pwn.college for Beginners: ASU's Free Hacking Dojo (2026)

What Is pwn.college?

pwn.college is a free education platform where you learn cybersecurity by solving hands-on challenges in a Linux environment that runs in your browser. It was built at Arizona State University, powers much of ASU's security curriculum, and its home page says it is "open, for free, to participation for interested people around the world."

The project was founded by ASU professor Yan Shoshitaishvili, with doctoral student Connor Nelson turning the curriculum into the dojo website. It started as the infrastructure for ASU's computer systems security course (CSE 466) and grew from there. In 2024, ASU reported that the platform was used in 145 countries and that students spent more than 1.5 million hours drilling in the dojo during 2023.

Three things set it apart from most free platforms:

• It is a real university course. Each module pairs lecture videos and slides with a set of challenges. The same challenges grade ASU students, which is why the platform asks you not to publish solutions.
• It goes deep, not wide. The core path runs from Linux basics to assembly, reverse engineering, binary exploitation, sandboxing and kernel security. There is some web and cryptography, but low-level systems hacking is the heart of it.
• Everything happens in the browser. No VPN, no VM, no install. You click Start and get a terminal, a VS Code editor or a full Linux desktop. SSH is there if you prefer it.

The infrastructure is open source on GitHub, and schools can create their own private dojos to run classes on it.

Is pwn.college Good for Beginners?

Yes for the first stretch, and honestly no for the rest unless you are patient. The Getting Started dojos assume no Linux knowledge at all. The Core Material assumes you finished them and climbs quickly into material ASU also teaches in its senior and graduate security courses.

Every dojo page shows a "Unique Hackers" counter. We checked them in late October 2026, and the drop-off tells you more than any review could:

Those counters track distinct people who have solved challenges in each dojo, not people who finished it. Even so, the shape is clear. Around 71,000 people have solved something in Start Here. Fewer than 3,000 have solved anything in Software Exploitation.

Our take: pwn.college is the best free resource we know for learning how programs work in memory, and a poor first stop for someone who wants to hack websites by Friday. If web security is your goal, start somewhere web-focused and come back to pwn.college when you want to understand what is happening underneath.

How the pwn.college Dojo Works

The material is organized in three layers. A dojo covers one broad topic. Each dojo contains modules, and each module contains challenges. Solve a challenge and you get a flag, a token you paste into the box on the challenge page to score it.

The workspace

When you click Start on a challenge, pwn.college spins up a container for you and gives you four ways in:

• Terminal: a plain shell in your browser. This is where you will spend most of your time.
• Code: VS Code in the browser, handy once you start writing scripts.
• Desktop: a full Linux GUI, which you will want later for debuggers and other graphical tools.
• SSH: link a public key in your settings and connect from your own terminal.

Your home directory persists across challenges, so scripts and notes you save stay with you. If you wreck the environment, click Start again for a clean one.

Where the flag lives

On every challenge the real flag sits in /flag, a file only root can read. The challenge files sit in /challenge. Your job is to find the way the challenge lets an unprivileged user (named hacker) get at that flag. Sometimes that means running a program in /challenge correctly, and later it means making a program do something its author never intended.

Practice mode

Each challenge also has a Privileged button. It starts the same environment with sudo access so you can debug and experiment freely, but /flag is swapped for a practice flag that scores nothing. In practice, this is the most underused feature on the platform. When an exploit fails and you cannot see why, a privileged instance lets you attach a debugger as root and watch exactly what goes wrong.

Which pwn.college Dojos to Do, in Order

The dojos page says the material "is designed to be tackled in order" and that each dojo expects you to know everything taught by the previous ones. Take that seriously. Here is the official path and what each step actually teaches.

Getting Started

1. Start Here. Ten challenges that teach the platform itself: launching the terminal, VS Code and desktop, pasting flags, restarting challenges. The module also includes intro lectures, one of them on cybersecurity ethics.
2. Linux Luminarium. Seventeen modules from "Hello Hackers" through paths, commands, globbing, piping, shell variables, processes, users, permissions and the PATH variable. The dojo says it is very introductory and that you can skip it if you are already comfortable in Linux. If you hesitated reading that list, do not skip it.
3. Computing 101. This is where it gets real. The dojo starts with the machine code computers run directly and your first program, then covers memory, the stack, number representation, control flow, endianness and debugging, finishing with a module where you build a web server.
4. Playing With Programs. Talking to software in unexpected ways: handling data formats, speaking HTTP by hand with curl and netcat, abusing ordinary programs, and an SQL playground. The dojo itself says you can move on once you are comfortable rather than finishing every challenge.

Core Material: earning your belts

1. Intro to Cybersecurity. Seven modules: web security, intercepting communication, cryptography, access control, reverse engineering, binary exploitation, and an integrated module that combines them.
2. Program Security. Five modules: program security, reverse engineering, return-oriented programming, dynamic allocator (heap) misuse and program exploitation. This is the dojo where the hacker counter drops by more than half.
3. System Security. Sandboxing, race conditions, kernel security and microarchitecture exploitation.
4. Software Exploitation. Format strings, file structure exploits, heap exploitation and kernel exploitation against modern mitigations.

