🤝 Help a fellow researcher fund advanced OT/ICS security tools: Support the project
90+ LABS · OFFLINE CORE · NO ADS

Ethical
Hacking
Labs.

// by VulnInspect · iOS + Android · Free to start

Hands-on ethical hacking, OSINT, Linux privilege escalation, and CTF training in a realistic simulated environment. Move beyond theory — investigate, enumerate, exploit, and learn directly on your phone or tablet.

Download on theApp Store GET IT ONGoogle Play
Explore the labs ↓
vulninspect ~ hacking-terminal
$ vulninspect --load-lab sqli-union-based
✓ Lab environment initialized [OFFLINE MODE]
✓ Target: Omega Logistics – user database
$ sqlmap -u "http://target/item?id=1" --dbs
[!] detected: MySQL ≥ 5.0 backend
available databases: [omega_db, admin_db]
$ ' UNION SELECT username,password,3 FROM users--
admin:5f4dcc3b5aa765d61d8327deb882cf99
[ ARENA CONQUERED ] +350 XP · Rank: Senior Operative
90+ Hands-on Labs
8 Languages
0 Ads
5 CTF Arenas
// Comprehensive Curriculum

Don't just read — execute.

Build practical tradecraft across web security, OSINT, network pentesting, and Linux privilege escalation. Core training runs locally in a safe simulated environment with no remote target required.

All categories
Recon & Tools
Injection
Client-Side
Auth & Sessions
Advanced Threats
OSINT
Internal Security
Reconnaissance
Web Architecture & Fundamentals
Deconstruct the modern web. Master the core protocols, infrastructure layers, and HTTP mechanics.
HTTP/HTTPS Front-End Back-End APIs
Reconnaissance
Traffic Interception & Manipulation
Master the Proxy suite. Learn to capture, inspect, and forge raw HTTP requests on the fly.
Proxies Interception Repeater Intruder
Reconnaissance
Target Reconnaissance
Map the attack surface. Discover hidden endpoints, subdomains, and internal infrastructure through active and passive intel.
DNS Enum vHosts Fingerprinting Crawling
Reconnaissance
Advanced Web Fuzzing
Automate your attacks. Uncover hidden directories, bypass virtual hosts, and fuzz input parameters at scale.
FFuF Dir Fuzzing Param Fuzzing Pipelines
Client-Side Attacks
Client-Side Code Injection (XSS)
Weaponize the browser. Exploit reflected, stored, and DOM-based vulnerabilities to compromise user sessions.
Reflected/Stored DOM XSS Blind XSS Cookie Stealing
Injection Attacks
Database Exploitation (SQLi)
Break the data tier. Subvert backend queries to extract credentials, bypass authentication, and map schemas.
Auth Bypass UNION Based Blind SQLi RCE
Injection Attacks
OS Command Injection
From web to shell. Exploit input sanitization failures to execute arbitrary operating system commands on the target.
Separators Filter Evasion Obfuscation Out-of-Band
Auth & Sessions
Authentication Bypass & Brute-Forcing
Compromise identity boundaries. Exploit weak logic, bypass OTPs, and brute-force access controls.
Brute-Forcing Passwords OTP Bypass Rate Limits
Auth & Sessions
Session Hijacking & State Manipulation
Steal the keys to the kingdom. Exploit insecure cookies, manipulate state, and hijack active user sessions.
Hijacking Fixation CSRF Open Redirects
Advanced Threats
Malicious File Uploads
Bypass extension filters and MIME checks to plant web shells, polyglot images, and malicious payloads on the server.
MIME Spoofing Blacklist Bypass Polyglots Web Shells
Advanced Threats
Path Traversal & File Inclusion
Break out of the web root. Exploit LFI/RFI flaws to read sensitive internal files, poison logs, and escalate to RCE.
LFI / RFI Traversal PHP Wrappers Log Poisoning
Advanced Threats
Backend Infrastructure Threats
Attack the core logic. Chain SSRF, Template Injection (SSTI), and Prototype Pollution to pivot into internal networks.
SSRF & Gopher SSTI (Jinja/Twig) Prototype Pollution
Advanced Threats
Modern API Exploitation
Master the art of attacking modern APIs. Learn to exploit Web Services, RESTful architectures, and complex data structures.
SOAP Spoofing XML-RPC REST ReDoS
Advanced Threats
Advanced Web Vulnerabilities
Explore the core vulnerabilities that plague modern web applications. Learn to bypass authorization mechanisms and exploit XML parsers.
Verb Tampering IDOR XXE Injection OOB Exfiltration
Open Source Intelligence
OSINT Investigations
Investigate identities, metadata, files, images, videos, infrastructure, and developer history. Correlate evidence into defensible findings.
Metadata Visual Verification Git History Evidence Correlation
Internal Security
Linux Privilege Escalation
Turn a low-privileged shell into a structured local assessment. Enumerate the host, identify weak privilege boundaries, and practice safe escalation paths.
SUID sudo cron PATH Hijacking Docker / LXD
// The Hacker Arena

