottlenecks, and produce an upgrade recommendation.
Push security rules to every PC at once.
Implement AppLocker, LAPS, and fine-grained password policies via AD Group Policy.
Manage phones and laptops from the cloud.
Configure compliance policies in Intune, enforce BitLocker encryption, and manage application deployment.
Find the holes in auto-built servers.
Review Terraform and Ansible scripts for security misconfigurations, apply hardening templates.
Control who gets the master keys.
Deploy a Privileged Access Management solution, configure session recording, and enforce just-in-time access.
Keep every log, safely, for years.
Configure centralized log collection from all infrastructure devices, set retention policies, and verify log integrity.
Design a network that trusts nobody.
Design identity-centric access controls, define micro-perimeters, and map data flows for a hybrid environment.
Brainstorm every way an app could break.
Apply STRIDE methodology to a microservices architecture, identify threats, and propose mitigations.
Find the gaps in a company's defenses.
Map CIS Controls v8 to an organization's current security posture and identify control gaps.
Connect the office to the cloud safely.
Design secure connectivity between on-premises and AWS/Azure environments with proper identity federation.
Bake security into the code factory.
Embed SAST, DAST, and dependency scanning into a CI/CD pipeline; define security gates and approval workflows.
Read a computer's mind with Volatility.
Acquire a memory dump and use Volatility to list processes, find injected code, and extract network connections.
Dig through the Windows registry for secrets.
Analyze Windows registry hives for persistence mechanisms, recently accessed files, and USB history.
Uncover spear-phishing in a mailbox.
Analyze mailbox exports to identify spear-phishing attacks, trace email routes, and recover deleted messages.
Pull clues out of a seized phone.
Extract and analyze data from an Android device image using Cellebrite/ALEAPP tools for a simulated investigation.
Rebuild a hack from a pile of packets.
Analyze a multi-protocol PCAP file to reconstruct a web intrusion, extract credentials, and identify exfiltrated files.
Break in with Metasploit, then pivot.
Exploit a vulnerable service with Metasploit, post-exploit for credentials, and pivot to a second target.
Crack stolen hashes with Hashcat.
Use Hashcat and John the Ripper to crack NTLM, MD5, and bcrypt hashes using wordlist and rule attacks.
Break a Wi-Fi password the hard way.
Capture WPA2 handshakes, perform deauth attacks, crack PSK, and evaluate evil twin attack feasibility.
Map every path to the crown jewels.
Use BloodHound and PowerView to enumerate AD attack paths, find Kerberoastable accounts, and map domain trusts.
Stand up your own command-and-control server.
Stand up a Havoc/Sliver C2 server, generate a staged payload, establish a callback, and blend traffic.
Run the whole response on a live ransomware hit.
Triage a PowerShell-delivered ransomware incident: isolate host, analyze memory, block lateral movement, document timeline.
Hunt a backdoor snuck in via a software update.
Investigate a compromised software update mechanism, identify affected endpoints, and implement emergency mitigations.
Chase a hacker through a hijacked AWS account.
Respond to a compromised AWS IAM role: revoke credentials, audit CloudTrail, identify exfiltrated S3 data.
Rip out every foothold an APT left behind.
Conduct environment-wide cleanup after a confirmed APT intrusion: remove persistence, flush caches, rebuild keys.
Trace a stolen inbox and stop the wire fraud.
Investigate a BEC incident: trace OAuth token theft, identify forwarding rules, notify affected parties, and harden M365.
Break into a web server, then own the network.
Conduct OWASP Top 10 assessment on DMZ web server and exploit EternalBlue on unpatched Windows hosts.
Escalate from one AWS flaw to total control.
Enumerate and exploit AWS misconfiguration: SSRF to metadata service, privilege escalation via role chaining.
Chain attacks all the way to domain admin.
Full AD attack: Kerberoasting → AS-REP Roasting → DCSync → Golden Ticket. Document each step with evidence.
Pick apart an Android app for weaknesses.
Perform dynamic and static analysis of an Android APK: intercept traffic, identify insecure data storage, bypass root detection.
Rip open an IoT gadget's secrets.
Extract firmware from an IoT device, identify embedded credentials, reverse engineer a binary, and document findings.
Catch spies sneaking data out through DNS.
Detect DNS tunneling with pcap analysis, hunt for C2 beaconing, and map findings to MITRE ATT&CK.
Take a virus apart, line by line.
Perform static and dynamic reverse engineering of a .NET malware dropper using dnSpy, identify capabilities and C2 logic.
Hunt Cobalt Strike beacons in Elastic.
