# Where to practice hacking legally: CyberGym and other targets

Published: 2026-10-24 · By HackerGPT Team
Canonical: https://hackergpt.org/blog/practice-hacking-legally/

> Hacking practice is legal when the owner of the target has said yes. The options that say yes, from a hosted OWASP Juice Shop to the big training platforms, and a first session on CyberGym, step by step.

**TL;DR:** You can practice hacking legally on any target whose owner has given you permission: a deliberately vulnerable app you run yourself (OWASP Juice Shop), a hosted one built to be attacked ([CyberGym](https://cybergym.hackergpt.app)), or a training platform's labs (PortSwigger Web Security Academy, picoCTF, TryHackMe, Hack The Box). The technique is not what makes it legal or illegal; authorisation is.

This is for students, CTF players and career changers who want to try web hacking on something real without wondering whether they are committing a crime. You will see why permission is the line the law draws, which free targets give you that permission, and what a first hour on CyberGym looks like, from opening the page to the first solved challenge.

This article is general information, not legal advice. Laws differ by country, and if you are unsure about a specific target, ask a lawyer or simply do not touch it.

## Is it legal to practice hacking?

Yes, as long as you are authorised to access the system you are practising on. The main computer-crime laws make **access without authorisation** the offence, not knowledge of hacking or the use of security tools.

- In the United States, the Computer Fraud and Abuse Act makes it an offence to "intentionally access a computer without authorization or exceed authorized access" and thereby obtain information, and separately to cause damage to a protected computer ([18 U.S.C. § 1030(a)(2) and (a)(5)](https://www.law.cornell.edu/uscode/text/18/1030)).
- In the United Kingdom, section 1 of the Computer Misuse Act 1990 makes it an offence to cause a computer to perform any function with intent to secure access to a program or data when "the access he intends to secure is unauthorised" and the person knows it ([Computer Misuse Act 1990, s. 1](https://www.legislation.gov.uk/ukpga/1990/18/section/1)). Section 1(2) adds that the intent need not be aimed at any particular computer.

Two consequences follow for a learner. First, curiosity is not a defence: "I was only practising" does not turn unauthorised access into authorised access. Second, a good motive helps less than people assume. The US Justice Department tells federal prosecutors to decline charges for conduct that was solely "good-faith security research" ([Justice Manual 9-48.000](https://www.justice.gov/jm/jm-9-48000-computer-fraud)), but that is a charging policy for federal prosecutors, not a change to the statute, and it does not reach other countries or civil claims. Practising on a target that has invited you avoids the whole question.

So the practical rule is short: **practice only on targets you own or that have given you written permission.** Everything in the rest of this article sits inside that rule.

## Where can I practice hacking legally?

On targets built for it. Each option below publishes its permission in the form of its purpose: it exists to be attacked, within the rules its owner sets. The facts in each row come from the project's own site, as of 24 October 2026; check them again before you choose, because plans change.

| Option | What it is | Cost | Install needed? | Source |
| --- | --- | --- | --- | --- |
| [CyberGym](https://cybergym.hackergpt.app) | A hosted, deliberately vulnerable web shop for training and CTFs, running OWASP Juice Shop (version 19.1.1 on 24 October 2026) | Free | No, open it in a browser | its own welcome banner and `/rest/admin/application-version` |
| OWASP Juice Shop, self-hosted | "Probably the most modern and sophisticated insecure web application for security trainings, awareness demos and CTFs", MIT-licensed | Free | Yes: Docker or Node.js on your machine | [OWASP project page](https://owasp.org/www-project-juice-shop/), [GitHub README](https://github.com/juice-shop/juice-shop) |
| PortSwigger Web Security Academy | "Free, online web security training from the creators of Burp Suite", with interactive labs and progress tracking | Free | Some labs need tools such as Burp Suite Community Edition | [Web Security Academy](https://portswigger.net/web-security) |
| picoCTF, now CyLab Security Academy | A free education programme and competition from Carnegie Mellon University: self-paced CTF challenges plus timed events | Free | No | [picoctf.org](https://picoctf.org/), [cylabacademy.org](https://cylabacademy.org/) |
| TryHackMe | Browser-based learning rooms and paths; the free tier has free rooms only and a daily limit on the in-browser AttackBox | Free tier and paid plans | No, the AttackBox runs in the browser | [TryHackMe pricing](https://tryhackme.com/pricing) |
| Hack The Box (HTB Labs) | Machines to compromise; free users get the active machines and a rotating shortlist of retired ones, the rest need a paid plan | Free tier and paid plans | A VPN connection from your own VM, or their hosted Pwnbox | [HTB help centre](https://help.hackthebox.com/en/articles/5185338-how-to-play-machines-on-hack-the-box) |

How to choose between them:

- **You want a whole web application, now.** CyberGym or a self-hosted Juice Shop. Both are the same kind of target: one realistic shop with dozens of planted vulnerabilities to find in context, rather than one lab per bug.
- **You want to learn one vulnerability class properly.** PortSwigger's Academy pairs each lab with a written explanation of the class.
- **You like scoring points and competitions.** picoCTF's events and HTB's active machines.
- **You want a guided path from zero.** TryHackMe's learning paths.