CTF Mode:
Prove your skills.

Put everything to the ultimate test in mission-based Arenas. Solve complex, chained-vulnerability scenarios locally, earn XP, and track your progression across the app.

  • Chained multi-vulnerability scenarios — not isolated drills
  • WAF simulations, filter evasion, payload obfuscation
  • Earn XP and unlock badges locally as you progress
  • Privacy-first: core progress is local; optional sign-in enables cloud sync and leaderboard features
// OPERATIVE PROFILE SYNC: OPTIONAL
Current Rank Elite Operative
XP Earned 9,840 XP
Module Progress 42 / 90+ Labs
Earned Badges
SQLi Master XSS Hunter Proxy Ninja RCE Elite
✦ [ ARENA CONQUERED ] · Omega Logistics ✦
// Key Features

Built different.

Every design decision serves one goal: helping you think and act like a real penetration tester.

01
⚡
100% Offline Simulator
No internet, no latency, no excuses. Practice on the metro, in a coffee shop, or in airplane mode. Everything runs locally on-device.
02
🎮
Gamified Progression
Earn XP, unlock achievements, and level up your hacker rank from Trainee all the way to Elite Operative.
03
🛡
WAF & Defense Realism
Experience realistic WAF simulations, filter evasion challenges, and payload obfuscation — not sanitized toy labs.
04
🌗
8 Themes · 8 Languages
Choose from multiple terminal and interface themes and learn in English, Spanish, Indonesian, French, Portuguese, Arabic, Hindi, or Bengali.
05
🔒
Privacy First
No ads and no advertising tracking. Core progress is stored locally, with optional account-based cloud sync when you choose to sign in.
06
📐
Structured Learning Path
From web fundamentals to advanced exploitation. Each module includes deep technical dives, interactive diagrams, and knowledge-verification quizzes.
// Who is this for?

Built for people
who build things — then break them.

Students
Solid Foundation
Preparing for major offensive security exams? While this app won't replace a full course, it builds a rock-solid hands-on foundation for the core web concepts you'll face.
OSCP CEH CPTS CWES
Developers
Think like an attacker
The best way to write secure code is to understand how it gets broken. Learn to identify the same vulnerabilities attackers look for — before they do.
Pentesters
Refine your tradecraft
Test new payloads, sharpen your methodology, and practice chained exploits in a safe, offline sandbox — no authorization paperwork required.
No ads or advertising tracking
Core progress stored locally
Core training works offline
Optional cloud sync with account
Ethical & legal training framework
iOS + Android · Free to start
// The App

The mainframe
is waiting.

Step into the grid. Deconstruct the architecture. Master the exploit. Everything you need to master ethical hacking — in your pocket.

  • Free to start on the App Store and Google Play
  • From David Fodor
  • Regular updates with new labs and challenges
  • 90+ hands-on labs, OSINT, CTF arenas, and Linux privilege escalation
  • 8 languages and multiple terminal/interface themes
Download on theApp Store GET IT ONGoogle Play
// VULNINSPECT · DASHBOARD
SQL Injection Suite
Union-Based80%
XSS & CSRF Labs
Client-Side55%
SSRF & Prototype Pollution
Advanced20%
🏆 Omega Logistics – CTF Active
[ ARENA CONQUERED ] · +350 XP earned
⚡ +1,200 XP · Senior Operative · 64% → Elite
// Join now

Step into
the grid.

Free to start. No ads. Core labs work offline — practical cybersecurity training on iPhone, iPad, and Android.

Download on theApp Store GET IT ONGoogle Play

ethicalhackinglabs.com · by David Fodor · Budapest, HU