🔭Hacking Labs

Test your pentesting knowledge!

Web

Online/Live

Acunetix :

• TestASP (Forum - ASP)

• TestAspNet (Blog - .NET)

• VulnWeb

• Cenzic CrackMeBank

• Google Gruyere (Python)

• Hacking-Lab (eg. OWASP Top 10)

• Hack.me (beta)

• HackThisSite (HTS - Basic & Realistic (web) Missions)

• Hackxor online demo (algo/smurf)

• HP/SpiDynamics Free Bank Online (admin/admin)

• IBM/Watchfire AltoroMutual (jsmith/Demo1234)

• NTOSpider Web Scanner Test Site (testuser/testpass)

• OWASP Hackademic Challenges Project - Live (PHP - Joomla)

• Pentester Academy

Offline

The following list references downloadable vulnerable web applications to play with that can be installed on a standard operating system (Linux, Windows, Mac OS X, etc) using a standard web platform (Apache/PHP, Tomcat/Java, IIS/.NET, etc).

• The BodgeIt Store (Java)

• OWASP Bricks (PHP)

• The ButterFly Security Project (PHP)

• bWAPP - an extremely buggy web application! (PHP)

• Damn Vulnerable Web Application - DVWA (PHP)

• Damn Vulnerable Web Services - DVWS (PHP)

• OWASP Hackademic Challenges Project (PHP)

• Google Gruyere (Python)

• Hacme Bank (.NET)

• Hacme Books (Java)

• Hacme Casino (Ruby on Rails)

• Hacme Shipping (ColdFusion)

• Hacme Travel (C++)

• Mutillidae (PHP)

• OWASP .NET Goat (C#)

• Peruggia (PHP)

• Puzzlemall (Java)

• Stanford Securibench (Java) & Micro

• SQLI-labs (PHP)

• SQLol (PHP)

• OWASP Vicnum Project (Perl & PHP)

• VulnApp (.NET)

• WackoPicko (PHP)

• OWASP WebGoat (Java)

• OWASP ZAP WAVE - Web Application Vulnerability Examples (Java)

• Wavsep - Web Application Vulnerability Scanner Evaluation Project (Java)

• WIVET - Web Input Vector Extractor Teaser

Virtual Machines (VMs) or ISO images

• BadStore (ISO)

• Bee-Box (bWAPP VMware)

• OWASP BWA - Broken Web Applications Project (VMware - list)

• Drunk Admin Web Hacking Challenge (VMware)

• Exploit.co.il Vuln Web App (VMware)

• GameOver (VMware)

• Hackxor (VMware)

• Hacme Bank Prebuilt VM (VMware)

• Kioptrix4 (VMware & Hyper-V)

• LAMPSecurity (VMware)

• Metasploitable (VMware)

• Metasploitable 2 (VMware)

• Moth (VMware)

• PentesterLab - The Exercises (ISO & PDF)

• PHDays I-Bank (VMware)

• Samurai WTF (ISO - list)

• Sauron (Quemu) [Spanish]

• UltimateLAMP (VMware - list)

• Virtual Hacking Lab (ZIP)

• Web Security Dojo (VMware, VirtualBox - list)

iOS

• Oversecured Vulnerable iOS App

• Damn Vulnerable iOS App (DVIA)

• iGoat

Android

• DVAA

• DIVA Android

  • Walkthrough

• Android InsecureBank v2

• hpAndro Android AppSec (Kotlin)

• MSTG Hacking Playground

• InjuredAndroid

• AndroGoat

• OWASP Crackmes

• Sieve app

• Purposefully Insecure and Vulnerable Android Application(PIIVA)

• Damn Vulnerable Hybrid Mobile App (DVHMA)

• Damn Vulnerable Bank

IOT

• IOTGoat - OWASP