pwnd.rs · hands-on security training
Get pwnd in the lab, not in production.
Break real-world bugs on throwaway targets, then fix them and prove the fix. 10 story worlds, 79 missions, every one modelled on a breach that actually happened.
Browser only · isolated targets · free until Nov 1, 2026
How a mission works
Three moves. Attack, then defend.
01
Spot it
Read the brief, name the weakness. One answer per team, so talk first.
02
Run the operation
A real terminal into an isolated attack box. Recon, breach, capture: three checkpoint flags, each one unlocking the next.
03
Harden it
Pick the fix that actually closes the hole, or patch the code and let hidden checks prove it. Then the real incident behind the lab is revealed.
Story worlds
Pick a world. Save it.
A Mars colony, a deep-sea station, a haunted smart home. Each world is a campaign of missions across web, crypto, APIs, distributed systems and smart contracts, with a finale when every system is secured.
Secure Coding Foundations
Find it. Fix it. Prove it.
Abyssal
Six thousand metres down, every system matters.
Chronos
Break it in any timeline, fix it in this one.
Glacier
Cold, remote, and quietly exploitable.
Neon City
A megacity runs on APIs. So do its criminals.
Attack to Defend
Break the sandbox. Learn what to lock down.
Orbital
In zero-g, there's no patching on the way down.
Red Planet
Hold the colony. Harden its systems.
Skyhold
A kingdom in the clouds, guarded by code.
Spectre
The smart house is haunted. The bug is real.
The Gilded Vault
The ultimate heist is read-only. You just need the flag.
Wasteland
After the collapse, the survivors kept the servers.
◈ Nothing here is fiction
Every mission is a breach that really happened.
Capture the flag and the debrief tells you who got hit, how, and what it cost. Sourced, dated, and the reason the defensive takeaway sticks.
42 named incidents behind 79 missions, 1988 to 2026. Which one you just re-enacted is revealed only after you capture the flag.
Instructor-led training · on site or virtual
Bring an instructor into the room, or onto the call.
A day with your developers, at your office or over a video call: one world, the group split into teams, every mission a real breach attacked and then fixed, with the instructor steering and debriefing between missions. Virtual works exactly like on site: the same join code, the same leaderboard shared on screen.
01
They've done it, not watched it
Slides don't change habits. A developer who has just dumped a database through a login form writes different queries on Monday. Every mission is attacked first, then fixed, by the people who ship your code.
02
The whole team, one day, one score
Teams of three or four race on a shared leaderboard. Juniors watch how seniors think, seniors meet the traps of a stack they didn't grow up with, and nobody hides at the back. Nothing to install: a browser and a join code.
03
Every mission is a real breach
Each lab is modelled on a named incident. The debrief gives the company, the year and what it cost, which lands harder than a CWE number ever will, and ends with the fix your team takes home.
A full day, hour by hour
- 09:30BriefingThe world's story, the rules, teams on the board. Five minutes to the first terminal.
- 10:00Missions 1 to 3Spot the weakness, run the operation, harden it. The instructor debriefs between missions and keeps every team moving.
- 13:30Missions 4 to 6Harder targets, bigger bonuses for first solves. Hints cost points, so teams argue before they ask.
- 16:00FinaleThe world is saved, scores are called, certificates are issued. Thirty minutes on what to change in your own codebase tomorrow.
Half-day format: briefing, three missions, finale. Small on purpose: at most ten people per session, so the instructor sees every team's terminal. Bigger teams book several sessions.
Join code on the projector
Participants type six characters. No installs, no VPN, a browser is enough.
Teams in one click
Auto-balance or drag names. Points go to the team, MVP credit to the player.
Live leaderboard
Projector view with per-mission progress squares, MVP board and a solve feed.
Instructor pacing
Unlock missions one at a time. First solve +20%, points decay to 50% after two hours.
Guide, slides, walkthroughs
A running order, debrief talking points and stage-by-stage answers per world.
Certificates
Finish a world, leave a review, get a verifiable certificate link.
Book a training, on site or virtual · custom pricing
Up to ten people per session, half a day or a full day, at your office or remote. We bring the instructor, the platform and the materials; you bring laptops. Priced per session, not per seat: tell us the team size, the date and on site or virtual, and we’ll propose a world and a quote.
Pricing
Start free. Unlock every world when you're ready.
Pro
€12/mo
or €120/yr. All 10 story worlds, every domain, certificates. Free until Nov 1, 2026.
Get ProTeam
€15/seat/mo
Everything in Pro for everyone. Invite by link or email domain, VAT invoices, seat management.
Set up a teamInstructor-led training
Custompriced per session
Half or full day, on site or virtual, up to ten people per session. The quote depends on group size, duration and location; platform access for the day is included.
Request a quotePrices include VAT where applicable · Pro and Team renew automatically, cancel at period end · training is quoted and invoiced per session
Questions
Is this legal?
Yes. Every target is ours: a throwaway container with no route to the internet, created for you and destroyed afterwards. The terms forbid using what you learn against systems you don't own.
Do I need to install anything?
No. The terminal, the editor and the targets all run in the browser. Tab completion, vim and reverse shells work like over SSH.
What do I learn?
The OWASP Top 10 and beyond: access control, injection, SSRF, crypto mistakes, JWT flaws, race conditions, smart-contract bugs. Each lab is modelled on a named real breach.
How does billing work?
Free covers the foundations. Pro unlocks every world for €12/month or €120/year, renews automatically, cancel at any time until the period ends. Teams pay per seat and can invite by link or email domain. Instructor-led trainings are not a subscription: each session is quoted and invoiced separately, based on group size, half or full day, and on site or virtual.
Can I run this for my company?
Yes, two ways. Book an instructor-led training, on site at your office or virtual over a video call: an instructor runs a world with the group split into teams. Or run sessions yourself on a Team plan: join code, teams, projector leaderboard and instructor materials are included. Instructor-led sessions take up to ten people, so bigger teams book several.
Your first target is ten seconds away.
Create an account, launch a lab, capture a flag. No card needed until Nov 1, 2026.
Start free