Experience Cybersecurity Hands-On

A virtual cyber range for learning network security, vulnerability assessment, and security operations.

Security Simulators

130

Learning Scenarios

Vulnerability Scenarios

246

CMM Assessment Items

🧪 Practice Labs — hands-on exercises, start here

🚀 STEP 1 — START HERE

🛡️

Security Device Lab

10 Simulators

Practice Firewall, IDS/IPS, VPN, Anti-DDoS, SIEM, WAF, IAM, NAC, Secure Coding, and Threat Intelligence in a simulated environment. Follow structured learning paths from beginner to SOC-level operations.

FirewallIDS/IPSVPNAnti-DDoSSIEMWAFIAMNACSecure CodingThreat Intel

STEP 2

🔍

Vulnerability Assessment Lab

Find · Analyze · Report

Hands-on vulnerability discovery across 4 scenarios: Web Application, Network, System, and API Security. Checklist + free identification modes.

Web AppNetworkSystemAPI

Team-based red team exercise scoring board. Track attack attempts, flag captures, and team rankings in real time.

Attack ScenariosFlag CaptureLeaderboard

Watch 9 cryptographic building blocks computed step by step — from a simple letter shift through DES, RSA, and Diffie-Hellman, to hash collisions, digital signatures, and MACs. Each tab has one worked example — reveal each step to see the math happen, or explore it yourself with the calculators.

CaesarVigenèreXORDESRSADiffie-HellmanHashDigital SignatureMAC

STEP 5

🧬

Digital Forensics Lab

Artifact Triage & Timeline

Sort real evidence from decoys across a fixed pool of forensic artifacts — registry keys, event logs, prefetch, browser history — and reconstruct the true incident timeline. Learn to spot falsified timestamps and legitimate-looking activity that isn't part of the story.

Artifact TriageTimeline ReconstructionAnti-Forensics Detection

STEP 6

🧯

Incident Response Playbook

Build the Right Response

Given an incident brief, pick the right response actions, assign each to its IR phase (Identification, Containment, Eradication, Recovery, Lessons Learned), and sequence them correctly. Learn why order matters — containing before eradicating, preserving evidence before wiping a host, verifying backups before restoring.

IR PhasesResponse SequencingDecision Making

STEP 7

📄

CERT Report Writing Lab

Build the Report

Given raw investigation notes, sort the real findings into the correct CERT report sections — Executive Summary, Timeline, Impact, Root Cause, IOCs, Remediation — in the right order, while excluding anything unprofessional, speculative, or irrelevant that doesn't belong in a report.

Report StructureProfessional WritingFact vs. Speculation

📋 Assessment Tools — organizational maturity & compliance evaluation, for instructors/auditors

📋

CMM Assessment

Cybersecurity Maturity

Evaluate organizational cybersecurity maturity across 6 domains with 246 questions. Generates radar charts and prioritized recommendations.

246 Questions6 DomainsRadar Chart

🏛️

CII Designation Evaluation

Critical Information Infrastructure

Self-evaluation tool for Critical Information Infrastructure designation criteria. 5 categories, 100-point scoring with threshold analysis.

5 Categories100ptsThreshold ≥70

How It Works

Enter your team name above. Your progress and scores are saved and visible to the instructor on the dashboard.

Choose a Module

Select a practice module from the cards above. Each module targets a different cybersecurity skill domain.

Practice & Investigate

Interact with simulated systems, find vulnerabilities, configure security controls, and analyze logs in real time.

Submit & Get Scored

Submit your findings or answers for automatic scoring. Review feedback and compare with other teams on the leaderboard.

🛡️ Security Device Lab

Practice firewalls, intrusion detection, VPN, DDoS mitigation, SIEM, WAF, IAM, NAC, secure coding, and threat intelligence — 10 simulators, no setup required.

Simulators

🛡️

Firewall Simulator

Firewall / Packet Filtering

Write iptables-style rules and trace step by step how packets are allowed or blocked. Practice INPUT·OUTPUT·FORWARD chains, CIDR matching, and port ranges.

Rule Chains Packet Trace CIDR Matching Default Policy

📋 3 Scenarios Start Practice →

ids

🔍

IDS/IPS Simulator

Intrusion Detection & Prevention

Activate 14 attack signatures (SQLi, XSS, brute force, malware, etc.) and observe how attack payloads are detected. Switch between IDS (detect) and IPS (block) modes.

14 Signatures IDS/IPS Mode Switch Anomaly Detection CVE References

📋 3 Scenarios Start Practice →

waf

🧱

WAF Simulator

Web Application Firewall

Write allow/block rules by method, path, and IP, and watch OWASP-style attack signatures (SQLi, XSS, path traversal, command injection) catch what your rules don't. Learn how custom rules always override signature detection.

12 Attack Signatures Rule + Signature Trace OWASP Top 10 Path/Method Rules

📋 6 Scenarios Start Practice →

vpn

🔐

VPN Simulator

Virtual Private Network

Select protocols like WireGuard, OpenVPN, or IPSec and visualize the 5-step handshake. Trace how packets are encrypted through the tunnel and practice split tunneling.

5 Protocols Handshake Visualization Encryption Flow Split Tunneling

📋 3 Scenarios Start Practice →

ddos

🌊

Anti-DDoS Simulator

Distributed Denial of Service

Simulate 5 attack types (SYN Flood, HTTP Flood, DNS Amplification, etc.) at varying intensities. See the real-time effect of 8 defenses: Rate Limiting, SYN Cookies, Traffic Scrubbing, and more.

