https://github.com/joe-shenouda/awesome-cyber-skills
A curated list of hacking environments where you can train your cyber skills legally and safely
https://github.com/joe-shenouda/awesome-cyber-skills
List: awesome-cyber-skills
Last synced: 3 days ago
JSON representation
A curated list of hacking environments where you can train your cyber skills legally and safely
- Host: GitHub
- URL: https://github.com/joe-shenouda/awesome-cyber-skills
- Owner: joe-shenouda
- License: mit
- Created: 2017-01-04T10:44:10.000Z (almost 10 years ago)
- Default Branch: master
- Last Pushed: 2026-09-17T07:49:09.000Z (about 1 month ago)
- Last Synced: 2026-10-04T04:51:01.681Z (17 days ago)
- Homepage: https://www.cyber-consult.org
- Size: 185 KB
- Stars: 4,706
- Watchers: 195
- Forks: 541
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING
- Funding: .github/FUNDING.yml
- License: LICENSE
Awesome Lists containing this project
- awesome-cyber-security - awesome-cyber-skills - A curated list of hacking environments where you can train your cyber skills. (Misc / More Awesome Repos (actively maintained))
- awesome-security - Awesome Cyber Skills - A curated list of hacking environments where you can train your cyber skills legally and safely. (Other Awesome Lists / Other Security Awesome Lists)
- awesome-security - Awesome Cyber Skills - A curated list of hacking environments where you can train your cyber skills legally and safely. (Other Awesome Lists / Other Security Awesome Lists)
- All-In-One-CyberSecurity-Resources - Awesome-Cyber-Skills
- awesome-security-collection - **1207**ๆ
- -awesome-hacking - Cyber Skills
- ultimate-awesome - awesome-cyber-skills - A curated list of hacking environments where you can train your cyber skills legally and safely. (Other Lists / TeX Lists)
- non-typical-OSINT-guide - Awesome Cyber Skills
- cyberelite - Cyber Skills
- awesome-security-hardening - Awesome Cyber Skills - A curated list of hacking environments where you can train your cyber skills legally and safely. (Other Awesome Security Lists / Cloud)
- venom - `Awesome Cyber Skills` - A curated list of hacking environments where you can train your cyber skills legally and safely. (CTF Tools / Resources / Courses)
- Awesome-Hacking - Cyber Skills
- awesome-hacking - Cyber Skills
- awesome-starz - joe-shenouda/awesome-cyber-skills - A curated list of hacking environments where you can train your cyber skills legally and safely (Others)
- awesome-csirt - awesome-cyber-skills
- awesome-hacking - Cyber Skills
- stargazer - joe-shenouda/awesome-cyber-skills - A curated list of hacking environments where you can train your cyber skills legally and safely \[*MIT License*\] (โญ๏ธ4705) (Unknown)
- awesome-hacking - Cyber Skills
- awesome_hacking - Cyber Skills
- fucking-Awesome-Hacking - Cyber Skills
- Hacking-Awesome - - Curated list of hacking environments where you can train your cyber skills legally and safely (Uncategorized / Uncategorized)
- awesomehacking - Cyber Skills
- awesome-index - joe-shenouda/awesome-cyber-skills
README
# ๐ก๏ธ awesome-cyber-skills
**A curated list of hacking environments where you can train your cyber skills free, legally and safely.**
[](https://github.com/joe-shenouda/awesome-cyber-skills/stargazers)
[](https://github.com/joe-shenouda/awesome-cyber-skills/network/members)
[](https://github.com/joe-shenouda/awesome-cyber-skills/commits/master)
[](https://github.com/joe-shenouda/awesome-cyber-skills/commits/master)
[](https://github.com/joe-shenouda/awesome-cyber-skills/graphs/contributors)
[](https://github.com/joe-shenouda/awesome-cyber-skills/issues)
[](https://github.com/joe-shenouda/awesome-cyber-skills/pulls)
## ๐ Welcome
Welcome to **awesome-cyber-skills** โ your one-stop library for free, legal, and safe places to train your cybersecurity skills.
