SIGNAL9.sh

A hands-on Linux & cybersecurity training platform. Launch a real root box, do the work in a real terminal, and get graded on the true state of the machine — not a flag, not a quiz.

You don't type the answer.
You prove it on the box.

Launch a live box — free
or take today's daily challenge — free, no signup
root@sig9-ir-04: ~ — incident-response/beacon-huntROOT
$
state hash matches expected
You do the work. On a real root shell.
We read the machine. Not your answer box.
The grade is the truth. Every time.
hands-on rooms
guided lessons
cert-aligned tracks
100%
real terminals

// how it works

Real root — when the lab calls for it.

A genuine Linux box, not a simulation. Full root where the topic demands it — and a locked-down user account when the lesson is escalating without it.

Graded on machine state.

The engine inspects what you actually changed. Multiple valid paths to correct; no single “right” keystroke.

Built by a responder.

Scenarios come from real defensive work — hardening, IR, forensics — not repackaged CTF puzzles.

// tracks

Cert-aligned, start to finish

01 foundationFundamentals first — a real shell, assumed nothing
02 specializationPick a role track: defense, sysadmin, security, DevOps
03 certificationBlueprint-aligned prep, timed mocks, a graded capstone

Browse the full track catalog →

Free to start · Pro for the whole catalog · Teams for readiness & hiring

Individuals train and prove skill. Companies track team readiness and screen candidates on live, sandboxed scenarios — evidence, not whiteboard trivia.