Learn to hack — ethically — by doing.

Twelve weeks of hands-on labs that run in Docker and open in a friendly console or your browser. Real tools — nmap, Wireshark, Metasploit-class targets, John, Hydra — against safe, deliberately vulnerable machines. You just log in and start.

Get started Browse the modules

bash — ./start.sh

  +=================================================+
  |   E T H I C A L   H A C K I N G   ·   L A B S     |
  |   Week 4: Scanning Targets (nmap)                |
  +=================================================+

  Environment up. You are logged in.

  lab> connect
  attacker:~$ nmap -sV 10.0.0.0/24
  10.0.0.20  80/tcp   open  http    nginx
  10.0.0.30  22/tcp   open  ssh     OpenSSH 9.2
  lab>

Get started

First time? About 10 minutes — most of it Docker installing. Done once.

Install Docker Desktop

Free, one-time, and the only software you need. Download for your system ↗, install it, and start it — wait until it shows “running”.

Download the labs — no git needed

⭳ Download the ZIP, then unzip it. You'll get a folder named ethical-hacking-docker-labs-main — put it somewhere easy, like your Desktop.

On Windows, “Extract All” nests it one level deeper — ethical-hacking-docker-labs-main\ethical-hacking-docker-labs-main. That's normal: the inner folder (the one containing start.bat) is the one you want. Move it somewhere easy and delete the empty outer one.

Launch it

Open the folder and double-click start.command.
First time only: if macOS blocks it, right-click the file → Open → Open.
A Terminal window opens, the machines boot, and you land at the lab> prompt. Pick a module (see the cards below) and follow it.

Prefer the terminal? Open Terminal, type cd (with a trailing space), drag the folder onto the window, press Enter, then run ./start.sh

One-time: install Git for Windows — it's the lab launcher. Run the installer and click Next through every screen; the defaults are all fine.
Open the unzipped folder — the inner one, containing start.bat — and double-click start.bat.

If a window flashes open and vanishes: right-click an empty spot inside the folder → Open in Terminal, type .\start.bat and press Enter — the message stays on screen. It usually says Docker Desktop isn't running yet.

Open a terminal in the folder — in most file managers, right-click → Open Terminal Here.
Run ./start.sh and pick a module.

Or from any terminal: cd path/to/ethical-hacking-docker-labs-main && ./start.sh

The twelve-week programme

One lab per week. Click a card for what it teaches and how to run it.

Part of the Assume-Breach series

Hands-on security labs across the lifecycle — plus two companion books and a game that tie it together. Found one? Here's the rest — or browse the whole series on the series home.

Offensive · break inEthical HackingYou are here

Offensive · move throughLateral MovementPivot deeper once you have a foothold DefensiveAssume BreachDefend assuming the attacker is already in Post-breachDigital ForensicsReconstruct the incident from the evidence Govern · auditSecurity AuditAudit a company against the Essential Eight The gameIncident Zero ↗Play the whole lifecycle — print & play The bookAssume Breach ↗The defender's-mindset thesis behind the labs The bookSubstantiate, Don't Assume ↗Security audit & controls — prove it, don't assume it