Your own web-app hacking range for red, blue & purple teams.
Spin up isolated, intentionally-vulnerable targets and a live in-browser attacker box. Hack, capture the flag, and auto-verify — all on your own infrastructure.
A full training range, not just a target list.
Everything a SOC or pentest team needs to practice against realistic web-app flaws — in a controlled, isolated environment.
Live attacker box
Each instance launches a Kali-based workstation with an in-browser terminal (ttyd) and web-pentest tools: nmap, sqlmap, ffuf, nikto, gobuster, wordlists.
Per-instance isolation
Every user gets their own target + attacker pair on a dedicated Docker network. Nothing reaches your other services — auto-torn-down on a TTL.
Auto-checker + flags
Unique FLAG{…} per instance, submitted in the portal. A per-challenge checker confirms the objective was actually achieved.
Red, Blue & Purple tracks
Offensive targets, defensive DFIR evidence, and purple labs that fuse the two — exploit a target, then engineer the detection — all graded the same way.
Admin UI + PDF writeups
Create, edit and disable challenges from the browser, and download a full technical writeup PDF per challenge — admin-only. Members see only objectives and hints.
Scoreboard & teams
Per-user and per-team scoring with wrong-submission penalties and a full audit trail — ready for internal CTF events and onboarding drills.
Spin up. Exploit. Verify.
Launch an instance
Pick a challenge and start it. The backend spins up the vulnerable target and your attacker box on an isolated network.
Hack from the box
Recon and exploit from the in-browser terminal. The target is reachable at the hostname target.
Flag & Run Check
Submit the flag, then hit Run Check — the checker confirms the objective and the solve lands on the scoreboard.
● Red Team · 28
- Injection — SQLi, command injection, NoSQLi, SSTI → RCE, XXE, XPath
- Access control — IDOR, mass assignment, LFI / path traversal
- Server-side — SSRF, SSRF → cloud metadata, unrestricted upload, insecure deserialization
- Auth, API & logic — JWT weak secret, GraphQL, race condition, CORS, open redirect, prototype pollution
- Insane — blind SQLi exfil, SSTI sandbox escape, blind OOB XXE, JWT kid SQLi, prototype pollution → RCE
- Operation BlackVault — a 3-stage connected offensive campaign (perimeter breach → deserialization RCE → SSRF to the vault)
● Blue Team · 33
- Log triage — attacker ID, Log4Shell JNDI, SQLi-dump triage, credential stuffing
- Hunting — webshell hunt, persistence (cron/systemd, Run-key), rootkit, dropper & macro analysis
- Network — DNS tunneling, proxy-log exfiltration, C2 beacon detection, PowerShell decode
- Memory & forensics — injected-process triage, fileless-APT reconstruction, Cobalt Strike config carving
- Insane — DNS exfil decode, LKM kernel rootkit, AD golden ticket, APT kill-chain correlation
- Operation Meridian — a 6-stage connected IR campaign (phish → dropper → implant → lateral → exfil → capstone), each stage's finding feeding the next
● Purple Team · 3
Multi-stage insane labs that fuse offense and defense: exploit a live target, analyse the telemetry it generates, then author a precise detection rule that catches the attack with zero false positives. The flag unlocks only when you have both broken in and built the detection — SQLi, command-injection RCE, and password-spray editions.
64 challenges, hand-built to be vulnerable.
No third-party images — every target and evidence set is purpose-made, with a per-challenge checker and an instructor writeup.
Boring, solid infrastructure.
The same stack as the rest of your toolset — no exotic dependencies, runs anywhere Docker runs.
Built by a SOC operator, for SOC teams.
The project
RangeSphere is a free, self-hosted training range for practising web-application attack and defence. Every target and evidence set is purpose-built — no third-party images — and each challenge spins up in its own isolated instance with a live attacker or analyst box in the browser. It's meant for SOC onboarding, internal CTFs, and keeping red, blue and purple skills sharp on infrastructure you control.
The author
Shabran Al Khairi runs a Managed Security Service Provider (MSSP) and builds the SOC tooling behind it. RangeSphere is part of that toolset — shared as freeware for the wider security community.
Connect on LinkedIn ↗Up and running in three commands.
Clone, set your secrets, and run. The bootstrap script builds the portal, the attacker box and every challenge image, then seeds the catalog.
# 1 — configure cp .env.example .env # 2 — build portal, attacker box + challenges ./start.sh # 3 — open the portal http://localhost:8080