What are Vulnerable Websites? Top 12 Sites for Legal Penetration Testing Training

The infamous cybersecurity skills gap is rising year by year. According to HelpnetSecurity, 71% of organizations report that the cybersecurity skills shortage has impacted them. And more than ever, companies are in need of security professionals to protect their networks and systems. So whether you're just starting out in cybersecurity or you're established as an expert, you constantly need to work on practicing and sharpening your cybersecurity skills.

Just as the gap grows, so does the number of vulnerabilities, attack vectors and attack techniques. Companies need to ensure their computer systems and networks are secured, and devoid of any holes for attackers to leverage for access to, and possession of, sensitive data.

Ethical hackers (or “white hats”) and bug bounty hunters play a tremendously valuable role in safeguarding systems and networks from vulnerability to malicious actors.

They represent some of the most attractive professions in the modern landscape. And because [cybercriminals](/content/threat-intelligence-101/threat-actors/cybercriminals "cybercriminals"/index.html) are constantly finding new ways to break into systems and networks and developing new tools and techniques, ethical hackers—whether merely starting out in cybersecurity or established as experts—are in constant need of practicing and sharpening their skills.

Remember that in order to [investigate cyber crime](/content/threat-intelligence-101/incident-response-management/cyber-crime-investigation "investigate cyber crime"/index.html), you must learn how they operate. Understanding the mindset and methodologies of cybercriminals allows you to anticipate their moves, strengthen system defenses, and effectively neutralize potential threats.

There are many ways to learn ethical hacking and penetration testing, whether it's through online tutorials, YouTube videos, courses, books, podcasts, etc., but we all know that nothing beats a practical approach. Truth is, it can be hard to test their skills legally so having websites that are designed to be vulnerable and provide a safe environment to test cybersecurity skills is a great way to continue challenging yourself.

What are vulnerable websites?

Vulnerable websites are intentionally designed with security flaws to provide a safe and legal environment for cybersecurity training and practice. Websites and web applications that are vulnerable by design and offer a safe hacking space are fertile ground for learning.

By using them, people can get comfortable with finding vulnerabilities, security researchers and bug bounty hunters can expand their knowledge and find new vulnerabilities, and seasoned professionals, developers and pen testers can keep their own skills sharp and current.

List of Top Vulnerable Websites for Legally Testing Your Skills

Today we're exploring a list of the top 12 deliberately vulnerable websites for penetration testing and ethical hacking training. There are fun, game-oriented platforms here, with both web and mobile applications and more, so you can find the one to suit your skills:

1. Hack The Box

Hack The Box has taken the community by storm. It counts more than 500,000 new hackers, students, security professionals and gamers from all over the world. An online pentesting platform, Hack The Box (HTB) allows you to test your cybersecurity (and pentesting) skills as well as exchange ideas and experiences with this amazing community.

HTB contains vulnerable machines that you are invited to hack—it even goes so far as to require you to hack your way to the invitation code that allows you to begin practicing on it. Several of its challenges are constantly being updated, with some that simulate real-world scenarios and some that lean more towards CTFs.

2. CTFlearn

CTFlearn is another highly popular ethical hacking platform. Offered as “The most beginner-friendly way to get into hacking”, CTFlearn boasts a worldwide following of over 70,000 individuals who are there to learn, practice and compete.

The platform’s name derives from Capture The Flag (CTF), which is popular in the hacking community for its contents and reputation as a favorite cybersecurity challenge for beginners as well as professional hackers. CTFlearn also features challenges and competitions that give the users the ability to act as both attacker and defender.

Different labs involve numerous cybersecurity topics that users can create themselves. Challenges are grouped into categories and organized by level of difficulty. These include:

  1. Web
  2. Reverse engineering
  3. Forensics
  4. Programming
  5. Binary
  6. Crypto
  7. Miscellaneous

3. bWAPP

Created by Malik Messelem, bWAPP (short for "buggy web application") is a free and open source application that is, just as the name implies, deliberately vulnerable. It's one of the best—if not the best—buggy websites available for practicing and sharpening your hacking skills.

What makes bWAPP unique is that it offers more than 100 web application vulnerabilities and bugs derived from OWASP's Top 10 Project. Some of the vulnerabilities are:

  • Cross-site scripting (XSS), cross-site tracing (XST) and cross-site request forgery (CSRF)
  • Man-in-the-middle attacks
  • Server-side request forgery (SSRF)
  • DoS attacks
  • SQL, HTML, iFrame, SSI, OS Command, PHP, XML, XPath, LDAP, Host Header and SMTP injections

But it doesn't end there. Beside the 100 bugs, you can use a so-called "bee-box," a custom pre-installed Linux VM.

bWAPP is built on PHP and uses a MySQL database. It can be hosted on both Windows and Linux OS: on Windows you can host it on xampp and wamp server; on Linux, Apache, and it's also great to use on Kali Linux.

