Free resources
Cybersecurity
Break into deliberately vulnerable applications in your own private copy and fix them, then investigate a compromised Linux machine.
Hands-on labs
Labs
Every lab is a real environment with a terminal beside it, nothing to install. Each has a short basic lesson that shows how a lesson works with a lab. A free account runs every lab and is given the basic lessons on Home; with no account you can run the Git lab and the SQL lab.
Container lab
OWASP Juice Shop lab: a vulnerable web shop to attack in your own copy
OWASP Juice Shop in each student’s private lab copy: over a hundred web security challenges across the OWASP Top 10, with nothing to install. Source on GitHub.
Free lessons
- Juice Shop Basics
- Juice Shop Basics 2
How it works · Source on GitHub · Create a free account to run it
Container lab
DVWA lab: practise SQL injection and XSS on the Damn Vulnerable Web Application
DVWA in each student’s private lab copy, its database already made: SQL injection, XSS and more at four security levels. Nothing to install; source on GitHub.
Free lessons
- DVWA Basics
- DVWA Basics 2
How it works · Source on GitHub · Create a free account to run it
Container lab
WebGoat lab: guided web security lessons with WebWolf in your own copy
OWASP WebGoat and WebWolf in each student’s private lab copy: guided lessons on injection, access control, JWT and more. Nothing to install; source on GitHub.
Free lessons
- WebGoat Basics
- WebGoat Basics 2
How it works · Source on GitHub · Create a free account to run it
Container lab
Mutillidae lab: practise SQL injection and XSS on a vulnerable PHP web application
OWASP Mutillidae II with its database and directory in each student’s private lab copy: SQL, LDAP and script injection. Nothing to install; code on GitHub.
Free lessons
- Mutillidae Basics
How it works · Source on GitHub · Create a free account to run it
Container lab
WrongSecrets lab: find hardcoded secrets and learn where secrets belong
OWASP WrongSecrets in each student’s private lab copy: fake secrets hidden in code, pages and config to find. Nothing to install; source on GitHub.
Free lessons
- WrongSecrets Basics
How it works · Source on GitHub · Create a free account to run it
Container lab
SQL injection lab: attack a weak shop search, fix the query and prove the fix
Attack a deliberately weak shop search in each student’s private lab copy, fix the query and prove it. Nothing to install; source on GitHub.
Free lessons
- SQL Injection Fix Basics
How it works · Source on GitHub · Create a free account to run it
Ubuntu VM lab
Linux privilege escalation lab: a setuid binary, a sudo rule and a cron job to break
A Linux privilege escalation lab: a setuid helper, a sudo rule and a writable cron job on a private Ubuntu VM, read by the teacher. Free sample; code on GitHub.
Free lessons
- Privilege Escalation Basics
How it works · Source on GitHub · Sign up free for the lesson
Ubuntu VM lab
Incident response and forensics lab: investigate a compromised server in your browser
A forensics lab: a hacked server’s SSH and web logs in one Ubuntu VM, find the attacker’s IP and what was left behind, and a script marks it. Free sample.
Free lessons
- Incident Response Basics
How it works · Source on GitHub · Sign up free for the lesson
Basic lessons are given to every free account, on Home, and to every college. Curriculum lessons, such as T Level, are for colleges. Labs marked as an Ubuntu VM lab are set by a teacher in a module, and their lessons start the VM for you.
Run these yourself
A free personal account runs every lab here and its lesson. Teaching a class? Start a college and set them for your students.
Make a free accountStart a college
Already have an account? Sign in