Use Elastic Security to build hunting queries for Cobalt Strike beacons, write detection rules, and tune false positives.
Dissect a real ransomware crew's playbook.
Analyze a ransomware campaign from initial access to encryption: identify the group, TTPs, and defensive recommendations.
Build a pipeline that tests its own alarms.
Build an automated detection pipeline using Sigma, ATT&CK, and SIEM to continuously test and improve detection coverage.
Defend a power plant's control network.
Detect unauthorized Modbus write commands, segment the SCADA network, and apply ICS-specific firewall rules.
Write the rules that catch the sneakiest attacks.
Build multi-phase correlation rules in Splunk ES for living-off-the-land attacks, data exfiltration, and credential theft.
Set traps and watch attackers fall in.
Deploy honeypots and canary tokens across the network, configure alerts, and analyze attacker behavior on deception assets.
Spot the telltale signs of ticket theft.
Detect Kerberoasting, AS-REP Roasting, and Silver Ticket attacks through Windows Security events and network traffic.
Attack and defend at the same time.
Coordinate with a red team: pre-agree TTPs, execute attacks, verify detections, identify coverage gaps, and improve rules.
Rebuild a breach from disk and wire.
Forensically image an isolated workstation, analyze the filesystem for artifacts, and reconstruct breach timeline from PCAP.
Catch the hacker who tried to cover their tracks.
Identify timestomping, log clearing, and file shredding artifacts, and recover evidence despite anti-forensics techniques.
Pull a live implant out of RAM.
Extract C2 implant from process memory, dump encryption keys, and reconstruct decrypted network communications.
Investigate a pwned Linux server.
Investigate a compromised Linux server: analyze bash history, cron jobs, SUID binaries, and kernel module persistence.
Snapshot and dissect a hacked cloud server.
Collect forensic evidence from a compromised EC2 instance: snapshot EBS, analyze VPC flow logs, and query CloudTrail.
Roll out zero trust across a whole company.
Implement full micro-segmentation, integrate SASE, and deploy continuous verification across the enterprise.
Design encrypted links for a branch network.
Design a secure SD-WAN deployment with encrypted overlays, centralized policy management, and anomaly detection integration.
Unify every login under one smart gate.
Design a unified identity fabric across on-premises AD, Azure AD, and external IdPs with conditional access policies.
Architect the brain that eats all the logs.
Design an enterprise SIEM ingestion pipeline: log sources, normalization, correlation, and long-term storage tiers.
Future-proof the company's encryption.
Audit enterprise cryptographic standards, identify deprecated algorithms, design a migration to post-quantum-ready algorithms.
Run a complete attack from phish to theft.
Execute a full red team operation: initial access via spear-phishing, establish persistence, lateral movement, and data exfiltration.
Sneak past the antivirus like a ghost.
Bypass AV/EDR using custom loaders, reflective injection, and process hollowing. Measure evasion effectiveness.
Mimic a real financial hacking crew.
Simulate FIN7 TTPs: spear-phish, CARBANAK loader, persistence via COM hijacking, and financial data exfiltration.
Clone a badge and talk your way in.
Simulate a physical intrusion: badge cloning, tailgating assessment, and USB drop attack simulation.
Attack a factory's control systems.
Assess an OT network: enumerate Modbus/DNP3 devices, replay control commands, identify safety system vulnerabilities.
Catch the internet's roads being stolen.
Detect a BGP route hijack in real time, validate RPKI, implement emergency prefix withdrawal, and notify upstream.
Survive a massive flood of junk traffic.
Implement BGP Flowspec, RTBH, and scrubbing center policies to mitigate a multi-vector volumetric DDoS attack.
Lock down the bots that run the network.
Secure network automation pipelines using Ansible Vault, signed playbooks, and read-only API tokens for network devices.
Spot bad TLS traffic without decrypting it.
Use JA3/JA3S, HASSH, and SSL certificate anomalies to identify malicious TLS without decryption.
Wall off the pods in a Kubernetes cluster.
Define and test Kubernetes NetworkPolicy rules to restrict pod-to-pod communication and egress in a production cluster.
Build zero trust from blueprint to live.
Design and implement full microsegmentation for the server farm, deploy cloud S3 security, and validate with penetration testing.
Lead a multi-year security overhaul.
Lead a multi-year security transformation program: security architecture, roadmap, governance model, and board presentation.
Stress-test defenses until they bend, not break.
Design chaos engineering tests for security controls, validate resilience under simulated attack conditions and partial failures.
Prep the company for the quantum age.
Plan and pilot a migration from RSA/ECC to CRYSTALS-Kyber and CRYSTALS-Dilithium across an enterprise PKI.