### Why not just use the Juice Shop demo?

Because its maintainers ask you not to. The Juice Shop README describes its public demo instance as being for deployment testing and a sneak peek, and says "you are not supposed to use this instance for your own hacking endeavours" ([Juice Shop README](https://github.com/juice-shop/juice-shop)). That is exactly the gap a hosted practice instance fills: CyberGym is a Juice Shop published for the purpose of being attacked, so you do not need Docker on a school laptop to start.

The alternative is to run it yourself, which takes two commands from the README:

```bash
docker pull bkimminich/juice-shop
docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop
```

It is then on `http://localhost:3000`. The `127.0.0.1:` prefix keeps it reachable from your machine only, which matters: a deliberately vulnerable app on an open port is an invitation to anyone on your network.

## What does a first session on CyberGym look like?

Find the Score Board, read the app the way a tester would, pick one easy challenge that your reading points at, and verify the result. That is what the session below did, on 24 October 2026, with a browser and `curl` and nothing else. It does not hand you a list of answers: each step is a method you can reuse on the next challenge.

![Six-step loop for a first CyberGym session, from looking around to verifying a solved challenge, scoped to CyberGym](https://hackergpt.org/blog/practice-hacking-legally/first-session.webp) *The loop behind the session below. Every step stays inside one host whose owner has invited you in.*

### 1\. Look around like a customer

Opening `https://cybergym.hackergpt.app` shows a shop and a welcome banner that says CyberGym "is a deliberately insecure web application packed with a vast number of intended security vulnerabilities", with a link to the Score Board and a "Help getting started" button that starts an interactive tutorial. Click through the shop, register an account, add something to the basket. You are learning what the app is for, which is what tells you later what counts as a flaw.

### 2\. Fingerprint what it runs

The first technical question about any target is what software it is. This app answers it directly:

```bash
curl -s https://cybergym.hackergpt.app/rest/admin/application-version
```

```json
{"version":"19.1.1"}
```

An unauthenticated endpoint that names the exact version is itself a finding on a real site: it tells an attacker which known bugs to try. Here it tells you which Juice Shop documentation applies.

### 3\. Read the client

A single-page app ships its own map to the browser. The Angular front end lists every route it can render in `main.js`, so you can read the routes without guessing them:

```bash
curl -s https://cybergym.hackergpt.app/main.js | grep -o 'path:"[a-z0-9/-]*"' | sort -u
```

The output was 39 routes. Some are what the shop menu shows; a few are not linked from anywhere a customer would click:

```text
path:"accounting"
path:"administration"
path:"privacy-policy"
path:"privacy-security"
path:"scores"
path:"web3-sandbox"
```

That is an excerpt, not the full list. Reading the client before attacking anything is the same habit as [mapping an app's attack surface before testing it](https://hackergpt.org/blog/map-web-app-attack-surface/), at the smallest scale.

### 4\. Find the Score Board

The Score Board is the first challenge in Juice Shop: "Find the carefully hidden 'Score Board' page." In upstream Juice Shop the route is `score-board`; in CyberGym the route list above shows it as `scores`, and the welcome banner links straight to it. So the first observation is that a writeup for the upstream app will not always match this instance. Read the target, not the walkthrough.

![CyberGym Score Board with progress counters, challenge categories and the Score Board, DOM XSS and Privacy Policy cards](https://hackergpt.org/blog/practice-hacking-legally/scores.webp) *The CyberGym Score Board at /#/scores, as it looked on 24 October 2026. Progress is shared by everyone using the instance.*

The second observation surprised us: many challenges were already ticked. CyberGym is one shared instance, and the Score Board shows the instance's progress, not yours. The challenge API shows the same thing:

```bash
curl -s "https://cybergym.hackergpt.app/api/Challenges/?difficulty=1" \
  | jq -r '.data[] | "\(.solved)\t\(.name)"' | sort
```

If you want a scoreboard that only counts your own work, run Juice Shop locally. For learning the method, a solved tick does not matter: the challenge is still there to solve.

### 5\. Pick one challenge your reading points at

Filter the Score Board to difficulty 1 and look for a challenge that matches something from step 3. One did: **Web3 Sandbox**, in the Broken Access Control category, "Find an accidentally deployed code sandbox for writing smart contracts on the fly." The route list already contained `web3-sandbox`, which no menu links to. The hypothesis: the sandbox is deployed and reachable by anyone who knows the route.

Opening `https://cybergym.hackergpt.app/#/web3-sandbox` tested it with a single request. The page loaded a smart-contract editor with compile and deploy controls, and the app showed "You successfully solved a challenge: Web3 Sandbox".

