Professionals with a real reason to attack. Penetration testers, red teams, bug bounty hunters, security researchers and CTF players. Tell us about your work and your track record, and a person reviews every request.

Do I need to install anything?

No. The lab runs in your browser. Every session works on its own machine in our cloud, with the tools already installed.

Can it attack any target?

Only targets you are authorized to test. Each session declares a scope, and its machine cannot reach anything outside it.

Is it safe to work with malware?

Yes. Samples stay on the session's isolated machine, which has no route to your computer or to other sessions.

Does it work with CTF platforms?

Yes. Connect a CTFd, rCTF or GZCTF event and its challenges arrive in the lab, ready to work.

Monthly packages with included usage, plus top-ups when you need more. You see the packages and their prices once your access is approved.

Do I stay in control?

Yes. You set the target, the scope and the goal. You can steer the lab with a message or stop a session at any time.

Offensive Lab. From recon to root.

An AI lab that runs offensive security work end to end. Pentests, bug bounty targets and CTF challenges, worked on its own isolated machines with a full toolkit, vision and web search. You set the target and the scope. The lab does the work.

Access by application. Every request is reviewed by a person.

42nd of 1,119 teams at HI Cyber Con 2026, one operator with the lab.

Request access See the benchmarks

Built for people who break things for a living.

Offensive Lab is for professionals with a reason to attack. If that is you, it takes the legwork off your plate.

Penetration testers: Work client engagements inside a declared scope and leave with findings and evidence.
Red teams: Test your own company the way an attacker would, without building a single box.
Bug bounty hunters: Cover more programs. Recon, triage and proof run while you choose the next target.
Security researchers: Take apart binaries, firmware and malware on a machine that never touches yours.
CTF players: Connect a CTFd, rCTF or GZCTF event and work the board together with the lab.

Every session gets its own machine.

Each session runs on a fresh, isolated machine in our cloud. It reaches the targets in your scope and nothing else. Exploits, payloads and malware samples stay inside it. Nothing runs on your computer.

Isolated per session: No machine is ever shared with another customer.
Scope only: Traffic leaves only for the hosts and ranges you declared.
Safe for malware: Unpack, emulate and pick apart samples with no route back to you.
Nothing to install: Everything runs in your browser and on our machines.

The whole toolkit. Already installed.

Every machine comes loaded with the tools you would reach for, 81 of them across six disciplines. The lab picks the right one, runs it, reads the output and chains the next step.

Web and network: nmap, Chromium, sqlmap, gobuster, curl, Impacket, tcpdump, tshark, Scapy, ngrep, tcpflow, netcat, OpenSSL, SecLists
Reversing: radare2, angr, Ghidra, Triton, Qiling, Unicorn, Capstone, ILSpy, CFR, GoReSym, pyinstxtractor, UPX, Wine, QEMU, Detect It Easy, binwalk, ghidriff
Exploitation: GDB, GEF, checksec, ROPgadget, pwntools, one_gadget, angrop, seccomp-tools, patchelf, libdebug, ltrace, strace
Crypto and cracking: John the Ripper, PARI/GP, fplll, hashcat, flatter, z3, SymPy, gmpy2, PyCryptodome, python-flint, fcrackzip, rockyou
Forensics and stego: ExifTool, Sleuth Kit, TestDisk, foremost, steghide, Volatility 3, stegseek, zsteg, outguess, pngcheck, zbar, SoX, multimon-ng, Tesseract, ImageMagick, FFmpeg, regipy, pikepdf
Malware analysis: YARA, pefile, LIEF, FLOSS, malduck, capa, MWCP, Miasm

It sees the screen. It searches the web.

Vision: Screenshots, scanned files and image challenges. The lab looks at them the way you would and points at what matters.
Web search: A version string or an odd error turns up. The lab looks up advisories, write-ups and docs, then tries what applies.

From the first request to the flag.

One session carries the whole engagement. Recon, foothold, escalation and proof, with every request and every finding on the record.

Recon. Services, versions and attack surface mapped.
Foothold. The first way in, tested and confirmed.
Escalation. From user to admin, from one host to the next.
Validation. Every finding proven with the request that shows it.
Report. Findings, evidence and the flag, ready to hand over.

Tested where nobody prepared it.

At HI Cyber Con 2026 one operator worked the board with the lab for three days, against 1,119 teams.

42nd of 1,119 teams
63 of 69 challenges solved
3,901 points

Read every write-up

Not for everyone. On purpose.

A lab that can attack real systems can do real harm in the wrong hands. So Offensive Lab is open by application only, and a person reviews every request before the first session.

Create your account. An email, a password and a second factor.
Request access. Tell us who you are, what you work on and your track record. It takes about two minutes.
Start your first session. Once you are approved, choose a package and open the lab.

Authorized targets only: Test what you own or have written permission to test.
Scope on every request: Each session declares its scope. The machine cannot reach past it.
On the record: Every request the lab sends is logged in the session.

Request access

Questions about the lab

Who can get access?: Professionals with a real reason to attack. Penetration testers, red teams, bug bounty hunters, security researchers and CTF players. Tell us about your work and your track record, and a person reviews every request.
Do I need to install anything?: No. The lab runs in your browser. Every session works on its own machine in our cloud, with the tools already installed.
Can it attack any target?: Only targets you are authorized to test. Each session declares a scope, and its machine cannot reach anything outside it.
Is it safe to work with malware?: Yes. Samples stay on the session's isolated machine, which has no route to your computer or to other sessions.
Does it work with CTF platforms?: Yes. Connect a CTFd, rCTF or GZCTF event and its challenges arrive in the lab, ready to work.
What does it cost?: Monthly packages with included usage, plus top-ups when you need more. You see the packages and their prices once your access is approved.
Do I stay in control?: Yes. You set the target, the scope and the goal. You can steer the lab with a message or stop a session at any time.

Bring the target. The lab does the rest.

Access by application only. Packages are shown once you are approved.

Request access