Cyfotok Labs · v1.074 operators online
NewLearning paths with certificatesarrow_forward
Your Cybersecurity Lab in your language, Not Just Another Course
Real vulnerabilities, running in real sandboxes you break into from your browser — with tutorials written in Tanglish and English.
credit_card_offNo credit cardworkspace_premiumFree certificatesnew_releasesNew labs weekly
lockcyfotok.academy/terminal
live
$ ▌
$
sandboxed envisolated · legal · safeverified
Tutorials available in
TanglishTamil + EnglishEnglishdefault
/labs · what's inside
Six things you can hack today.
Easy
Phishing
Cyber attacks-la most common-aa use pannra attack technique enna-na Phishing. Attackers fake emails, websites, SMS, phone calls, social media messages use panni users-ah trust panna vechu passwords, banking details, OTPs, company credentials maari sensitive information steal pannuvanga. Indha Learning Path-la, Phishing attack eppadi work pannudhu, attackers enna techniques use panranga, phishing emails-ah eppadi identify pannrathu, fake websites-ah eppadi detect pannrathu, phishing attacks-ku against eppadi protect pannanum nu step-by-step practical examples-oda kathukkaporinga.
/labs/phishingarrow_forward
Easy
Public Key Infrastructure (PKI)
Indha learning path-la, Public Key Infrastructure (PKI) basics-lendhu step-by-step learn pannuvenga. Public Key, Private Key, Digital Certificates, Certificate Authority (CA), Digital Signatures nu ovvoru concept a purinjukuvenga.
/labs/public-key-infrastructure-pkiarrow_forward
Hard
Hands-on XSS
Indha premium Hands-On XSS room la neenga Cross-Site Scripting (XSS) vulnerabilities-ah complete-a practical-a learn pannuveenga. Basic alert payload lendhu real-world reflected, stored, DOM-based XSS attacks varaikum step-by-step hands-on exercises irukum. Oru attacker epdi user input-ah manipulate panni browser la malicious JavaScript execute panraan, adhu eppadi cookies steal panna, fake login forms create panna, admin sessions hijack panna use aagudhu nu practical demonstrations moolama purinjukolveenga.
/labs/hands-on-xssarrow_forward
The method
More terminal,
less reading.
Each lab opens in a split screen. The vulnerable app on one side. The tutorial and your terminal on the other.
No 40-minute video first. No 12-page PDF. The whole point is to get your hands on something exploitable in under sixty seconds.
If a step is confusing, leave feedback in the lab — we actually read it, and tutorials get rewritten.
cyfotoklabs.com/labs/phishing/play
The curriculum
What you'll
actually be able
to do.
Not "you'll learn about cybersecurity." Specifically these things — with a real lab attached to each.
WebAuthAPIRecon
- 01Web
SQL injection
Login bypass, blind SQLi, UNION attacks
- 02Web
Cross-site scripting
Reflected, stored, and DOM-based XSS
- 03Web
CSRF
Forging requests as another user
- 04Web
Command injection
Breaking out of shell calls
- 05Web
File upload bugs
Bypassing MIME and extension checks
- 06Web
Directory traversal
Reading files you shouldn't
- 07Auth
JWT attacks
Algorithm confusion, key cracking
- 08Auth
Broken authentication
Sessions, password resets, weak flows
- 09API
IDOR
Reading other users' data via the API
- 10Recon
Subdomain enumeration
Find what they didn't mean to expose
Plus a learning path that strings them together end-to-end, so you're not just collecting techniques — you're building toward something you can put on a résumé. See the paths.
A note from us
We tried teaching this the way everyone else does — long lecture videos, slide decks, links to external CTF sites. About half the room understood. The other half nodded politely and quietly looked up the words.
The hard part wasn't the security. It was English.
So we wrote every tutorial twice — once in Tanglish, once in plain English — and we'll keep adding more languages as we grow. Cyfotok Labs is small and opinionated. There aren't 500 labs yet. The ones we have, we've sat with someone less technical than you and watched them work through.
Cyfotok Labs team · Coimbatore, India
Pricing
Free to start.
Honest if you outgrow it.
Free
₹0 foreverBeginner labs, leaderboard, progress tracking. The full platform — not a teaser.
Pro
₹399/monthor ₹2,489/yr
Everything: advanced labs, learning paths, certificates, priority support.
Colleges can buy seats in bulk with a discount and get an instructor dashboard. Email [email protected].
See the pricing pagearrow_forwardWhat is Cyfotok Labs?add
A hands-on cybersecurity learning platform built for students from South India. Every lab runs a real vulnerable application in a sandboxed environment, with step-by-step tutorials in Tanglish or English so you can learn in the language you actually think in.
Is it free?add
Yes — the beginner labs and the full free tier are free forever, no credit card. Pro is ₹399/month or ₹2,489/year if you want unlimited access to advanced labs, learning paths and certificates.
Do I need any prior experience?add
No. The first few labs assume only that you've used a computer and know what HTML and a browser are. Each lab teaches the underlying concept before asking you to exploit it.
What do the labs actually cover?add
SQL injection, XSS, CSRF, IDOR, command injection, file upload bugs, JWT attacks, directory traversal, subdomain enumeration, broken authentication and more. Roughly the OWASP Top 10 plus the practical recon and exploitation skills bug-bounty hunters use.
Are the labs legal and safe to practice?add
Completely. You're attacking targets we host inside isolated sandboxes — never real third-party systems. This is the same legal practice setup that platforms like HackTheBox and TryHackMe use.
Can I get a certificate?add
Yes. Finishing a learning path unlocks a verifiable certificate you can post on LinkedIn or attach to your résumé.
The first lab takes about ten minutes.
You don't need to read more about it. Sign up, pick a lab, and we'll see you in the terminal.
╴╴ no credit card · cancel anything any time ╴╴