Penetration Testing Web Resources
Resources to practice penetration testing and to prepare for the Offensive Security Certified Professional (OSCP) certification.
VulnHub
Reading about digital security can only get you so far. VulnHub provides the resources you need to gain practical experience in network administration and pen-testing. Beginners and experts alike can get free, specialized scenarios and challenges to practice their hacking skills!
HackTheBox
Learning is always more fun when you do it with others. HackTheBox turns pen-testing practice into a competitive and collaborative community. Complete challenges, earn points, join teams, get exclusive job offers and hack your way to the top of the leaderboards.
Practical Pentest Labs
https://practicalpentestlabs.com
Hacking is a hands-on activity that requires hands-on education. Practical Pentest Labs provides both the know-how and the opportunity to apply it. It hosts a constantly-updated supply of vulnerable-by-design systems designed to teach you how to hack Windows, websites and more.
Zenk-Security
https://www.zenk-security.com/epreuves.php
Zenk-Security provides educational materials and interactive challenges for English and French hackers of all skill levels. Download a book or two to brush up on your knowledge, then try your hand at one of the practice scenarios. Categories include cryptography, steganography, digital forensics, malware, Windows exploits and Linux exploits.
Pentesterlab
Pen-testing isn’t just a skill, it’s a mindset. PentesterLab provides everything you need to think like a hacker, navigate different systems, and identify exploits. Practice on examples that demonstrate real vulnerabilities and earn certificates as you gain mastery in Unix, authentication, serialization and more.
Defend the Web (formerly HackThis)
https://defendtheweb.net (formerly https://www.hackthis.co.uk)
Defend the Web won’t give you a cape and a mask, but it’ll give you everything else you need to become a pen-testing superhero. Over 70 in-depth articles cover encryption, cross-site scripting, network security, coding basics, and more. Then put that knowledge to good use with Defend the Web’s 60+ hacking challenges.
Shellter Labs
Forget about Twitter and Facebook — Shellter Labs is going to be your new favorite social network. Designed specifically for pen-testers, IT experts, and computer science students, it provides both community and education. Compete against other users in contests and win prizes, or just browse Shellter’s extensive resource library.
Root-Me
Whether you’re interested in cryptography, app exploitation, digital forensics, or web hacking, Root-Me has you covered. Test your skills in over 350 challenges across over 90 different environments — Windows, Linux, Android, Java, and more. Contribute your solutions and get publications, job offers, and other rewards.
Wizard Labs Security
https://labs.wizard-security.net
Wizard Labs is still in development, but it plans to deliver a fun yet educational game of capture the flag. You’ll go up against other hackers attempting to gain root access on various vulnerable machines, locating special files along the way. Improve your skills, solve the challenge and advance into the Hall of Fame!
W3Challs
You’ve heard of W3Schools, one of the web’s best resources for learning HTML and CSS. Now there’s W3Challs, where you can learn programming, cryptography, forensics, and other hacking-related disciplines. Challenges include Windows exploits, RSA cracking and even hacking the W3Challs website itself.
alert(1) to win
alert(1) to win dispenses with the fancy web design and social components. Instead, it drops you straight into the challenge. It starts with a simple scenario: you’re given a snippet of code that generates HTML unsafely, and your task is to prove it by calling alert(1). Do that, and you’ll unlock the next test — how far will you make it?
NewbieContest
Aspiring French-language hackers will find a welcoming community and ample education at NewbieContest. Try your hand at steganography, logic, hashing, or crypto challenge — there’s something for beginners and experts alike. And if you get stuck, an active forum provides guidance and collaboration.
Hacker101 CTF
Capture the flag has never been so rewarding as it is with Hacker101 CTF. Learn the basics of pen-testing and bug-hunting with Hacker101’s informative articles and videos. Then sign up and comb through files, databases, source code and more until you find the flag and win the game!
The Cryptopals Crypto Challenges
Cryptography is best learned from experience, and the Cryptopals Crypto Challenges are here to teach you all you need to know. You’ll need a good background in various languages, including C, C++, Python, Visual Basic, Perl, and Ruby. But no prior crypto experience is required — just dive in and start learning!
Penetration Testing Practice Labs
http://www.amanhardikar.com/mindmaps/Practice.html
Cybersecurity expert Aman Hardikar has compiled a master list of vulnerable systems for hacking practice. The list is divided into categories like mobile apps, OSes, websites, and even the cloud. Choose your preferred topic, pick a link and get hacking — materials include old software, bank simulations, and vulnerable web apps.
Hacksplaining
https://www.hacksplaining.com/exercises
Smooth design, easy-to-follow explanations, and hand-on practice scenarios make Hacksplaining one of the best resources for beginner pen-testers. Lessons cover a variety of exploits and hacking techniques for websites, OSes, apps, and more. Topics range from SQL injection to malvertising to XML bombs.