5 Attack Types 8 Defense Techniques Real-time Chart Intensity Control

📋 3 Scenarios Start Practice →

siem

◈

SIEM Simulator

Security Information & Event Management

Aggregate and correlate logs from Firewall, IDS, VPN, and Anti-DDoS. Practice SOC operations to detect and respond to APT Kill Chains, brute-force attacks, and combined DDoS+intrusion scenarios.

Log Aggregation 8 Correlation Rules Alert Management Kill Chain Analysis

📋 3 Scenarios Start Practice →

iam

🔑

IAM Simulator

Identity & Access Management

Write access policies by principal, action, and resource, and see how an explicit DENY always overrides an ALLOW — no matter the order. Practice least privilege, RBAC, separation of duties, and blocking privilege escalation.

Deny Overrides Allow RBAC Policies Least Privilege Separation of Duties

📋 6 Scenarios Start Practice →

nac

🔌

NAC Simulator

Network Access Control

Write device admission rules by type, MAC, auth method, and posture. Learn how the first matching rule decides ALLOW, QUARANTINE, or DENY — and assigns a VLAN — for corporate laptops, IoT devices, contractors, and guests.

Posture-Based Rules VLAN Assignment Quarantine VLAN 802.1X / MAB

📋 6 Scenarios Start Practice →

💻

Secure Coding Simulator

Vulnerable Code Diagnosis

Read real vulnerable code snippets and diagnose them: identify the vulnerability category, the exact vulnerable line, and pick the correct secure fix among plausible alternatives. Covers SQL injection, XSS, hardcoded secrets, command injection, insecure deserialization, and broken access control.

Real Code Snippets Spot the Vulnerable Line Pick the Correct Fix Instant Explanation

📋 6 Scenarios Start Practice →

🎯

Threat Intelligence Simulator

IOC Triage

Cross-reference indicators of compromise against 5 threat-intel feeds of varying reliability. Add analyst overrides to correct false positives and escalate under-rated threats, and learn how override order determines the outcome.

IOC Lookup Reliability-Weighted Feeds Analyst Overrides False Positive Triage

📋 6 Scenarios Start Practice →

Learning Path

🔓Always available

🟢 Beginner — Understanding Security Devices

Cybersecurity for Complete Beginners

Understand why security devices are needed and what each one does, from the ground up.

1🛡️ Firewall — Web Server Basic Protection

2🔍 IDS — SQL Injection Detection

3🔐 VPN — Remote Work Access

4🌊 Anti-DDoS — SYN Flood Defense

Not started

🔒LockedComplete Beginner path first

🟡 Elementary — Real-World Scenarios

Following Real Security Operations

Practice real-world security issues found in actual companies through hands-on scenarios.

1🛡️ Firewall — Internal SSH Management

2🔍 IDS — Port Scan & Brute Force

3🔐 VPN — Site-to-Site (HQ-Branch)

4🌊 Anti-DDoS — HTTP Flood (L7)

Locked

🔒LockedComplete Elementary path first

🔴 Intermediate — Combined Attack Response

APT Kill Chain Detection & Blocking

Handle real attack scenarios including ransomware spread, reverse shells, and compound DDoS attacks.

1🛡️ Firewall — Block Ransomware Spread

2🔍 IDS — Malware & Reverse Shell

3🌊 Anti-DDoS — DNS Amplification Defense

4◈ SIEM — APT Kill Chain Analysis

Locked

🔒LockedComplete Intermediate path first

🟣 SOC Operations — Integrated Security Monitoring

Real-World Security Operations with SIEM

Integrate and analyze logs from 5 security devices to detect attacks and handle incidents.

1◈ SIEM — SSH Brute-Force Detection

2◈ SIEM — APT Kill Chain Analysis

3◈ SIEM — DDoS + Internal Network Intrusion

4◈ SIEM — Custom Correlation Rules

Locked

Core Concepts

🛡️

Firewall

Decides whether to allow or block based on source/destination IP, port, and protocol. Exists in Stateful and Stateless variants.

🔍

IDS / IPS

IDS only detects; IPS detects and then blocks. Both signature-based and anomaly detection methods are combined.

🔐

VPN

Creates an encrypted tunnel over a public network. Used for remote access, branch connectivity, and privacy.

🌊

DDoS / Anti-DDoS

Distributed denial-of-service attacks occur at L3–L7. Defended via traffic scrubbing, Anycast routing, and rate limiting.

📊

SIEM / Log Analysis

Collecting and correlating security event logs. Understanding attack flow by combining IDS alerts with firewall logs.

🧱

WAF

Filters HTTP traffic to a web application, inspecting requests for OWASP-style attack signatures. Custom allow/block rules always take precedence over signature detection.

🔑

IAM

Access control based on identity: policies define who (principal) can do what (action) to which resource. An explicit DENY always overrides an ALLOW.

🔌

NAC

Controls which devices may join the network based on type, authentication method, and security posture — assigning each one to the right VLAN, or to quarantine.

💻

Secure Coding

Spotting vulnerabilities directly in source code — SQL injection, XSS, hardcoded secrets, insecure deserialization — and knowing the correct fix, not just the flaw.

🎯

Threat Intelligence

Cross-referencing indicators of compromise against threat feeds of varying reliability, and knowing when an analyst should override an automated verdict.

🕵️

Attack Techniques

Understanding web attacks centered on OWASP Top 10: SQLi, XSS, SSRF, RCE, port scanning, brute force, and reverse shells.

🏗️

Network Architecture

Separation of DMZ, internal network, and external network. Zero Trust model, microsegmentation, and Defense in Depth concepts.

Experience Cybersecurity Hands-On

🗺️ Reference Maps

🛡️ Security Device Lab