The CertInstructor Pentest Range — A Free, Browser-Based Cyber Range You Can Attack Right Now

The CertInstructor Pentest Range: A Free, Browser-Based Cyber Range You Can Attack Right Now

By Vinh NTT — Founder, CertInstructor

Most people who want to learn offensive security hit the same wall on day one: before you can run a single command, you have to download a multi-gigabyte Kali image, stand up vulnerable target VMs, wire them onto an isolated network, and pray nothing breaks. Hours gone, and you haven't learned anything yet.

So I built something to remove that wall entirely.

The CertInstructor Pentest Range is a complete, browser-based training network you attack from a simulated Kali box — no VM, no install, no setup. You open a URL, run your first scan, and you're in. It's free, it's original work, and it exists for one reason: to give anyone serious about security a place to practise the full attack lifecycle end to end.

👉 Launch the range: go.certinstructor.org/range

Simulation only. Every command, scan and exploit in the range is simulated in your browser. No real system is ever scanned or touched, and nothing is sent over the network. Always get written authorization before testing any real system you do not own.

One network. Three targets. The full kill chain.

The whole range lives on a single training subnet — 10.10.10.0/24. You operate from a Kali attacker box, discover the hosts, and work three deliberately vulnerable targets from reconnaissance all the way through to persistence. Then you switch chairs and defend them.

Everything is framed against two industry-standard models: the Cyber Kill Chain (the order intrusions actually unfold in) and MITRE ATT&CK (the technique catalogue defenders use). Each individual lab maps to a single ATT&CK technique, so you always know exactly what you're learning and where it fits.

How the labs actually work

Every lab in every module follows the same shape, so once you've done one, you know how to do all forty:

• A simulated terminal. You type real-looking commands (nmap -sV 10.10.10.11, hydra, mimikatz, and so on). The engine responds with realistic output — but nothing leaves your browser.
• Missions. Each lab has a short list of objectives that auto-check as you complete them (for example: run a version scan, run a vulnerability scan). The progress bar fills as you go.
• A knowledge check. A short quiz at the end of each lab ties the hands-on work back to the "why" — the CVE, the technique, the fix.
• Hints & a guide. Stuck? Every lab ships suggested commands and a written guide, so you're never staring at a blank prompt.
• The ATT&CK Navigator. Each module has a live MITRE ATT&CK matrix that lights up to show both what the module covers and what you've completed.

Your progress is saved automatically in your browser, so you can leave and come back to a half-finished module.

One thing to know: progress is stored per-browser (in localStorage), not per-account. If you switch computers or browsers you'll start fresh — so try to finish a module on the same machine you started it on.

How to start in 60 seconds

1. Open go.certinstructor.org/range.
2. Scroll to Stage 00 · Reconnaissance and click ▶ Run ARP discovery. Watch the Kali box sweep the subnet and reveal the live hosts — this is your first taste of recon.
3. Click Enter the Kali box — start here (M1). That's your operator workstation and the front door to everything else.
4. From there, work the targets in order — M2 → M3 → M4 — then finish with the M5 SOC capstone.

You don't have to go in order, but the range is designed as one continuous engagement: what you find on the Kali box tells you which targets exist; what you steal on one host you reuse on the next; and the traces you leave behind are exactly what you hunt for in the blue-team finale. Walking it in sequence is where the "aha" moments live.

Which certification does this map to?

The range was built by someone who teaches to the CompTIA and EC-Council blueprints for a living, so the modules line up cleanly with the certifications people are actually studying for. If you're prepping for an exam, here's the natural pairing between a module and the official CompTIA CertMaster Labs that take you from simulation to real, graded lab environments:

The range is free and it's genuinely enough to build real skill on its own — finish it first. The CertMaster Labs above are the honest next step when you want the official, exam-aligned lab environments and a credential at the end of it. No pressure, and no outcome is guaranteed by any lab, mine or CompTIA's — that part is always on you.

Original work, freely shared

The portal, all five lab platforms, the missions, the simulated terminals and the campaign data are original work, © Vinh NTT — CertInstructor. You're welcome to use it freely to learn: run the labs, study the techniques, walk the kill chain as many times as you like. It is not licensed to be repackaged, rebranded or resold. Keep the credit intact and it stays free for the next person to learn on.

Read the module guides

Each module has its own detailed, step-by-step walkthrough:

• Module M1 — Getting Started on the Kali Attacker Box →
• Module M2 — Owning the Linux Box (Metasploitable 2) →
• Module M3 — The Windows Kill Chain (Metasploitable 3) →
• Module M4 — Breaking the Web Stack (OWASP-BWA) →
• Module M5 — The SOC Blue Team Capstone →

About the author — Vinh NTT   is the founder of CertInstructor and has spent 20+ years in IT-security training. He holds the full CompTIA security certification stack — Security+, CySA+, PenTest+ and SecurityX — and is a two-time recipient of the EC-Council Instructor Circle of Excellence Award (2022 & 2023). The Pentest Range is his original work, built and shared free for the community to learn on.