ARENA

Curriculum

Five tracks, from first packet to full chain.

31 hands-on modules that stack from networking and Linux up to a full red team engagement. Every module ships a live target, a flag you have to earn and a writeup you file afterwards.

Start with FoundationsWhat each plan unlocks →

  • Networking, Linux and the HTTP request lifecycle. You leave this track able to read a packet capture and script a client from nothing.No prerequisites

    capture.pcap · frame 475 bytes00000010002000300040525400123456525400abcdef08004500003d1c4640004006e2510a0a14050a0a140bc93a00506b1a3c029e4f2177501801f66c810000474554202f6c6f67696e20485454502f312e310d0aeth52:54:00:ab:cd:ef → 52:54:00:12:34:56 · IPv4ipv410.10.20.5 → 10.10.20.11 · ttl 64 · proto tcptcp51514 → 80 · [PSH, ACK] · seq 1796881410httpGET /login HTTP/1.1s.send(b"GET /login HTTP/1.1\r\nHost: web-01\r\n\r\n")frame 4 · 75 bytes captured on arena0

  • Injection, deserialisation, SSRF and auth bypasses against applications that fight back. Every module ships its own container.Live targets

  • Break and harden real services on isolated targets. Every module ships a container you spawn yourself, a flag you have to earn, and a writeup you file afterwards.Live targets

  • Multi-host topologies over VPN. Pivot from a DMZ web host into an internal segment your own machine cannot route to.VPN required

  • Full-chain engagements against a running range: initial access, persistence, lateral movement, then a report a client would actually accept.Advanced tier

The path

Each track builds on the last.

Foundations first. Web, binary and network exploitation on top of it. Red team operations pulls all three together.

Start here

Foundations

6 modules · no prerequisites

Web exploitation

9 modules

Binary exploitation

7 modules

Network ranges

5 modules

The full chain

Red team operations

4 modules · Advanced tier

Outcomes

What you leave able to do.

Each track is measured by what you can do at the end of it, not by what you read.

Foundations · 6
Read a packet capture and script a client from nothing. Networking, Linux and the HTTP request lifecycle.
Web exploitation · 9
Find and exploit injection, deserialisation, SSRF and authentication bypasses against applications that fight back.
Binary exploitation · 7
Break real services on isolated targets, then harden them, and file a writeup on both.
Network ranges · 5
Pivot from a DMZ web host into an internal segment your own machine cannot route to, over VPN.
Red team operations · 4
Run a full-chain engagement on a live range: initial access, persistence, lateral movement, then a report a client would accept.

How a module runs

Read it, then do it.

The lesson and the target sit side by side, so theory turns into a flag in the same sitting.

    01

    Read

    Open the module. The lesson stays on the left of the screen while you work.
    02

    Spawn

    Start the module’s own container. It is yours for the session.
    03

    Break

    Work the live target until you have the flag.
    04

    File

    Write up what you did. Writeups and solve history stay with your account.

Questions

Asked before you are.

Where should I start?

Foundations. It has no prerequisites and covers networking, Linux and the HTTP request lifecycle that every later track assumes.

Which tracks need a paid plan?

Network ranges come with Pro, every range on a shared instance, and with Advanced on your own private topology; red team operations sit in the Advanced tier. Jeopardy challenges and walkthroughs are free.

Can trainers assign modules to a cohort?

Yes. The Enterprise trainer portal handles cohorts, assignments and reporting, and you can author your own challenges alongside the catalogue.

What is a module, exactly?

A lesson plus a container you spawn yourself, a flag you have to earn and a writeup you file afterwards.

Keep reading

Step through the gate.

Make an account, open a challenge, find the way in.

Get startedSign in