HackLab: a hacker simulator game with a real terminal

The useful test for a phone app is whether you type commands or tap answers, because recall of syntax and order is most of the skill. HackLab works that way: missions hand you a terminal where nmap, sqlmap and curl are parsed and answered with realistic output, and every target is fictional. It is free on iOS and Android and needs no prior experience. Real tooling on real hosts still belongs in a lab or a sanctioned CTF.

Learning is legal. Reading about attacks, studying tools, and practising in an environment built for it breaks no law anywhere. What is illegal in most countries is accessing or testing a system you do not own without written permission, and intent is not a defence — curiosity and a good motive do not make an unauthorised scan lawful. That is why simulators, Capture-the-Flag competitions, and home labs exist: they give you the same practice with the permission question already settled.

nmap is a network scanner. It sends packets to a host and reports which ports answer, whether they are open, filtered or closed, and often which software and version is listening — ssh on 22, http on 80, https on 443. Attackers use it to find a way in; defenders use it to find services nobody meant to expose. In HackLab, the scan phase of a mission runs against a simulated host so the reading of that output is what you practise.

SQL injection happens when user input is dropped straight into a database query instead of being passed as a parameter. An attacker types SQL into a form field or a URL and the database runs it, returning or altering data it should never expose. It persists because a single unescaped parameter anywhere in a large application is enough, and because the fix — prepared statements and parameterised queries — has to be applied consistently rather than once.

Capture the Flag is the standard legal practice format in security. Organisers stand up deliberately vulnerable machines or challenges, and players prove they broke in by finding a hidden string called a flag. Scoring is by difficulty, often against a clock. It matters because it gives you a target you are explicitly allowed to attack. HackLab runs scheduled live CTF tournaments inside its own simulation, alongside duels against other players and races against a recorded best time.

No. HackLab is a simulator and a game. The terminal parses commands and returns realistic output, but the hosts, networks and vulnerabilities are fictional and live entirely inside the app. Nothing it produces can be pointed at real infrastructure, and finishing a mission leaves you with understanding rather than an exploit. That is the point: you can see how port scanning, SQL injection and XSS probing behave without touching anything you are not allowed to touch.

HackLab is free to download on the App Store and Google Play, with an optional Pro subscription. Pro adds unlimited daily missions, every CTF challenge, a 1.5x XP multiplier, two automatic streak freezes per renewal, a second gear loadout, and every advanced Learn lesson. A free trial lets you try Pro before committing. The app is rated 4+ and links to its terms of use and privacy policy from the store listing.

No prior experience is required. Missions start at easy — find the open ports on a host, read a server log — and there are Beginner, Intermediate and Advanced tracks, plus an Experience Level setting that tailors hints and pacing from the first run. If a step stalls you, the AI Mentor gives a limited number of free contextual nudges each day, written to point at the technique rather than hand over the answer.

Certifications open doors, especially for a first role or a government contract, but they test knowledge you still have to acquire somewhere. Most people build that through labs, CTFs and reading, then sit the exam to prove it. HackLab is practice, not coursework: it is not an accredited course or an exam question bank, but working missions gives you familiarity with scanning, injection and log analysis that makes the study material read as things you have already seen.

Yes. A global leaderboard ranks players worldwide, and scheduled live Capture-the-Flag tournaments run against the clock with final standings posted afterwards. You can also challenge a friend or a random rival to an async duel using invite codes, with ratings and rematches, or race a Ghost — the recorded best time on a mission. Daily missions, a five-question daily trivia round, and streaks with a streak freeze keep the day-to-day scoring going.