Mind maps / Hacking Practice Lab
Hacking Practice Lab: vulnerable apps and systems
A mind map of vulnerable web applications, operating system images, CTF archives and vendor test sites where you can practise penetration testing legally. SANS used it for its pentest poster in 2015 and 2016.
Only test systems you own or have written permission to test. Everything listed here was built for practice. This edition (v5.0) dates from January 2019, so some projects have since moved or closed.
Reference
Links from the map
These are the sources and tools referenced in the Hacking Practice Lab mind map. Links marked offline pointed to projects that have since shut down or moved, so they are kept as text only.
Vulnerable Web Applications
Vulnerable Operating System Installations
| 21LTR | 21ltr.com/scenesoffline |
|---|---|
| Damn Vulnerable Linux | sourceforge.net/projects/virtualhacking/files/os/dvl |
| exploit-exercises - nebula, protostar, fusion | exploit-exercises.com/downloadoffline |
| heorot: DE-ICE, hackerdemia | hackingdojo.com/downloads/iso/De-ICE_S1.100.isooffline hackingdojo.com/downloads/iso/De-ICE_S1.110.isooffline hackingdojo.com/downloads/iso/De-ICE_S1.120.isooffline hackingdojo.com/downloads/iso/De-ICE_S2.100.isooffline hackingdojo.com/downloads/iso/De-ICE_S1.123.isooffline |
| Holynix | sourceforge.net/projects/holynix/files |
| Kioptrix | kioptrix.com/blog |
| LAMPSecurity | sourceforge.net/projects/lampsecurity |
| Metasploitable | sourceforge.net/projects/virtualhacking/files/os/metasploitable |
| neutronstar | neutronstar.org/goatselinux.html |
| PenTest Laboratory | pentestlab.org/lab-in-a-boxoffline |
| Pentester Lab | pentesterlab.com/exercises |
| pWnOS | pwnos.com |
| RebootUser Vulnix | rebootuser.com/?page_id=1041 |
| SecGame # 1: Sauron | sg6-labs.blogspot.com/2007/12/secgame-1-sauron.html |
| scriptjunkie.us | scriptjunkie.us/2012/04/the-hacker-games |
| UltimateLAMP | amanhardikar.com/mindmaps/practice-links.html |
| TurnKey Linux | turnkeylinux.org |
| Bitnami | bitnami.com/stacks |
| Elastic Server | elasticserver.comoffline |
| OS Boxes | osboxes.org |
| VirtualBoxes | virtualboxes.org/images |
| VirtualBox Virtual Appliances | virtualboximages.com |
| CentOS | centos.org |
| Default Windows Clients | microsoft.com/en-us/evalcenter/evaluate-windows-10-enterpriseoffline dev.windows.com/en-us/microsoft-edge/tools/vmsoffline |
| Default Windows Server | microsoft.com/en-us/evalcenter/evaluate-windows-server-technical-previewoffline |
| Default VMWare vSphere | vmware.com/products/vsphereoffline |
Sites for Downloading Older Versions of Various Software
| Exploit-DB | exploit-db.com |
|---|---|
| Old Apps | oldapps.com |
| Old Version | oldversion.com |
| VirtualHacking Repo | sourceforge.net/projects/virtualhacking/files/apps%40realworld |
Sites by Vendors of Security Testing Software
| Acunetix acuforum | testasp.vulnweb.com |
|---|---|
| Acunetix acublog | testaspnet.vulnweb.com |
| Acunetix acuart | testphp.vulnweb.com |
| Cenzic crackmebank | crackme.cenzic.com |
| HP freebank | zero.webappsecurity.com |
| IBM altoromutual | demo.testfire.net |
| Mavituna testsparker | aspnet.testsparker.com |
| Mavituna testsparker | php.testsparker.com |
| NTOSpider Test Site | webscantest.com |
| Embedded Security CTF | microcorruption.com |
| EnigmaGroup | enigmagroup.org |
| Escape | alf.nu/alert1 |
