Where to practise legally: picoCTF, OverTheWire, TryHackMe, Hack The Box, and local labs

Platforms

picoCTF from Carnegie Mellon is free and beginner-friendly, with a large archive of past challenges. OverTheWire offers free wargames such as Bandit and Natas. TryHackMe provides guided rooms with browser-based machines, with free and paid tiers. Hack The Box offers machines and challenges at a range of difficulty, plus an academy with structured modules. PortSwigger Web Security Academy has free, high-quality web labs.

Local labs

Self-hosted intentionally vulnerable applications let you practise offline and break things freely: OWASP Juice Shop, DVWA, WebGoat, and VulnHub virtual machines. Run them on an isolated host-only network, never exposed to the internet.

Snippet

docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop
docker run --rm -p 127.0.0.1:8080:80 vulnerables/web-dvwa
docker run --rm -p 127.0.0.1:8081:8080 webgoat/webgoat

Lab: plan a progression

Write a three-month plan: month one on picoCTF archives and Bandit for fundamentals; month two on PortSwigger labs for web and a guided TryHackMe path; month three on easy Hack The Box machines or a beginner live event. For each week, choose one skill to focus on and one write-up to produce.

Staying legal

Practise only on platforms and labs that explicitly invite testing, within their rules. Testing other systems without written permission is illegal in most countries, even with good intentions. Bug bounty programs offer legal real-world testing, but only within each program’s published scope.

Diagram

Practice options by style

Mix guided and open-ended.

picoCTF
Free, beginner jeopardy archive.
OverTheWire
Free wargames: Linux, web, and more.
PortSwigger Academy
Free web security labs with explanations.
TryHackMe / Hack The Box
Guided rooms and machines, free and paid tiers.
Local labs
Juice Shop, DVWA, WebGoat on localhost.

Check yourself

1. Which free resource focuses on web security labs with explanations?

2. How should local vulnerable apps be run?

3. What makes real-world testing legal?