Practise hacking legally, on targets built for it

Testing a site you do not own or have permission to test is illegal in most countries. Practice targets remove that problem: they are built to be attacked, and solving a challenge tells you that you got it right.

Start with where to practise, then follow the CyberGym walkthroughs. CyberGym is a hosted OWASP Juice Shop, and each article explains the weakness behind a challenge and how to check your own app for it.

CyberGym is the free target these walkthroughs run on: open it in a browser and work through its challenges, with tutorials and hints along the way.

Articles

• Juice Shop Retrieve Blueprint: finding a file the shop never linked

  How a product photo's URL led to an unlinked 3D model in the same public folder on CyberGym, what the weakness is called, and how to check your own static folders for files you never meant to publish.

• Pentest scope template: what to agree before you test

  A fill-in pentest scope and rules of engagement template, built on NIST SP 800-115, with two filled-in examples: your own site, and a site you test with written permission. Plus five passive checks that show what a one-line scope leaves out.

• Exposed directory listing: how to find sensitive files your server shows

  A web folder with listing switched on hands out the name of every file in it, including documents nobody meant to publish. Learn why it happens, how to check your own server for it in a few commands, and how to switch it off.

• Where to practice hacking legally: CyberGym, Juice Shop and your own site

  Hacking practice is legal when the owner of the target has said yes. The targets that say yes, from a hosted OWASP Juice Shop to your own site, and a first session on CyberGym, step by step.