KillChain Labs Documentation
Master browser-based offensive and defensive cybersecurity training. Learn how missions, browser labs, scoring, and progression work.
1. What is KillChain Labs?
KillChain Labs is a premium browser-based cybersecurity operator-training platform. We train offensive and defensive security operators through interactive, hands-on missions organized across the full Cyber Kill Chain framework.
Unlike traditional passive learning platforms, there are no lectures to watch or generic multiple-choice quizzes to memorize. You solve realistic challenges, analyze evidence, and manipulate tools inside isolated range environments to build practical, measurable skills.
2. How Missions Work
Missions are structured hands-on scenarios mapped directly to one of the 7 phases of the Cyber Kill Chain:
Passive and active information gathering on a target.
Creating malicious payloads and attack tools.
Transmitting the weapon to the target environment.
Triggering vulnerability execution on the target.
Establishing persistence on the compromised system.
Command and control channel communication.
Achieving the final goal — exfiltration, disruption, etc.
Missions Loop Checklist
- 1. Read the scenario briefing to identify the security domain and attack objectives.
- 2. Launch the isolated browser lab or configure your local environment.
- 3. Perform enumeration and analyze target systems using security tools.
- 4. Collect evidence files or strings to document your progress.
- 5. Submit the final flag to prove objectives have been met.
- 6. Review the mission debrief writeup to learn alternative methods.
3. What Mission 0 Teaches
Create your account with email/password, Google OAuth, or GitHub OAuth. New email/password accounts verify by email OTP before onboarding. Optional two-factor authentication (MFA) can be enabled afterward from Settings.
All new operators then begin with Mission 0: Onboarding. This non-technical orientation introduces you to the system mechanics and configures your learning preferences:
- →Callsign Setup: Establish your operator alias on the range.
- →Diagnostic Assessment: A short questionnaire to gauge your starting IT background and cyber security experience level.
- →Role Selection: Choose a recommended Operator Path (Offensive Operator, Defensive Analyst, Cloud Defender, etc.) to target your training.
Completing Mission 0 activates your dashboard, builds your initial skill radar, and unlocks your first set of training challenge recommendations.
4. How Browser Labs Work
Browser labs run isolated target systems and tools directly in your browser. Each lab is provisioned on-demand, creating a private sandbox containing the necessary systems, networks, or file artifacts needed to investigate.
Depending on the mission type, your browser layout will adapt to include an in-browser terminal, interactive web applications to audit, target status panels, or hint ladders.
5. How Evidence Submission Works
To prevent guessing, challenges require concrete proof of execution. You submit evidence in the following formats:
- →Normalized Answers: Exact strings like IP addresses, open ports, usernames, or files discovered.
- →Flags: Cryptographic strings matching the `KCL{...}` pattern hidden inside target file systems, database schemas, or traffic captures.
6. How Ranks and Points Work
Missions award points based on difficulty:
Each challenge may have up to 3 hints. Using a hint costs 25% of the base points. The absolute minimum payout is 10% of base points (floor: 10 pts) no matter how many hints you unlock.
Use hints strategically — they reduce your score on that challenge permanently.
Ranks are earned based on your total point count:
Difficulty 3+ challenges are locked until you complete at least 3 challenges at the previous difficulty tier.
7. Leaderboard
The leaderboard ranks all operators by total points, updating live as challenges are completed — no refresh needed.
- →Time Filters: Switch between All Time, This Month, and This Week to see rankings over different periods.
- →Your Rank: Signed-in operators see a banner with their current position, total points, and challenges completed.
- →Row Highlighting: Your own row is highlighted in the table so you can spot it among the ranked list.
8. How Local Tools Extend the Experience
For advanced missions, or if you prefer using your own local tooling suite (like custom Python scripts, specialized local fuzzers, or full Wireshark GUI), you can connect to target environments using a local lab setup.
Interactive lab preflight
Use this to preview the exact setup path that fits your machine before you open a challenge.
Host OS
Environment
Docker preflight
Best when you want the fastest, lowest-friction way to launch a safe local practice environment.
Install and enable Docker
- Install Docker Desktop for your Mac architecture.
- Grant Docker file-sharing access for the directories you want to use in labs.
Launch the lab container
docker pull kalilinux/kali-rolling
docker run -it --name kcl-lab -v kcl-data:/root kalilinux/kali-rolling bash
apt-get update && apt-get install -y kali-tools-top10 nmap python3-pip git curl wget
Readiness checklist
Quick and isolated. Install Docker Desktop, then run:
# Run Kali Container
docker run -it --name kcl-lab \
-v kcl-data:/root \
kalilinux/kali-rolling bash
Provides a complete Kali Linux virtual machine with desktop environment and comprehensive pre-packaged security tools. Setup Hypervisors: UTM (Apple Silicon macOS), VirtualBox (Intel Mac/Windows), or KVM (Linux).
9. How Security and Isolation Work
Safety and isolation are fundamental to the design of the KillChain Labs platform:
- →Vulnerability Isolation: Target machines are run inside private, ephemeral sandboxes with strict inbound/outbound egress limits to prevent network contamination.
- →Credential Safety: Never use real personal passwords inside lab targets. All range environments use isolated testing credentials.
- →Browser Protection: In-browser sandboxed terminal sessions are wrapped in isolated secure context websockets.
10. Troubleshooting
Can't sign in or verify email?
Check spam for the OTP, confirm you used the same email/provider, then try again from the login page. If OAuth and email accounts use different addresses, they may create separate sessions.
Lab setup failed?
For Docker, confirm Docker Desktop is running. For VMs, verify virtualization support is enabled in BIOS/UEFI settings.
Answer looks right but fails?
Recheck the requested artifact and the helper text beside the submission field. Some challenges expect only a port, hostname, or full flag.
Still stuck?
Use hints in order, then ask in Discord with the challenge title, setup, and what you tried (no spoilers).
Already have an account? Sign in to continue your training missions.
Sign In