hacking-practice

Hacking Practice Repository

A comprehensive, categorized collection of cybersecurity labs, vulnerable machines, training platforms, and documentation resources for hands-on practice and skill development.

Categories

This repository organizes resources into the following categories for easy navigation:

Category Description
All Results Complete list of all resources
CTF & Wargames Capture The Flag platforms and wargame environments
Vulnerable Web Apps Intentionally vulnerable web applications for testing
Downloadable VMs & Labs Virtual machines and standalone lab environments
Documentation Reference materials, guides, and learning resources
Free Mentored Training Provider Guided learning platforms with mentorship

CTF & Wargames (29 Resources)

Full-scale platforms for capture the flag competitions, wargames, and security challenges:

  1. HackTheBox (Free Tier) - https://www.hackthebox.com
  2. TryHackMe (Free Tier) - https://tryhackme.com
  3. OverTheWire - https://overthewire.org
  4. PicoCTF - https://picoctf.org
  5. Root-Me.org - https://www.root-me.org
  6. RingZer0 CTF - https://ringzer0ctf.com
  7. HackThisSite - https://www.hackthissite.org
  8. SmashTheStack - http://smashthestack.org
  9. WeChall - https://www.wechall.net
  10. NewbieContest - https://www.newbiecontest.org
  11. W3Challs - https://w3challs.com
  12. Pentestit.ru - https://lab.pentestit.ru
  13. CTFlearn - https://ctflearn.com
  14. Cryptopals - https://cryptopals.com
  15. Pwnable.kr - https://pwnable.kr
  16. Pwnable.tw - https://pwnable.tw
  17. Reversing.kr - http://reversing.kr
  18. Microcorruption - https://microcorruption.com
  19. IO - https://io.netgarage.org
  20. HellBound Hackers - https://www.hellboundhackers.org
  21. EnigmaGroup - https://www.enigmagroup.org
  22. DVWA online - https://github.com/digininja/DVWA
  23. bWAPP online - http://www.itsecgames.com
  24. Google CTF - https://capturetheflag.withgoogle.com
  25. Facebook CTF - https://www.facebook.com/careers/life/hackathons
  26. HSCTF - https://hsctf.com
  27. NahamCon CTF - https://ctf.nahamcon.com
  28. CyberDefenders - https://cyberdefenders.org
  29. BlueTeamLabs Online - https://blueteamlabs.online

Vulnerable Web Applications (47 Resources)

Intentionally vulnerable web applications for practicing web security testing:

