CyberGym: a legal place to practise hacking

CyberGym is a free, deliberately vulnerable web shop at cybergym.hackergpt.app where you can practise web hacking legally, in your browser, with nothing to install. You learn injection, cross-site scripting, broken access control and more by finding the flaws yourself and checking each result on its Score Board.

What you will practise

You learn web hacking by doing it on a working application: a shop with accounts, a basket, product reviews, an API and a chatbot, built with intended security flaws for training and CTFs. CyberGym runs OWASP Juice Shop (version 19.1.1 on 5 November 2026) under its own branding.

On 5 November 2026 it listed 110 hacking challenges in 16 categories, on six difficulty levels, and 14 of them were at difficulty 1. The categories include injection, cross-site scripting (XSS), broken access control, broken authentication, sensitive data exposure, improper input validation, vulnerable components and security misconfiguration. Some challenges have you read the app and find something it left exposed; others have you craft a request the app should have refused.

The legal question is settled before you start. Testing a site without its owner's permission is an offence in most countries, whatever your reason. CyberGym exists to be attacked, and full permission is granted to hack it, so you can run a payload to see what it really does instead of only reading about it.

How a practice session works

  1. Open it in a browser

    Go to cybergym.hackergpt.app. There is nothing to install and you do not need an account to start. Some challenges need you to register: use a made-up address and a password you use nowhere else.

  2. Start from the Score Board

    The welcome banner links to the Score Board at /#/scores, which lists the challenges and lets you filter them by category and difficulty.

  3. Take a tutorial if you are new

    On 5 November 2026, 13 challenges had an interactive tutorial from the built-in Hacking Instructor, starting with Score Board, DOM XSS and Bonus Payload. Each one walks you through a first solve.

  4. Pick one challenge and read the app

    Use the shop the way a customer would, watch its requests in your browser's developer tools, and read the code it sends to the browser. Form a guess about the flaw, then test it. Open a hint when you are stuck.

  5. Verify it, then write it down

    The app announces a solved challenge. Note what you found, how you found it and how the owner of a real app should fix it. That note is what turns a solved challenge into a skill you keep.

Who it is for

  • Beginners and students. Try your first SQL injection or XSS on a target where trying is allowed, with tutorials and hints to get you started.
  • CTF players. Warm up on web challenges across six difficulty levels, without setting up a target first.
  • Developers and site owners. See what these flaws look like from the attacker's side, then check whether your own app has the same weakness.

What helps you learn

  • A Score Board of 110 hacking challenges you can filter by category and difficulty (5 November 2026)
  • Interactive tutorials for 13 challenges, for your first solves
  • Hints on 109 of the 110 hacking challenges, so you can get unstuck without reading a full solution
  • A mitigation link on 76 challenges, to learn how the flaw is fixed in a real app
  • Coding challenges on 31 of them: once you have solved one, find the vulnerable line in the source and choose the fix. The Score Board counts these too, so its total is higher than 110
  • Free access in the browser, with nothing to install

Legal targets only

Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. Practise on CyberGym.

FAQ

Is it legal to hack CyberGym?

Yes. CyberGym is published to be attacked, and full permission is granted to hack it. That permission covers the CyberGym application at cybergym.hackergpt.app and nothing else: not hackergpt.app, and not any other site. This is general information, not legal advice.

Is CyberGym free, and do I need to install anything?

It is free, and it runs in your browser. You only need to install something if you want to run OWASP Juice Shop yourself, which takes Docker or Node.js.

Is CyberGym the same as OWASP Juice Shop?

CyberGym runs OWASP Juice Shop with its own branding and some routes renamed, such as the Score Board at /#/scores. A walkthrough written for the original will not always match. It is hosted for practice, unlike the official Juice Shop demo, which its maintainers ask people not to hack.

Why are most challenges already solved?

CyberGym is one instance shared by everyone using it, and the Score Board shows everyone's progress, not only yours. A tick does not tell you who solved it, and the challenges still work, so you can solve them yourself. For a scoreboard that only counts your own work, run Juice Shop on your own machine.

What should I not do on CyberGym?

Do not enter real personal data or a password you use anywhere else: the app is insecure on purpose, and other people practise on it too. Treat any account as disposable, and do not try to knock the instance offline, because that only spoils it for everyone else.

Can I use HackerGPT on CyberGym?

Yes. CTF Mode can work through CyberGym with you, explaining each step as it goes. Like any tool, it reports what it finds, and doing the steps yourself is what builds the skill.

Can I try the same techniques on other websites?

Only on sites you own or have written permission to test. When you are ready to move on from CyberGym, your own site or app is the next step.

Open CyberGym

Related