hands-on security lab

Learn security tools by using them_

Foothold drops you in front of real tool output — port scans, packet captures, hash dumps, SIEM logs — and asks you to find the answer, the way you would on the job. No slideshows, nothing to install.

Try Nmap or Wireshark free — no account needed. Create a free account to unlock the rest and save your progress.

24hands-on rooms

5tracks, one story

20+real tools

0setup — it’s all in the browser

One breach, five vantage points

Every room is part of the same incident — the FieldKit breach. You work it from every seat, so the tools connect into one story instead of sitting in isolation.

1Red Teambreak innmap · sqlmap · hydra · netcat · privesc 2Blue Teamdetect itsplunk · sigma · suricata · osquery 3DFIRinvestigatevolatility · sleuthkit · yara · misp 4GRCgovern itvuln mgmt · audit · PCI · ISO 27001 +Cloud securitya separate trackEC2 · S3

How a room works

Watch

A short briefing sets up the tool and where it fits in the breach.

Learn

Read the essentials and answer questions — checked on the server, never revealed to the browser.

Practice

Drive a simulated terminal or console and pull the answer straight out of real-looking output.

Get your first foothold.

Start with Nmap and follow the breach all the way to the incident report.

Foothold is an educational cybersecurity training platform. Every lab is a simulation — scripted tool output that runs entirely in your browser; nothing here attacks real systems, and no real credentials are collected. Apply what you learn only to systems you own or are explicitly authorised to test.

hands-on security lab

Learn security tools by using them_

No slideshows. Each room drops you in front of real tool output — scans, packet captures, hash dumps — and asks you to find the answer, the way you would on the job.

Getting started

Red Team

Blue Team

Digital Forensics and Incident Response (DFIR)

Governance, Risk & Compliance (GRC)

Cloud security

Capstone

Prototype note. Answers are checked on the server and never sent to the browser. Signed-in progress and points are recorded server-side. The tool output shown in each room is scripted for the walkthrough.

← all rooms

0tasks

0points

0solved

—difficulty

You're playing as a guest. Correct answers count, but they're lost when you leave. Create an account to keep your progress and get on the leaderboard.

← all rooms

Leaderboard

Top 20 by points. Ties go to whoever got there first.

← all rooms

Learn security tools by using them_

One breach, five vantage points

How a room works

Get your first foothold.

Learn security tools by using them_

Getting started

Red Team

Blue Team

Digital Forensics and Incident Response (DFIR)

Governance, Risk & Compliance (GRC)

Cloud security

Capstone

Section cleared ✓

Leaderboard

Your progress

Delete account

Save your recovery code

Reset password

Change password

New recovery code