  1. OWASP Juice Shop - https://owasp.org/www-project-juice-shop
  2. DVWA - https://github.com/digininja/DVWA
  3. bWAPP - http://www.itsecgames.com
  4. WebGoat - https://owasp.org/www-project-webgoat
  5. WebGoat.NET - https://github.com/WebGoat/WebGoat.NET
  6. DVIA - https://github.com/prateek147/DVIA
  7. InsecureBankv2 - https://github.com/dineshshetty/Android-InsecureBankv2
  8. Mutillidae II - https://github.com/webpwnized/mutillidae
  9. Hackademic - https://github.com/Hackademic/hackademic
  10. WackoPicko - https://github.com/adamdoupe/WackoPicko
  11. BadStore - https://github.com/bkimminich/BadStore
  12. Gruyere - https://google-gruyere.appspot.com
  13. Hackxor - https://hackxor.sourceforge.net
  14. XVWA - https://github.com/s4n7h0/xvwa
  15. Security Shepherd - https://owasp.org/www-project-security-shepherd
  16. Security Ninjas - https://github.com/OWASP/SecurityNinjas
  17. ZeroBank - https://github.com/OWASP/ZeroBank
  18. Altoro Mutual - https://demo.testfire.net
  19. Hackme CTF - https://hack.me
  20. CryptOMG - https://github.com/cryptOMG/cryptOMG
  21. Command Injection Lab - https://github.com/cybersecurity-labs/command-injection-lab
  22. XSS Labs - https://xss-game.appspot.com
  23. PortSwigger Academy - https://portswigger.net/web-security
  24. Django.NV - https://github.com/nVisium/django.nv
  25. RailsGoat - https://github.com/OWASP/railsgoat
  26. NodeGoat - https://github.com/OWASP/NodeGoat
  27. Spring Boot Vuln App - https://github.com/hdivsecurity/springboot-vuln-app
  28. Laravel.VWA - https://github.com/Live-Hack-CVE/Laravel-VWA
  29. WordPress Lab - https://wordpress.org/plugins
  30. Joomla Vuln - https://developer.joomla.org/security.html
  31. Drupal Vuln - https://www.drupal.org/security
  32. OWASP Broken Web Apps - https://owasp.org/www-project-broken-web-applications
  33. OWASP WrongSecrets - https://github.com/OWASP/wrongsecrets
  34. OWASP DevSlop - https://github.com/OWASP/DevSlop
  35. OWASP iGoat - https://github.com/OWASP/igoat
  36. OWASP GoatDroid - https://github.com/OWASP/GoatDroid
  37. OWASP Mobile Top 10 - https://owasp.org/www-project-mobile-top-10
  38. Vulnerable Flask - https://github.com/iridakos/flask-security
  39. Vulnerable Express - https://github.com/cr0hn/vulnerable-node
  40. SSRF Lab - https://portswigger.net/web-security/ssrf
  41. XXE Lab - https://portswigger.net/web-security/xxe
  42. Insecure Deserialization - https://portswigger.net/web-security/deserialization
  43. GraphQL Vuln - https://github.com/dolevf/graphql-security
  44. WebSocket Vuln - https://portswigger.net/web-security/websockets
  45. JWT Vuln - https://jwt.io/introduction
  46. OAuth Vuln - https://portswigger.net/web-security/oauth
  47. SAML Vuln - https://portswigger.net/web-security/saml

Downloadable VMs & Labs (25 Resources)

Virtual machines and complete lab environments for offline practice:

  1. Metasploitable 1 - https://sourceforge.net/projects/metasploitable
  2. Metasploitable 2 - https://sourceforge.net/projects/metasploitable
  3. Metasploitable 3 - https://github.com/rapid7/metasploitable3
  4. VulnHub - https://www.vulnhub.com
  5. Kioptrix - https://www.vulnhub.com/series/kioptrix,8
  6. FristiLeaks - https://www.vulnhub.com/entry/fristileaks-13,133
  7. Stapler - https://www.vulnhub.com/entry/stapler-1,150
  8. Mr-Robot - https://www.vulnhub.com/entry/mr-robot-1,151
  9. Brainpan - https://www.vulnhub.com/entry/brainpan-1,51
  10. Lord of the Root - https://www.vulnhub.com/series/lord-of-the-root,66
  11. Tr0ll - https://www.vulnhub.com/series/tr0ll,45
  12. PwnLab - https://www.vulnhub.com/entry/pwnlab-init,158
  13. SkyTower - https://www.vulnhub.com/entry/skytower-1,96
  14. IMF - https://www.vulnhub.com/entry/imf-1,162
  15. Breakout - https://www.vulnhub.com/entry/breakout-1,190
  16. Zico2 - https://www.vulnhub.com/entry/zico2-1,210
  17. DevRandom - https://www.vulnhub.com/entry/devrandom-1,211
  18. Misdirection - https://www.vulnhub.com/entry/misdirection-1,227
  19. HackFest2016 - https://www.vulnhub.com/entry/hackfest2016,190
  20. WinterMute - https://www.vulnhub.com/entry/wintermute-1,239
  21. Nebula - https://exploit.education/nebula
  22. Protostar - https://exploit.education/protostar
  23. Fusion - https://exploit.education/fusion
  24. Phoenix - https://exploit.education/phoenix
  25. CengBox - https://github.com/CengBox
  26. PwnOS - https://www.vulnhub.com/series/pwnos,25
  27. Lamphy - https://www.vulnhub.com/entry/lamphy,215
  28. Born2Root - https://www.vulnhub.com/entry/born2root-1,197
  29. HA: Narak - https://www.vulnhub.com/entry/ha-narak,434
  30. Bug Report Learning - https://hackerone.com/hacktivity
  31. Your Own Lab - https://github.com/infosecn1nja/Red-Teaming-Toolkit

