Cyber Range Training Tools
Cyber Range Training platforms and simulation environments for hands-on cybersecurity training and incident response exercises.
Browse 155 cyber range training tools
FEATURED
USE CASES
HackTheArch is an open-source Ruby on Rails-based scoring server platform designed for hosting and managing Cyber Capture the Flag competitions with web-based problem management and hint systems.
Intentionally vulnerable Kubernetes cluster environment for learning and practicing Kubernetes security.
CTFd is a web-based framework for creating and managing Capture The Flag cybersecurity competitions with customizable challenges, scoring systems, and team management capabilities.
A deliberately vulnerable web application that uses WebSocket communication to provide a training environment for learning about WebSocket-related security vulnerabilities.
AzureGoat is a deliberately vulnerable Azure cloud infrastructure that incorporates OWASP Top 10 vulnerabilities and Azure service misconfigurations for security training and penetration testing practice.
A project providing a low-cost ICS testbed with affordable hardware, instructions, and attacker scenarios to facilitate learning in industrial security.
A Windows kernel driver intentionally designed with various vulnerabilities to help security researchers practice kernel exploitation techniques.
FBCTF is a platform for hosting Jeopardy and King of the Hill style Capture the Flag competitions with support for various scales and participation models.
echoCTF is a cybersecurity framework for running Capture the Flag competitions and training exercises on real IT infrastructure.
A deliberately vulnerable GraphQL application designed for security testing and educational purposes, containing multiple intentional flaws for learning GraphQL attack and defense techniques.
GRFICS is a Unity 3D-based framework that provides a virtual industrial control system environment for practicing ICS security attacks and defenses with visual feedback.
InsecureBankv2 is an intentionally vulnerable Android application with a Python back-end server designed for educational purposes in mobile security testing and Android vulnerability research.
A deliberately vulnerable PHP/MySQL web application designed for security training, testing, and educational purposes in controlled environments.
DVXTE is a Docker-based training platform containing multiple vulnerable applications designed for cybersecurity education and skill development.
A collection of vulnerable web applications containing command injection flaws designed to test and evaluate detection and exploitation tools like commix.
DetectionLab is a pre-configured Windows domain environment with security tooling and logging designed for cybersecurity training and detection capability development.
SecGen is an open-source framework that automatically generates vulnerable virtual machines and hacking challenges for cybersecurity education and penetration testing training.
Deliberately vulnerable CI/CD environment with 11 challenges to practice security.
A Node.js CLI tool that automates the setup of CTF events using OWASP Juice Shop challenges across multiple CTF frameworks.
A deliberately vulnerable ARM/ARM64 application with 14 different vulnerability levels designed for CTF-style exploitation training and education.
A training program that teaches security professionals how to conduct penetration testing and attack simulations against AWS and Azure cloud infrastructure.
A lightweight CTF platform with simple setup and difficulty-based scoring that removes timezone advantages from competitions.
Haaukins is an automated virtualization platform that provides hands-on cybersecurity education through capture the flag exercises in controlled vulnerable environments.
Create a vulnerable active directory for testing various Active Directory attacks.
Cyber Range Training Tools FAQ
Common questions about Cyber Range Training tools, selection guides, pricing, and comparisons.
A cyber range is a simulated IT environment where security teams practice defending against realistic attacks without risk to production systems. SOC analysts use them for training on detection and response, red teams practice attack techniques, and organizations run tabletop exercises and incident response drills. Ranges replicate real infrastructure (Active Directory, cloud, OT) with injected attack scenarios.
