Practice Labs & Career Tree

What are the ByteBreach practice labs?

The practice catalogue is the assessment half of the academy. The learning paths teach a concept; the practice labs test whether you actually absorbed it and can apply it to an unfamiliar scenario. Every lab is a self-contained scenario with a written briefing, the artefacts you are expected to examine, a task list, and a flag that is validated when you submit it.

The labs are deliberately not multiple-choice quizzes. A question such as "which of these is the correct wildcard mask" can be memorised; a task that gives you a routing table with an unreachable network and asks you to find the misconfiguration cannot. The grading is therefore behavioural, which also means the feedback is specific: when you get a lab wrong, the explanation tells you which step of your reasoning diverged from the expected path.

Which security domains do the labs cover?

The catalogue is organised by the kind of weakness you are being trained to find. You can filter by category, so you can practise a specific weakness rather than a random room.

• Web application security: SQL injection, cross-site scripting, server-side request forgery, insecure direct object references, broken authentication and session handling, and the path from an initial foothold to data exposure.
• Network defence and traffic analysis: reading a packet capture for cleartext credentials and protocol abuse, spotting rogue DHCP and ARP spoofing on a segment, and reconstructing what happened from connection logs.
• Active Directory and Kerberos defence: service ticket abuse, AS-REP roasting, the Kerberoasting path, pass-the-hash, and how to read BloodHound output to find the shortest path to a domain controller.
• Linux privilege escalation: SUID and SGID abuse, sudoers misconfiguration, writable service files, cron and systemd abuse, kernel and container escape techniques, and the enumeration that finds them.
• Cryptography in practice: RSA padding oracle attacks, hash length extension, AES-CBC bit flipping, weak IV reuse, and steganography techniques for hiding data inside ordinary files.
• Host and cloud configuration: over-permissive IAM policies, exposed storage buckets, container misconfiguration, and secret material leaking into logs, repositories, and image layers.

How a lab environment works

Some labs run entirely inside the browser page as an interactive terminal simulation. You type commands exactly as you would in a shell, the parser interprets them, and the output appears in the terminal panel. Nothing leaves your browser and no third-party infrastructure is touched. This is why you can practise safely without a home lab, a virtual machine, or physical hardware.

Other labs supply an artefact instead: a packet capture file to open in Wireshark, a configuration listing to audit, a log bundle to correlate, or a set of challenge files to triage. In those cases the lab states its requirements up front, and the intended workflow is to download the artefact and analyse it locally with the same tools you would use on a real engagement. That habit is the point: you should be building muscle memory for the tools, not memorising where a button is in our interface.

Where a lab depends on a specific tool, we name it and we link to its documentation. Where it depends on a specific piece of software version, we say so, because behaviour changes between releases and we would rather you were not surprised by output that does not match what you read.

How flags are validated and what XP is worth

Flag submissions are trimmed of surrounding whitespace and compared without regard to letter case, so a trailing newline or an inconsistent capital letter will not fail your answer. What will fail it is submitting a labelled value: wrapping the answer in quotation marks, prefixing it with a flag format, or pasting your explanation alongside it. Submit only the value the task asks for. Some tasks accept several equivalent forms, and some require a specific shape, such as a single octet or a comma-separated list, so read the task text carefully before you submit.

Each completed lab awards XP that varies with difficulty, and the XP feeds the same total that drives your rank tier and leaderboard position. A small number of daily challenge entries are reviewed manually because they accept free-form answers, so those can take a little longer to settle than an automatically validated flag.

Safe and authorised use

Every ByteBreach lab targets a sandbox that the platform provides for that purpose. You may work on them freely. You may not point any of these techniques at a system that you do not own or have explicit written permission to test, and you may not use the labs to target other learners or the academy infrastructure. Running an intrusion attempt against someone else's system is unlawful in most jurisdictions regardless of intent, and it is always a breach of the owner's terms of service.

The full detail is in the educational disclaimer and the terms of conditions, and the editorial policy explains how lab content is reviewed and corrected. If a lab behaves incorrectly, or if a flag is rejected when you believe it should have validated, tell us through the contact page with the lab identifier and the exact output you saw.