Try an AI security lab — free
Acme's new chatbot holds a secret it must never tell. Trick it into leaking, then switch sides and close the hole. Short, simulated labs you can play right now in a scripted terminal: attack, defend and investigate. Lab 1 needs no account. Real StationX hands-on labs run real machines in your browser; these give you the feel of one, for free.
← Back to the AI Security Engineer — career path roadmap
For learning only. The targets are fictional. In the real world, only ever test systems you own or are explicitly authorised to test.
- ▶Lab 1 — Recon to shellRecon, enumeration, information disclosure and credential reuse · ~5 min
- 🔒Lab 2 — Breaking a loginWeb enumeration and SQL injection · ~4 minLab 2 is locked for now — finishing Lab 1 unlocks it. Lab 2 onward needs a free account.
- 🔒Lab 3 — Shut the doorLog analysis, brute-force detection and containment · ~4 minLab 3 is locked for now — finishing Labs 1 and 2 unlocks it. Lab 2 onward needs a free account.
- 🔒Lab 4 — The leaver's laptopHidden files, file signatures, hashing and building a timeline · ~4 minLab 4 is locked for now — finishing Labs 1 to 3 unlocks it. Lab 2 onward needs a free account.
- 🔒Lab 5 — Left openCloud identity, finding a public storage bucket and blocking public access · ~4 minLab 5 is locked for now — finishing Labs 1 to 4 unlocks it. Lab 2 onward needs a free account.
- 🔒Lab 6 — Cracked in a secondIdentifying a hash, offline password cracking and a strong password policy (length, MFA, slow salted hashing) · ~5 minLab 6 is locked for now — finishing Labs 1 to 5 unlocks it. Lab 2 onward needs a free account.
- 🔒Lab 7 — Make it talkPrompt injection, system prompt leakage and layered AI defences (isolation, output filtering, least privilege) · ~5 min
- ★Lab 8 — The real thingreal machines, in your browserMembership →
Your progress is saved in this browser only.
Lab 1 done! Create a free account to unlock Lab 2 — it saves your spot and opens the next challenge.
Lab 1 complete — nice work.
You just did what a penetration tester does on day one: you practised recon, enumeration, information disclosure and credential reuse. This was a simulation; the commands were scripted.
Real hands-on labs that teach this — these run real machines in your browser:
- Scanning with Nmap
- Preliminary Scanning
- Host Identification Scanning with Linux
- Open Source Password Cracking
Lab 8: the real thing. StationX Membership opens hundreds of hands-on labs on real machines, with roadmaps that take you from here to certified.
Lab 2 complete — nice work.
You just did what a web app tester does on day one: you practised web enumeration and SQL injection. This was a simulation; the commands were scripted.
Real hands-on labs that teach this — these run real machines in your browser:
- WebApp Attack PCAP Analysis
- Core Impact Web Application Penetration Testing
- Hardening C#.NET Web Apps - Broken Authentication
Lab 8: the real thing. StationX Membership opens hundreds of hands-on labs on real machines, with roadmaps that take you from here to certified.
Lab 3 complete — nice work.
You just did what a SOC analyst does on shift: you practised log analysis, brute-force detection and containment. This was a simulation; the commands were scripted.
Real hands-on labs that teach this — these run real machines in your browser:
- Log Analysis
- Searching for Indicators of Compromise
- Log Correlation & Analysis to Identify Potential IOC
- LNX101 - Setting Up a Firewall With UFW and Firewalld
Lab 8: the real thing. StationX Membership opens hundreds of hands-on labs on real machines, with roadmaps that take you from here to certified.
Lab 4 complete — nice work.
You just did what a digital forensics investigator does on a real case: you practised hidden files, file signatures, hashing and building a timeline. This was a simulation; the commands were scripted.
Real hands-on labs that teach this — these run real machines in your browser:
- Hash Verification
- Creating a Forensic Image
- Data Recovery with Autopsy
- Manually Creating a Baseline with MD5Deep
Lab 8: the real thing. StationX Membership opens hundreds of hands-on labs on real machines, with roadmaps that take you from here to certified.
Lab 5 complete — nice work.
You just did what a cloud security engineer does on a real audit: you practised cloud identity, finding a public storage bucket and blocking public access. This was a simulation; the commands were scripted.
Real hands-on labs that teach this — these run real machines in your browser:
- Configure File Encryption and Access Logging [Guided]
- Create Buckets, Versioning, and Permissions with Amazon S3 [Guided]
- Can You Provide Secure Access to AWS Data and Resources [Advanced]
- Implement AWS Credentials and Policies by Using IAM [Guided]
Lab 8: the real thing. StationX Membership opens hundreds of hands-on labs on real machines, with roadmaps that take you from here to certified.
Lab 6 complete — nice work.
You just did what a security analyst does when a password leak lands: you practised identifying a hash, offline password cracking and a strong password policy (length, MFA, slow salted hashing). This was a simulation; the commands were scripted.
Real hands-on labs that teach this — these run real machines in your browser:
- Perform Password Cracking [Guided]
- Open Source Password Cracking
- Evaluate the Risk of Password Cracking to Your IT Environment [Guided]
- Configure Multi-factor Authentication in Microsoft Entra ID [Guided]
Lab 8: the real thing. StationX Membership opens hundreds of hands-on labs on real machines, with roadmaps that take you from here to certified.
Lab 7 complete — nice work.
You just did what an AI security engineer does before a chatbot goes live: you practised prompt injection, system prompt leakage and layered AI defences (isolation, output filtering, least privilege). This was a simulation; the commands were scripted.
Real hands-on labs that teach this — these run real machines in your browser:
- Working with AI Prompts in Azure OpenAI Studio [Guided]
- Creating a Chatbot from a Custom AI Prompt [Guided]
- Configure AI Prompts by Using Company Data [Guided]
Lab 8: the real thing. StationX Membership opens hundreds of hands-on labs on real machines, with roadmaps that take you from here to certified.