You can easily download bWAPP here.

4. HackThisSite

One of our favorites, HackThisSite, or HTS, is a great hacking website that was founded by Jeremy Hammond but has been maintained by the community. It offers numerous different challenges that contain beginner as well as advanced hacking skills.

The challenges are fun and engaging, with real-life scenarios and different characters. Each challenge has a thread on a forum where you can discuss it with other members of the community and offer resources to solve the puzzle more quickly. You even get a chance to hack a voting system!

Some other challenges on HackThisSite are:

  • Realistic missions
  • Application missions
  • Phone phreaking missions
  • Forensic missions
  • Programming missions

5. Google Gruyere

It's not often we see the pairing of cheese and hacking, but this website is a lot like good cheese—full of holes. It also uses "cheesy" code and the entire design is cheese-based. Gruyere is a great option for beginners who want to dive into finding and exploiting vulnerabilities, but also learn how to play on the other side and defend against exploits.

Gruyere is written in Python, with bugs that aren't specific to Python, and offers a substantial number of security vulnerabilities chosen to suit beginners. Some of the vulnerabilities are:

  • Cross-site scripting (XSS)
  • Cross-site request forgery (XSRF)
  • Remote code execution
  • DoS attacks
  • Information disclosure

6. Damn Vulnerable iOS App - DVIA

DVIA is an iOS mobile application meant to help mobile security hobbyists, professionals and mobile developers practice penetration testing. It was recently re-released and is available for free on GitHub.

DVIA contains common iOS app vulnerabilities following the OWASP Top 10 mobile risks. It's written in Swift, with all vulnerabilities tested up to iOS 11, and you do need to have Xcode installed (the best way to install it is by using Cydia Impactor).

Some of the vulnerabilities you can play with are:

  • Phishing
  • Jailbreak detection
  • Debugging
  • Touch/Face ID bypass
  • Side channel data leakage
  • Broken cryptography
  • Network layer security
  • Application patching

7. Hellbound Hackers

Hellbound Hackers is an all-around computer security platform, as it not only offers hands-on challenges, articles, forums and a wide array of hacking tutorials, but also has one of the biggest hacking communities around, with over 100,000 registered members.

On Hellbound Hackers, you'll have the chance to participate in timed challenges requiring you to find a vulnerability and a way to patch it.

8. OWASP Mutillidae II

Another OWASP project to consider here is the OWASP Mutillidae II, better known simply as Mutillidae.

Written in PHP, this is an open source vulnerable web application that can be used on Linux and Windows using lamp, wamp and xampp servers. It also comes pre-installed on Rapid7 Metasploitable 2, Samurai WTF and OWASP BWA. For easier installation, they offer tutorials for each step.

9. Defend the Web

Defend the Web, originally known as HackThis!!, is an interactive cybersecurity platform designed to offer challenges for all skill levels. It features over 60 hacking levels and articles that cover all areas of security including those specifically contained on the level.

10. WebGoat

Yet another OWASP entry on this list, and one of the more beloved. WebGoat is a highly insecure app that provides a learning environment for common server-side application flaws. It's designed to help people learn about application security and practice pen testing skills.

11. Root Me

A multilanguage security training platform, Root Me is a great place for testing and advancing your hacking skills. It features over 300 challenges which are updated regularly and more than 50 virtual environments, all to provide a realistic environment.

12. OverTheWire

Another terrific place for fun and learning, OverTheWire offers wargames and warzones for different skill levels, although it does lean toward more advanced hacking concepts. Each level features specific scenarios; you start as a Bandit and work your way up to the more complex exploits.

Expand your cybersecurity skills with Recorded Future University

Diving into penetration testing and ethical hacking is a thrilling part of learning cybersecurity, but there’s so much more to the story. It’s important to remember that truly comprehensive cybersecurity expertise goes beyond just understanding web applications. Central to the success of both [blue and red teams](/content/threat-intelligence-101/threat-analysis/red-team-vs-blue-team "blue and red teams"/index.html) is a deep knowledge of threat intelligence.

Conclusion

Whether you're a developer, security professional, student, or enthusiast, websites designed to be vulnerable for ethical hacking purposes offer a fantastic way to learn while putting your skills to the test. With a plethora of options available—most of them free—we're confident you'll find something that will provide, at the very least, a fun and engaging experience.