A fully offline attack-chain lab across three hosts - scan, enumerate, crack weak credentials where needed, exploit, and capture a flag on each. Save your session as a shareable practice report.
Ideal for: CompTIA PenTest+ or OSCP-track students who need to practice the full recon-to-report methodology, not just isolated tool syntax.
What you'll practice
Chain scan → enum → hydra → exploit across three distinct vulnerable hosts
Practice recognising when a service needs cracked creds vs. a direct exploit
Capture a flag per host and generate a progress report to save and share
Start practicing
Pentest Simulator - Capstone Lab is part of Practice Tools. Sign in or create an account, then subscribe for ₦4,000/month to unlock it.
📋 Lab Instructions
Step-by-step exercises for Pentest Simulator - Capstone Lab - read them here, then practice live in the tool above.
Getting Started with the Pentest Simulator -- Capstone Lab
Last updated: August 8, 2026
What you're practicing: the full recon-to-exploitation methodology, not just one tool's syntax.
1. Click "Open" to launch the terminal.
2. Type targets to see the three hosts in this capstone lab (10.20.20.0/24).
3. For your first host, run scan to see its open ports.
4. Run enum -- read the hint it gives you carefully, it tells you what to try next.
5. If the hint mentions weak or default credentials, run hydra to crack them.
6. Run exploit (add --cve if the enum hint gave you one) to get a shell and capture that host's flag.
7. Repeat scan, enum, hydra (if needed), then exploit for the other two hosts.
8. Run report at any time to see your progress across all three hosts.
9. Once you've captured what you can, click Save This Session as a Project to keep your report.
Tip: don't skip straight to exploit -- each host is built so enum tells you exactly what the next command should be. Reading the hint IS the exercise.