SmashTheStack
http://smashthestack.org/wargames.html
SmashTheStack hosts what it calls “ethical hacking environments” — that is, simulations where you can safely and legally practice your hacking skills. Depending on which one you pick, you may find yourself hacking Linux, web apps, or even encryption. Each wargame has its own IRC channel if you get stuck or have questions.
Hackaflag
https://academy.hackaflag.com.br
Speakers of Brazilian Portuguese now have their own special CTF site: Hackaflag. Combining competitive CTF tournaments with real-world bug bounties and extensive learning materials, Hackaflag is Brazil’s all-in-one pen-testing resource. Read educational articles in the Academy if you’re new, or get right to the game if you’ve got hacking experience.
PentestIT LAB
Russian pen-testing firm PentestIT provides aspirational pen-testers with a free “laboratory” in which to hone their skills. Labs simulate real-world infrastructures for realistic learning environments. Each lab tests your aptitude at hacking, programming, cryptography and even social engineering.
Hacker Security
Brazilian pen-testers will learn a lot — and prove their knowledge — with these CTF games from top cybersecurity experts. “What File” requires you to determine the correct file type of a mislabeled “EXE” file. “Card” instructs you to properly protect a credit card number in a database. Others involve decrypting messages, finding passwords and IDing malware.
PicoCTF
Aimed at middle school and high school students but open to all, PicoCTF will take you from newbie to expert in the most fun way possible. Each game features a detailed storyline created by security experts at Carnegie Mellon University. Decrypt, reverse engineer and hack the scenario to win big prizes!
Exploit.Education
Exploit.Education hosts five virtual machines that are free to download. Each VM contains a full pen-testing scenario that’s ready to be hacked and solved. Most scenarios emphasize Linux exploits, though the “Main Sequence” VM involves web hacking, password cracking, and cryptoanalysis as well.
Root in Jail
The premise of Root in Jail is simple: pick a scenario and gain root access. Depending on your choice, though, getting there will involve applying many different pen-testing techniques. Challenges are graded from easy to hard, so both newbies and pros can practice their network mapping, website hacking and more.
CMD Challenge
Many pen-testing challenges involve a wide array of software, exploits, and languages. CMD Challenge condenses your hacking techniques into one task: complete the challenge with a single line of bash. Use your command line skills to find prime numbers, extract IP addresses, repair corrupted text and more.
Try Hack Me
Hands-on practice is important in cybersecurity, but some folks learn better in a classic classroom environment. Try Hack Me provides both: an on-demand virtual machine with preloaded practice scenarios and a traditional Q&A aspect. Classrooms are dedicated to pen-testing 101, Burp Suite, hash cracking, Metasploit and many other topics.
Hacking-Lab
https://www.hacking-lab.com/index.html
Hacking-Lab provides the European Cyber Security Challenge with its annual challenge materials. But it also provides free challenges to users around the world all year. Download the free virtual machine, pick a challenge, and find the solution. Hacking-Lab teachers will grade your solutions and provide feedback to help you learn.
Google CTF
https://capturetheflag.withgoogle.com
If you’re feeling confident in your pen-testing abilities, take Google’s CTF challenge and prove your worth. Pass the online qualifying round and advance to the in-person final round, with a prize pool of over $31,337. But first, try the beginner’s quest, a CTF challenge with multiple paths and a cool sci-fi storyline that will push your hacking skills to the limit.
ImmersiveLabs
Immersive Labs provides businesses with cybersecurity training tools like no other. Structured like a game with goals, levels, and achievements, it’s targeted to cover each business’s specific technologies. From Windows and command-line basics to remote exploits and credential dumping, it provides a complete cybersecurity education in one package.
Attack-Defense
Attack-Defense provides you with complete virtual machines that contain everything you need to practice pen-testing. You’ll get a full Kali Linux system that runs in your browser along with labs to test your chosen skills. Use MySQL exploits to hack a web server or try an in-depth CTF challenge.
OverTheWire
With over a dozen different free wargames, OverTheWire teaches you everything about pen-testing from the ground up. Absolute beginners will learn all the basics, starting with how to SSH into the challenges. Experts will be able to put their reverse engineering and Linux hacking skills to the test.
SANS Holiday Hack Challenge
https://www.holidayhackchallenge.com
Every Christmas, SANS puts together its Holiday Hack Challenge, an in-person challenge hosted at KringleCon. The Santa-themed challenge involves data recovery, passcode hacking, steganography, authentication cracking, and network decryption. Prizes are awarded for solutions demonstrating creativity, technical knowledge, and overall aptitude.
PWNABLE
Don’t be fooled by the cute illustrations that accompany each of PWNABLE’s CTF challenges: these are serious scenarios. Beginners can start out at the “Toddler’s Bottle” tier with tasks involving MD5 hash collision and Linux command shells. As you level up, you’ll test your skills by hacking DOS, Windows, Android, and even malware.