You start with a white belt the moment you register. The belts page lists orange, yellow, green and blue belt holders, and the dojos page says you "must earn belts sequentially" by completing the Core Material dojos. Finish all four and pwn.college will mail you an actual embroidered blue belt, though for now it only ships belts at blue. Brown and black belts, according to the home page, come later and outside the dojo, once you can contribute to the security industry and academia.

If the low-level half of that list looks intimidating, reading about it first helps. HackerDNA's binary exploitation course covers stack overflows, protections like ASLR and NX, and ROP chains in plain language, which makes Program Security's lectures far easier to follow.

Your First Hour on pwn.college

Here is a realistic first session, start to finish.

1. Register and read the rules. Before you see any material, the platform asks you to agree not to post writeups, walkthrough videos or livestreams of solutions. It cannot enforce this, so it relies on you.
2. Open Start Here and watch the first lecture. "What is pwn.college?" sets expectations for everything that follows. Then click Start on "Using the Terminal." The terminal opens under the challenge text and your first flag appears.
3. Submit it. Drag-selecting text in the terminal copies it. Paste it into the Flag box and submit. That loop (start, solve, copy, submit) is the whole platform.
4. Try every workspace. The rest of Start Here walks you through VS Code, the desktop and restarting. Do them all now, because you will need the desktop much later and it is easier to learn when nothing is at stake.
5. Join the Discord. Start Here has a module just for this. It is where you ask for help later.
6. Begin Linux Luminarium. The first module, Hello Hackers, explains the shell prompt. You will see something like this:

hacker@dojo:~$ whoami
hacker
hacker@dojo:~$

The tutorial walks through each piece. hacker is your username, the part after the @ is the machine's hostname (on pwn.college it is derived from the challenge name), and the $ means you are not an administrator. Much later, when you exploit your way to root, that $ turns into a #. It is a small detail, and it tells you exactly where this platform is heading.

How to Get Unstuck Without Breaking the Rules

Because writeups are discouraged, you will not find a walkthrough for most challenges. That is a feature. The platform gives you other ways to get moving again:

• 🎥Rewatch the module lecture. Challenges are built to exercise what the lecture shows. If you are stuck on challenge 7, the answer usually traces back to something said in the video that you skimmed.
• 🤖Ask SENSAI. pwn.college has an AI tutor called SENSAI, reachable from the Help link once a challenge is running. ASU built it specifically for students who get stuck in the dojo.
• 💬Ask on Discord, properly. Say which challenge, what you tried, and what happened. Expect hints that help you think, not solutions, and do not ask for one.
• 🔧Use a Privileged instance. When the problem is "my exploit does not work and I cannot see why," run it with sudo in practice mode and watch it under a debugger.

The honest advice for beginners: being stuck for an hour on pwn.college is normal. The challenges are short, but each one removes a little more scaffolding than the last. If you are stuck for days on early Luminarium material, the gap is usually Linux fundamentals, and a structured course will close it faster than brute force.

pwn.college vs OverTheWire, picoCTF and HackerDNA

All four are good, and they are good at different things.

OverTheWire is the closest in spirit: free, terminal-only, no hand-holding. Bandit covers similar ground to Linux Luminarium with less explanation, and its later games (Narnia, Behemoth) touch the same binary exploitation themes as Program Security. Our OverTheWire wargames guide lays out the order to play them. Plenty of people do Bandit and Luminarium side by side.

picoCTF is wider and shallower. If you want to sample cryptography, forensics and web in one week, it is the better pick. If you want to understand why a buffer overflow works rather than just trigger one, pwn.college is.

HackerDNA fills a different gap. pwn.college challenges isolate one concept at a time, which is great for learning and very different from a real target. HackerDNA labs give you a whole vulnerable machine or application, often with guided questions along the way, so you practice chaining what you learned. A good bridge from Computing 101 is the License Key Crackme lab, where you pull apart a Linux binary with objdump and GDB, the kind of debugging pwn.college drills from Computing 101 onward.

Beyond the Belts: CTF Archive and Live Competitions

pwn.college itself points you to the next step. Its home page recommends capture the flag competitions and wargames once you have outgrown the dojo, and it hosts a few community dojos that bridge the gap:

• CTF Archive: 834 challenges preserved from past competitions, including CSAW and 0CTF, all runnable in the same workspace. The dojo says its scoreboard is for tracking your own progress, not competing.
• Advent of Pwn: a 12-challenge holiday dojo. The 2025 edition is still playable if you want a short, themed set to try after Intro to Cybersecurity.
• Community dojos: the dojos page lists dozens more, from Windows and ARM to web security and privilege escalation, built by the pwn.college community.

When you are ready for a timed event, the home page sends you to CTFtime, the calendar most of the CTF world uses. Our guide to entering your first CTF competition explains formats, teams and which beginner events are worth your weekend.

Legal and Ethical Considerations

• Respect the no-writeups rule. Universities grade students with these exact challenges. Publishing a solution makes the platform less useful for everyone, including the next beginner.
• Keep exploits inside the dojo. Shellcode and exploits you write for pwn.college target its challenge programs. Running them against software you do not own or have permission to test is illegal in most countries.
• Do not attack the platform. The containers are the challenge, not the infrastructure behind them. If you find a real bug in pwn.college itself, report it through Discord or by email instead of using it.
• Watch the ethics lecture. Start Here includes a lecture on cybersecurity ethics. It is worth your time before you learn anything offensive.

Frequently Asked Questions