Defend the AI the SOC relies on.
Integrate AI/ML-based anomaly detection into the SOC architecture, addressing model poisoning and adversarial input risks.
Hunt a nation-state across the whole kill chain.
Hunt for APT indicators across all systems: LOLBin abuse, credential dumping, lateral movement, exfiltration. Full ATT&CK mapping.
Name the hacking crew behind the breach.
Analyze malware, infrastructure, and TTPs to attribute an intrusion to a known nation-state group with confidence scoring.
Predict next quarter's cyber threats.
Produce a 6-month threat forecast for a critical infrastructure sector using geopolitical intelligence and historical TTP data.
Build a working exploit for a fresh bug.
Research and develop a proof-of-concept exploit for a memory corruption vulnerability in a network service (controlled lab).
Run a company-wide honeynet sting.
Design an enterprise-wide deception campaign with honeynets, breadcrumbs, and canary documents. Measure attacker interaction.
Attack, then flip sides and defend.
Combined offense and defense: exploit vulnerabilities, establish persistence, then switch to defender role to detect and eradicate.
Lead the response to a state-sponsored breach.
Lead a whole-of-enterprise response to an active nation-state intrusion: crisis management, legal coordination, and public disclosure.
Recover from an attack meant to destroy.
Respond to a destructive wiper attack targeting OT and IT networks simultaneously. Coordinate recovery across business units.
Guide a company through ransomware to rebuild.
Lead full ransomware recovery: negotiation documentation, decryption key management, system rebuild, and lessons learned.
Run the war room for a critical-infrastructure drill.
Facilitate a multi-agency cybersecurity tabletop exercise simulating a critical infrastructure attack with cross-sector coordination.
Code your own stealthy command-and-control tool.
Develop a fully custom C2 implant in C/C++ with encrypted comms, anti-analysis features, and automated tasking.
Hack a PLC and flip the switches.
Exploit vulnerabilities in HMI software and PLCs, modify ladder logic, and demonstrate impact in a controlled ICS environment.
Invent new ways to stay hidden in AD.
Research and demonstrate novel AD persistence techniques: AdminSDHolder abuse, DSRM backdoor, and SID history injection.
Pull firmware off a chip and patch it.
Extract firmware via JTAG/UART, identify hardcoded credentials, and develop a firmware patch to remediate the vulnerability.
Simulate a full attack on a power grid.
Simulate an end-to-end APT attack on a power grid: initial access, persistence in IT, IT/OT pivot, and impact demonstration.
Run a forensic case across borders.
Lead a forensic investigation spanning cloud, on-premises, and international assets with legal hold coordination.
Hunt a kernel rootkit in memory.
Analyze a kernel-level rootkit using memory forensics, identify hooks, and develop detection signatures.
Trace a backdoor through a build pipeline.
Investigate a compromised open-source dependency: trace build pipeline, identify tampered artifacts, scope affected systems.
Write the report you'd defend in court.
Prepare a forensic report suitable for court testimony, including methodology, chain of custody, and expert opinion sections.
Follow stolen crypto through mixers.
Trace cryptocurrency transactions through mixing services using on-chain analysis tools to recover stolen funds.
Architect a multi-firewall fortress.
Design and implement a multi-vendor firewall architecture with ECMP, high availability, and unified policy management.
Harden a 5G core against attack.
Evaluate and harden a 5G SA core network: protect N interfaces, implement network slicing security, and audit SBI exposure.
Test the seams of an MPLS VPN.
Assess MPLS VPN security: test label spoofing, BGP route injection, and unauthorized inter-VRF routing.
Design defense-in-depth for a factory.
Design a defense-in-depth OT/ICS security architecture using Purdue model, unidirectional gateways, and OT-specific IDS.
Wire every signal into one XDR brain.
Integrate an XDR platform across endpoint, network, cloud, and identity telemetry sources. Build and test expert-level playbooks.
Run an entire red team program.
Build and manage an enterprise red team program: rules of engagement, risk frameworks, reporting standards, and metrics.
Find a bug, report it, earn a CVE.
Discover a vulnerability in open-source software, write a PoC, coordinate responsible disclosure, and publish a CVE.
Run always-on attack surface management.
Implement CTEM: attack surface discovery, attack path simulation, exposure prioritization, and automated remediation workflows.
Launch a bug bounty from scratch.
Design and launch a bug bounty program: scope definition, triage processes, reward structure, and researcher communication.
Pit red against active defense and measure who wins.
Pit red team against a blue team with active defense capabilities (deception, EDR, NDR) — measure dwell time and detection rates.