Documentation & References (43 Resources)

Comprehensive documentation, guides, and reference materials:

  1. OWASP Official Documentation - https://owasp.org/www-project-top-ten/
  2. OWASP WebGoat - https://owasp.org/www-project-webgoat/
  3. GitHub Security Lab - https://securitylab.github.com/
  4. GitHub Advisory Database - https://github.com/advisories
  5. PortSwigger Web Security Academy - https://portswigger.net/web-security
  6. Hacksplaining - https://www.hacksplaining.com/
  7. SANS Reading Room - https://www.sans.org/white-papers/
  8. MITRE ATT&CK - https://attack.mitre.org/
  9. NIST Cybersecurity Framework - https://www.nist.gov/cyberframework
  10. AWS Security Documentation - https://docs.aws.amazon.com/security/
  11. Azure Security Documentation - https://learn.microsoft.com/en-us/security/
  12. Google Cloud Security - https://cloud.google.com/security
  13. EC-Council Resources - https://www.eccouncil.org/resources/
  14. INE Cybersecurity Training - https://ine.com/learning/cybersecurity
  15. Cisco Security Learning - https://www.cisco.com/site/us/en/learn/training-certifications/security.html
  16. Microsoft Learn Security - https://learn.microsoft.com/en-us/training/browse/?products=security
  17. VirusTotal - https://www.virustotal.com/
  18. ANY.RUN Interactive Malware Analysis - https://any.run/
  19. Hybrid Analysis - https://www.hybrid-analysis.com/
  20. TraceLabs OSINT - https://www.tracelabs.org/
  21. GRFICS OSINT Framework - https://grfics.github.io/
  22. K8s Goat - https://github.com/madhuakula/kubernetes-goat
  23. CloudGoat - https://github.com/RhinoSecurityLabs/cloudgoat
  24. Flaws.cloud - http://flaws.cloud/
  25. DetectionLab - https://github.com/clong/DetectionLab
  26. Secure Code Game - https://github.com/skills/secure-code-game
  27. Hack.me - https://hack.me/
  28. Hacking-Lab - https://www.hacking-lab.com/
  29. CTFtime - https://ctftime.org/
  30. Awesome-CTF - https://github.com/apsdehal/awesome-ctf
  31. SecurityTube - https://www.securitytube.net/
  32. InfoSec Institute - https://www.infosecinstitute.com/
  33. Docker Hub - https://hub.docker.com/
  34. Proxmox Documentation - https://www.proxmox.com/en/proxmox-ve
  35. GNS3 - https://www.gns3.com/
  36. RangeForce - https://www.rangeforce.com/
  37. LetsDefend - https://letsdefend.io/
  38. SecureFlag - https://www.secureflag.com/
  39. Bugcrowd University - https://www.bugcrowd.com/hackers/bugcrowd-university/
  40. HackerOne Hacktivity - https://hackerone.com/hacktivity
  41. Intigriti Hackademy - https://www.intigriti.com/hackademy
  42. HackToLive Academy - https://hacktolive.net/
  43. Offensive Security Platform - https://offsecplatform.com

🎓 Free Mentored Training Provider (1 Resource)

Platforms offering guided learning with mentorship:

  1. HackToLive - https://hacktolive.net

Getting Started

Prerequisites

  1. Start with OverTheWire or PicoCTF for absolute beginners
  2. Move to TryHackMe or HackTheBox Free Tier for guided learning
  3. Practice on VulnHub VMs like Kioptrix or Metasploitable
  4. Explore Vulnerable Web Apps like DVWA or OWASP Juice Shop
  5. Use Documentation resources to deepen understanding

Stay curious, stay ethical, and happy hacking!