![CyberGym banner confirming the Web3 Sandbox challenge was solved, above the exposed smart-contract editor](https://hackergpt.org/blog/practice-hacking-legally/sandbox.webp) *Solving Web3 Sandbox: the page itself was the finding, and the app announced it.*

### 6\. Verify, then write it up

A banner is a good sign, not evidence. The challenge API is the record:

```bash
curl -s "https://cybergym.hackergpt.app/api/Challenges/?key=web3SandboxChallenge" \
  | jq '.data[0] | {name, category, difficulty, solved}'
```

```json
{
  "name": "Web3 Sandbox",
  "category": "Broken Access Control",
  "difficulty": 1,
  "solved": true
}
```

Then write three lines for yourself: what you found (an internal tool reachable without authentication), how (a route read from the client bundle), and what the owner of a real app should do (remove it from production builds, or put it behind the same access check as other admin tools). Those three lines are what turns a solved challenge into something you learnt, and they are the shape of a real finding.

What did not work, for the record: guessing `#/score-board` from upstream writeups led nowhere on this instance, which is why step 3 comes before step 4.

## What should I practice next?

Keep the loop and raise the difficulty. On CyberGym, work through the difficulty 1 and 2 challenges in one category at a time, and read the mitigation link on each challenge card once you have solved it. When a class clicks, do the matching PortSwigger lab to see the same bug in isolation.

If you want help along the way, HackerGPT's [CTF Mode](https://hackergpt.org/features/ctf-mode/) runs a CTF on your own website, or on CyberGym when you do not have one, and explains each step as it happens; the other modules are on the [features page](https://hackergpt.org/features/). It is a learning aid, not a substitute for doing the steps yourself, and like any tool it reports what it finds rather than everything there is. If you would rather start from your own app, [how to pentest your own website](https://hackergpt.org/blog/how-to-pentest-your-own-website/) covers the scope and safety side.

## Key takeaways

- Practise only on targets you own or that have given you permission; under the CFAA and the Computer Misuse Act, unauthorised access is the offence, whatever your motive.
- For a whole web application with no install, use a hosted practice instance such as CyberGym; for your own scoreboard, run Juice Shop locally on `127.0.0.1`.
- Read the target before attacking it: version endpoints and the client's route list pointed at two challenges in this session before any payload was needed.
- Verify every result against the app's own record, then write down what, how and the fix.
- Do not trust upstream walkthroughs blindly; this instance's Score Board route differs from upstream Juice Shop's.

## FAQ

### Is it legal to scan a website for vulnerabilities?

Only with the owner's permission. Laws such as the US Computer Fraud and Abuse Act and the UK Computer Misuse Act make unauthorised access the offence, and a scan of someone else's site can cross that line or break its terms of service. Scan your own sites, sites whose owner has given you written permission, or practice targets such as CyberGym that exist to be scanned. This is general information, not legal advice.

### Do I need to install anything to practice hacking?

No. CyberGym, picoCTF and PortSwigger's Web Security Academy all run in the browser, and TryHackMe provides a browser-based attack machine with a daily limit on its free tier. You only need to install something if you want to self-host OWASP Juice Shop, which takes Docker or Node.js, or use tools such as Burp Suite for some labs.

### Is CyberGym the same as OWASP Juice Shop?

CyberGym runs OWASP Juice Shop, version 19.1.1 when this was written, with its own branding and some routes renamed, such as the Score Board at `/#/scores`. It is hosted for practice at cybergym.hackergpt.app, so you can attack it without installing anything, unlike the official Juice Shop demo, which its maintainers ask people not to hack.

### Why are challenges on CyberGym already solved?

CyberGym is one shared instance, and the Score Board shows the progress of everyone using it, not just yours. The challenges still work, so you can solve them yourself; the tick just does not tell you who did. For a scoreboard of your own, run Juice Shop locally.

### What are free alternatives to TryHackMe for web hacking practice?

PortSwigger's Web Security Academy is free and focused on web vulnerabilities, picoCTF (now CyLab Security Academy) is free and CTF-based, and OWASP Juice Shop is free either self-hosted or as the hosted CyberGym instance. Hack The Box also has a free tier with its active machines.

## Sources

- [18 U.S.C. § 1030, Computer Fraud and Abuse Act](https://www.law.cornell.edu/uscode/text/18/1030), Cornell Legal Information Institute
- [Computer Misuse Act 1990, section 1](https://www.legislation.gov.uk/ukpga/1990/18/section/1), legislation.gov.uk
- [Justice Manual 9-48.000, Computer Fraud and Abuse Act](https://www.justice.gov/jm/jm-9-48000-computer-fraud), US Department of Justice
- [OWASP Juice Shop project page](https://owasp.org/www-project-juice-shop/)
- [OWASP Juice Shop README](https://github.com/juice-shop/juice-shop), GitHub
- [PortSwigger Web Security Academy](https://portswigger.net/web-security)
- [picoCTF](https://picoctf.org/) and [CyLab Security Academy](https://cylabacademy.org/), Carnegie Mellon University
- [TryHackMe pricing](https://tryhackme.com/pricing)
- [How to play Machines on Hack The Box](https://help.hackthebox.com/en/articles/5185338-how-to-play-machines-on-hack-the-box), HTB help centre

Practice on [CyberGym](https://cybergym.hackergpt.app), or try HackerGPT on your own site at [hackergpt.app](https://hackergpt.app).