CYBRARY Forge Labs
Guided hands-on practice on simulated Windows and Linux machines.
What is in it
For individual learner, university, l&d lead — build a skill and prove it transfers to an unseen task.
- Windows 11 and seven Linux distributions, each with distro-accurate commands
- Role paths, difficulty levels and a guided first run
- Referee scoring with per-step reasoning, not a completion tick
- Six languages, with technical evidence left untranslated so investigations still work
What it is not
- Nothing real executes — no VM, no shell on a real host
- Not a substitute for an exploit-development certification track
Forge Labs against the field
15 capabilities that matter for this purchase, next to the platforms a buyer shortlists in this lane: TryHackMe, Hack The Box Academy, RangeForce.
- Because the estate is simulated rather than hosted, a class of five hundred costs the same to run as a class of five — nobody waits for a machine.
- Every run is reseeded, so artifact names and file hashes differ per learner and last year's answers are worthless.
- Scoring reads what actually happened at the shell: a command that returned access denied does not tick the step off.
| What you need | Forge LabsIncluded in the platform | HTB | THM | RangeForce |
|---|---|---|---|---|
| Free entry route for an individual | Yes, in part Runs through Cybrary's existing free tier rather than a Forge-specific plan. | Hack The Box: Documented for Free entry route for an individual | TryHackMe: Documented for Free entry route for an individual | RangeForce: Limited for Free entry route for an individual |
| Paid individual subscription | Yes, in part Sold as part of Cybrary, not separately packaged yet. | Hack The Box: Documented for Paid individual subscription | TryHackMe: Documented for Paid individual subscription | |
| Guided hands-on labs | Yes See it live | Hack The Box: Documented for Guided hands-on labs | TryHackMe: Documented for Guided hands-on labs | RangeForce: Documented for Guided hands-on labs |
| Job-role learning paths | Yes See it live | Hack The Box: Documented for Job-role learning paths | TryHackMe: Documented for Job-role learning paths | RangeForce: Documented for Job-role learning paths |
| Foundational command line and operating-system learning | Yes See it live Seven Linux distributions and Windows 11, each with distro-accurate command behavior. | Hack The Box: Documented for Foundational command line and operating-system learning | TryHackMe: Documented for Foundational command line and operating-system learning | RangeForce: Documented for Foundational command line and operating-system learning |
| Advanced offensive target practice | Yes, in part See it live Attack paths are modeled, not executed. Genuine exploitation needs the native lane. | Hack The Box: Documented for Advanced offensive target practice | TryHackMe: Documented for Advanced offensive target practice | RangeForce: Limited for Advanced offensive target practice |
| Vendor's own practical certification program | Coming Cybrary certification exists; Forge-assessed credentials are not built. | Hack The Box: Documented for Vendor's own practical certification program | TryHackMe: Documented for Vendor's own practical certification program | |
| Completion certificates and CPE route | Yes, in part See it live | Hack The Box: Documented for Completion certificates and CPE route | TryHackMe: Limited for Completion certificates and CPE route | RangeForce: Limited for Completion certificates and CPE route |
| Cloud-specific learning | Yes See it live | Hack The Box: Documented for Cloud-specific learning | TryHackMe: Documented for Cloud-specific learning | RangeForce: Limited for Cloud-specific learning |
| Application-security and developer exercises | Yes See it live Graded secure code review: a seeded pull request with one real flaw, a scanner report that is partly wrong, and a dependency list that is mostly a distraction. | Hack The Box: Documented for Application-security and developer exercises | TryHackMe: Documented for Application-security and developer exercises | RangeForce: Limited for Application-security and developer exercises |
| Operational-technology content and environments | Yes See it live A graded plant shift across Purdue levels, scored on the safe response rather than the IT one — containment that would blind the control room loses marks. | Hack The Box: Documented for Operational-technology content and environments | RangeForce: Documented for Operational-technology content and environments | |