| Google Gruyere | google-gruyere.appspot.com |
| Gh0st Lab | gh0st.net |
| Hack This Site | hackthissite.org |
| HackThis | defendtheweb.net |
| HackQuest | hackquest.com |
| Hack.me | hack.me |
| Hacking-Lab | hacking-lab.com |
| Hacker Challenge | dareyourmind.net |
| Hacker Test | hackertest.net |
| hACME Game | hacmegame.orgoffline |
| Halls Of Valhalla | halls-of-valhalla.org/beta/challengesoffline |
| Hax.Tor | hax.tor.hu |
| OverTheWire | overthewire.org/wargames |
| PentestIT | pentestit.ru/enoffline |
| CSC Play on Demand | pod.cybersecuritychallenge.org.ukoffline |
| pwn0 | pwn0.com/home.phpoffline |
| RootContest | rootcontest.comoffline |
| Root Me | root-me.org/?lang=en |
| Security Treasure Hunt | securitytreasurehunt.com |
| Smash The Stack | smashthestack.org |
| SQLZoo | sqlzoo.net/hackoffline |
| TheBlackSheep and Erik | bright-shadows.net |
| ThisIsLegal | thisislegal.com |
| Try2Hack | try2hack.nl |
| WabLab | wablab.com/hackme |
| XSS: Can You XSS This? | canyouxssthis.com/HTMLSanitizeroffline |
| XSS Game | xss-game.appspot.com |
| XSS: ProgPHP | xss.progphp.comoffline |
CTF Sites / Archives
| CAPTF Repo | captf.comoffline |
|---|---|
| CTFtime (Details of CTF Challenges) | ctftime.org/ctfs |
| CTF write-ups repository | github.com/ctfs |
| Reddit CTF Announcements | reddit.com/r/securityctf |
| shell-storm Repo | shell-storm.org/repo/CTFoffline |
| VulnHub | vulnhub.com |
Mobile Apps
| Damn Vulnerable Android App (DVAA) | code.google.com/p/dvaa |
|---|---|
| Damn Vulnerable FirefoxOS Application (DVFA) | github.com/pwnetrationguru/dvfaoffline |
| Damn Vulnerable iOS App (DVIA) | github.com/prateek147/DVIA-v2 |
| ExploitMe Mobile Android Labs | securitycompass.github.io/AndroidLabs |
| ExploitMe Mobile iPhone Labs | securitycompass.github.io/iPhoneLabs |
| Hacme Bank Android | mcafee.com/us/downloads/free-tools/hacme-bank-android.aspx |
| InsecureBank | paladion.net/downloadapp.htmloffline |
| NcN Wargame | noconname.org/evento/wargameoffline |
| OWASP iGoat | code.google.com/p/owasp-igoat |
| OWASP Goatdroid | github.com/jackMannino/OWASP-GoatDroid-Project |
Lab
| binjitsu | github.com/binjitsu/binjitsuoffline |
|---|---|
| CTFd | github.com/isislab/CTFd |
| Mellivora | github.com/Nakiami/mellivora |
| NightShade | github.com/UnrealAkama/NightShade |
| MCIR | github.com/SpiderLabs/MCIR |
| Docker | docker.com |
| Vagrant | developer.hashicorp.com/vagrant |
| NETinVM | informatica.uv.es/~carlos/docencia/netinvm |
| SmartOS | tritoncloud.io/smartos |
| SmartDataCenter | github.com/joyent/sdc |
| vSphere Hypervisor | vmware.com/products/vsphere-hypervisoroffline |
| GNS3 | sourceforge.net/projects/gns-3 |
| OCCP | opencyberchallenge.netoffline |
| XAMPP | apachefriends.org/index.html |
Miscellaneous
| VulnVPN | rebootuser.com/?page_id=1041 |
|---|---|
| VulnVoIP | rebootuser.com/?page_id=1041 |
| Vulnserver | thegreycorner.com/2010/12/introducing-vulnserver.html |
| NETinVM | informatica.uv.es/~carlos/docencia/netinvm |
| DVRF | github.com/praetorian-inc/DVRF |
| HackSys Extreme Vulnerable Driver | payatu.com/hacksys-extreme-vulnerable-driveroffline |
| VirtuaPlant | github.com/jseidl/virtuaplant |
| Fosscomm | github.com/nikosdano/fosscomm |
| Morning Catch | blog.cobaltstrike.com/2014/08/06/introducing-morning-catch-a-phishing-paradiseoffline |
| AWBO | labs.snort.org/awbo/awbo.htmloffline |
