Labs live inside course tracks

Enrol in a course to unlock linked labs free, take the track quiz, and claim a CYNARKS certificate. This catalog is a browse-all view of built rooms.

Go to courses →24 Paths · 404 rooms →Visual Learning →

Learn · TryHackMe-style curriculum map

Segregated Labs Paths

24 tracks · 404 rooms — Cybersecurity Fundamentals through Advanced. Live rooms use browser engines; planned rooms publish as content ships.

Browse all 24 paths →

Practice hub

Hands-on Labs

177 hands-on browser rooms — 28 free to start. Others unlock with a linked course enrol or Learn plan (same idea as PortSwigger: practice in-product, not a separate lab invoice). Browse courses.

Your progress

0/177

Unlocked for you: 22/177

How unlock works. Enrol in the course that owns the room, or use a Learn plan that covers that track. Labs are practice rooms — we do not put ₹/mo price tags on each card.

Fundamentals

BeginnerFree lab

Decode the Beacon

Decode a Base64 string used in a fake C2 sample.

🌐 interactive roomEncodingAnalysis

Cryptography

Beginner🔒 Unlock via course or plan

ROT13 Note

Recover a ROT13-obfuscated note.

🌐 interactive roomCrypto basics

Networking

Beginner🔒 Unlock via course or plan

Port Riddle

Identify the HTTPS port.

🌐 interactive roomPorts

Networking

Beginner🔒 Unlock via course or plan

Handshake Order

Order the TCP three-way handshake.

🌐 interactive roomTCP/IP

Web Security

Beginner🔒 Unlock via course or plan

Inspect the Login Request

Read a simulated HTTP login and find the password field value.

Segregated Labs Paths

Hands-on Labs

Decode the Beacon

ROT13 Note

Port Riddle

Handshake Order

Inspect the Login Request

Spot the IDOR

Break the Query (Simulated)

Find the Noisy IP

Pick the SYN Packet

Lock Down secret.txt

HttpOnly Cookie

Least Privilege Policy

Reflect the Payload (Safe Sim)

Mail Server Record

Map the Technique

CSRF Token Check

Security Header Pick

JWT Segment Count

SSRF Target Spot

Hex Decode

Path Traversal Pattern

Write the Hunt Idea

CIA Triad Match

Risk Ingredients

AuthN vs AuthZ

Kerberos Ticket Name

Cloud Shared Responsibility

IR Phase Pick

Zero Trust Phrase

XXE Danger Sign

Windows Event Pick

NTLM vs Kerberos

MASVS Acronym

YARA Purpose

SAST vs DAST

JWT alg=none Trap

Lateral Movement Idea

TCP 3-Way Handshake

TCP Connection Teardown

DNS Resolution

HTTPS / TLS Handshake

HTTP Request & Response

ARP Resolution

CDN, WAF & Reverse Proxy

SQL Injection – Attack vs Defense

Authentication & Authorization

ARP Spoofing / MITM

Cloud IAM

SOC Investigation

XSS Attack

API Security

Network Routing & Switching

Malware Analysis

API Bearer vs API Key

GraphQL Introspection Risk

OAuth Redirect URI Trap

CORS + Credentials

XXE Entity Declaration

Race on Balance Check

Prototype Pollution Vector

HTTP Request Smuggling Signal

Weak CSP Script Policy

SAML Assertion Trust

Cloud IAM Wildcard

Dockerfile Root User

Kubernetes RBAC Scope

Terraform Public Security Group

SBOM Purpose

SAST in Pipeline Gate

Sigma Detection Intent

YARA Rule Match

DMARC Alignment

DNSSEC Goal

WPA3 vs WPA2

Firmware Update Trust

STRIDE Letter

STIX/TAXII Use

India DPDP Basics