| SCADA practice mapped to IEC 62443 zones, conduits and security levels | Yes See it live The plant is built to a zone and conduit model with target security levels, and every graded decision is listed against the foundational requirement it exercises — so a coverage answer comes from what learners did, not from a syllabus. | |||
| Structured feedback after practice | Yes See it live Referee scoring with per-step reasoning and a debrief that discloses what was staged. | Hack The Box: Documented for Structured feedback after practice | TryHackMe: Documented for Structured feedback after practice | RangeForce: Documented for Structured feedback after practice |
| A working corporate mail client inside the exerciseOutlook on the Windows desktop, Evolution on Linux: folders, threads, attachments, full headers and message source. | Yes See it live Phishing training is graded both ways — a missed lure costs the same as reporting a legitimate message. | TryHackMe: Limited for A working corporate mail client inside the exercise | ||
| The full desktop exercise usable on a phoneA trackpad cursor, edge-following viewport, gestures, an on-screen keyboard and the taskbar folded into one reachable control. | Yes See it live | TryHackMe: Limited for The full desktop exercise usable on a phone |
The run behind this line: The shared drive that answered everyone
A first shift: one machine, one wrong permission, and an analyst who has to read what the commands actually returned rather than what they expected.
Opponent: Opportunist — takes whatever the estate hands over without asking twice. Shaped after Commodity access broker tradecraft as described in CISA AA23-025A. Technique and zone identifiers are published by MITRE and ISA/IEC; the mapping is ours and is not an accreditation.
How it starts — the message delivered to the mailbox
- From
- IT Service Desk <servicedesk@it-support-portal.example>
- Reply-To
- helpdesk-reply@mailer-portal.example
- Subject
- Your mailbox storage upgrade is ready — confirm within 24 hours
- Link
- shows “https://mail.northwind.example/storage”, really points at https://mail-northwind.it-support-portal.example/logon
- The visible link and the real link disagree — the domain is a lookalike
- Reply-To points at a different domain than From
- A deadline manufactured to stop the reader from checking
Graded verdict: phish — T1566.002. Nothing here sends or resolves anywhere real.
The steps, and the zone each one crosses
| # | Tactic | ATT&CK | On the range | IEC 62443 zone |
|---|---|---|---|---|
| 1 | Initial access | T1566.002 Phishing: spearphishing link | The lure lands in the analyst's mailbox with a lookalike sign-in page. | Enterprise |
| 2 | Credential access | T1078 Valid accounts | The harvested password signs in from an address the account has never used. | Identity |
| 3 | Discovery | T1135 Network share discovery | net view and smbclient walk the shares the account can reach. | Enterprise |
| 4 | Collection | T1039 Data from network shared drive | A finance folder that should have been restricted is copied wholesale. | Enterprise |
Zones in this run: Enterprise (Purdue level 4/5, via Internet mail and web egress); Identity (Purdue level 4, via LDAP and Kerberos to the domain controllers). How the zone model is used.
The alerts the SIEM raises from this run
Lookalike sign-in domain clicked
A click-through to a domain registered inside the last 30 days.
mail gateway · stage 1 · LINE-LABS-01 · T1566.002
Sign-in from an address this account has never used
Successful logon from a source outside the account's 90-day history.
directory audit · stage 2 · LINE-LABS-02 · T1078
Share enumeration from a workstation
One host opening shares it has no history of opening.
endpoint agent · stage 3 · LINE-LABS-03 · T1135
What the case has to hold before it closes
- The mailbox that received the lure and the time it was clicked
- The account used and the source address it signed in from
- Every share read while the session was live
- The permission that allowed the read, and the change that fixes it
Start learning this line
Ten minutes on a real machine, scored on what the commands actually returned.
A tick means the other platform's own documentation shows it. A question mark means we could not confirm it publicly — it is never a claim that they lack it. Every Forge yes opens the working screen rather than a screenshot.