Practice real security skills in your browser.

Nothing to install. Each lab is a small network of practice machines, cut off from the internet, with step-by-step tasks and a Reset button for when things go sideways.

Try your first lab free

Or try the demo below: press Run on each task.

Practice lab: web-01, 10.10.0.5
Demo

Lab 3.1

Get to know the target

A demo that runs in this page only. The real lab gives you a full terminal.

  • Task 1: Check the target is up

    ping -c 4 10.10.0.5

  • Task 2: Find the services it runs

    nmap -sV 10.10.0.5

  • Task 3: Read the web server's headers

    curl -I http://10.10.0.5

Connected to the Patchline practice lab (isolated network).

Target: web-01 at 10.10.0.5. Pick a task and press Run.

student@lab:~$

0 of 3 tasks done

Lab in progress

One lab for every module.

Each module ends with a lab built on what you just learned. You get tasks to follow, hints when you're stuck, and something real to write up at the end.

  1. 01

    Module 1, Security foundations

    Map the attack on a small office network

    Draw each step an attacker takes, from the first email to the stolen files.

  2. 02

    Module 2, Networking and Linux basics

    Trace a connection and find it in the server logs

    Follow one login across the network to the line it leaves in the server log.

  3. 03

    Module 3, Ethical hacking in the lab

    Scan and get into a lab target, then write it up

    Find the open services on web-01, get in, and record every step.

  4. 04

    Module 4, Web application security · Pro and Mentor

    Break into a practice shop app, then patch it

    Exploit an injection flaw in the shop app, then fix the code.

  5. 05

    Module 5, SOC and incident response · Pro and Mentor

    Work a queue of alerts and report the real incident

    Sort the alert queue, spot the one real incident and report it.

  6. 06

    Module 6, Career prep

    Publish your portfolio of lab write-ups

    Gather your best write-ups into one page you can share.

From lab to portfolio.

Every lab ends with a short write-up: what you did, what you found and how to fix it. Finish the six labs and you have six pieces of real work to put on GitHub or link from your resume.

On your resume

Scanned a practice web server, found three exposed services and a version leak in its headers, and wrote up the fixes.

writeups/lab-3-web-01.md

Lab 3.1, Patchline practice lab

Scanning web-01: three open services

Steps

  1. 1.Confirmed the host was up with ping -c 4 10.10.0.5
  2. 2.Scanned for services and versions with nmap -sV 10.10.0.5
  3. 3.Pulled the web server headers with curl -I http://10.10.0.5

FindingMedium

MySQL (port 3306) answers from the network, and the web headers name the exact Apache and PHP versions. An attacker can match those versions to known flaws.

Fix

Bind MySQL to localhost or block 3306 at the firewall. Set ServerTokens Prod and turn off expose_php so the headers stop naming versions.

Is this legal?

Yes. You only practice on the lab's own machines, which we run for exactly this, on a network with no route to the internet. Outside the lab, the rule is simple: never scan or attack a system you don't own or don't have written permission to test.

Module 3 starts with a lesson on rules of engagement before you touch a single target.

Lab questions.

  • No. Each lab opens in a browser tab with the tools already set up. You need a laptop or desktop with an up-to-date browser and an internet connection.

Your first lab is free.

The starter kit is 5 short lessons and 1 hands-on lab. Just your email, no card.

Try your first lab freeSee the curriculum

Photo on this page: AllGo - An App For Plus Size People on Unsplash

Built with Leapd