Lab Environments

DVWA

Damn Vulnerable Web Application for learning OWASP bugs.

beginner

Docker

LAMP

Lab

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Practicing SQLi, XSS, CSRF, file inclusion at adjustable difficulty.

Docker run; login; set security level; exploit each module.

Structured web vuln curriculum in one app.

Commands & usage

docker run --rm -it -p 80:80 vulnerables/web-dvwa

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

Metasploitable 2/3

Intentionally vulnerable Linux/Windows VMs for exploit practice.

OWASP Juice Shop

Modern insecure web app with gamified challenges.

OWASP WebGoat

Deliberately insecure app teaching common web flaws lesson-by-lesson.

VulnHub

Free downloadable vulnerable machines for offline practice.

Hack The Box

Online pentest labs with machines, challenges, and careers path.

TryHackMe

Guided cybersecurity learning rooms and hands-on labs.