References & Further Practice

External Vulnerable Labs

Once you have mastered the local CTF challenges, continue your practice with these industry-standard vulnerable applications:

1. OWASP Juice Shop

   • The most modern and sophisticated vulnerable web application. Written in Node.js, Express, and Angular.
   • GitHub Repository
   • Run via Docker: docker run --rm -p 3000:3000 bkimminich/juice-shop

2. Damn Vulnerable Web App (DVWA)

   • A PHP/MySQL web application that is damn vulnerable. Excellent for understanding traditional vulnerabilities.
   • GitHub Repository

3. WebGoat

   • Maintained by OWASP, WebGoat is a deliberately insecure application that allows developers to test vulnerabilities commonly found in Java-based applications.
   • GitHub Repository

4. crAPI (Completely ridiculous API)

   • Excellent for practicing API-specific vulnerabilities (BOLA, Mass Assignment, etc.).
   • GitHub Repository

5. TerraGoat

   • A vulnerable Terraform environment by Bridgecrew for learning IaC security.
   • GitHub Repository

CTF Platforms

To practice against real-world scenarios in a competitive environment:

• CTFtime: The central hub for tracking global Capture The Flag competitions.
• Hack The Box: A massive platform for penetration testing labs and CTF challenges.
• TryHackMe: Excellent guided learning paths for beginners.
• PortSwigger Web Security Academy: Free, interactive labs focused on web vulnerabilities (creators of Burp Suite).