## ๐ Table of Contents
- [๐ About the List](#-about-the-list)
- [๐๏ธ Categories](#-categories)
- [โ๏ธ Difficulty Levels](#-difficulty-levels)
- [๐ The Sites](#-the-sites)
- [๐ธ All Sites Are Free](#-all-sites-are-free)
- [๐ค Contributing](#-contributing)
- [๐บ๏ธ Roadmap](#-roadmap)
- [โจ Show Some โค๏ธ](#-show-some-๏ธ)
- [๐ค About the Author](#-about-the-author)
- [โ Support](#-support)
## ๐ About the List
> [!NOTE]
> In the field of Information Security, understanding the enemy, the hacker, is crucial. By knowing your enemy, you can effectively defend and secure the digital world.
> [!TIP]
> "Know the enemy, and you can defeat the enemy."
In the USA, even high-ranking retired police officers continue to advise residents on how to better secure their homes. They visit houses and identify weak points, sharing their knowledge of the criminals' techniques to help prevent break-ins.
To hone your cybersecurity skills, you need to keep your hacking skills up-to-date. To achieve this, **a safe, legal, and free environment is necessary for practice**.
This list compiles websites that offer various opportunities to practice your cyber skills. Each site has a unique approach, and a brief description is provided to highlight its focus.
- ๐ Some sites offer **tutorials** to guide you
- ๐งญ Others encourage **self-directed exploration**
- ๐ The list is **regularly updated** โ bookmark it or watch for new sites
If you are missing a site not mentioned in the list, feel free to [contribute](https://github.com/joe-shenouda/awesome-cyber-skills/blob/master/CONTRIBUTING).
## ๐๏ธ Categories
| Emoji | Category | Sites |
|:-:|:--|-:|
| ๐ | Web Application Security | 41 |
| ๐ | Cryptography | 2 |
| ๐ | Reverse Engineering | 16 |
| ๐ฏ | CTF / Wargame | 31 |
| ๐ก๏ธ | Blue Team / DFIR / SOC | 3 |
| โ๏ธ | Cloud Security | 1 |
| ๐ฑ | Mobile Security | 4 |
| ๐ฅ๏ธ | System / Network / Exploitation | 8 |
| ๐งฐ | Tutorial / Course / Knowledge | 11 |
| ๐ฎ | Misc / Game | 2 |
## โ๏ธ Difficulty Levels
| Badge | Level | Best for |
|:-:|:--|:--|
| ๐ข | **Beginner** | Just starting in security โ guided tutorials, friendly walkthroughs, low-stakes CTFs |
| ๐ก | **Intermediate** | Have basics down โ real CTFs, full vulnerable apps, blue-team investigations |
| ๐ด | **Advanced** | Significant expertise โ kernel exploitation, custom reversing, deep system internals |
## ๐ The Sites
> [!IMPORTANT]
**Every site in this list is 100% free, legal, and safe to practice on.** Each entry is tagged with a **category emoji** and a **difficulty badge** (`๐ข Beginner` / `๐ก Intermediate` / `๐ด Advanced`).
Use the categories legend below or `Ctrl+F` to jump to what you need.
| # | Site name | Category | Difficulty | Description |
|:-:|:--|:-:|:-:|:--|
| 1 | [Bug Bounty Hunter](https://www.bugbountyhunter.com/) | ๐ | ๐ก | ๐ NEW โ Free training platform created by bug bounty hunter zseano, teaching how to find and report web application vulnerabilities in real bug-bounty programs. |
| 2 | [bWAPP](http://www.itsecgames.com/) | ๐ | ๐ก | buggy web application, is a free and open source deliberately insecure web application. It helps security enthusiasts, developers and students to discover and to prevent web vulnerabilities. bWAPP prepares one to conduct successful penetration testing and ethical hacking projects. |
| 3 | [Commix testbed](https://github.com/commixproject/commix-testbed) | ๐ | ๐ก | A collection of web pages, vulnerable to command injection flaws. |
| 4 | [Damn Small Vulnerable Web](https://github.com/stamparm/DSVW) | ๐ | ๐ก | Damn Small Vulnerable Web (DSVW) is a deliberately vulnerable web application written in under 100 lines of code, created for educational purposes. It supports the majority of (most popular) web application vulnerabilities together with appropriate attacks. |
| 5 | [Damn Vulnerable Android App](https://code.google.com/archive/p/dvaa/) | ๐ | ๐ข | Damn Vulnerable Android App (DVAA) is an Android application which contains intentional vulnerabilities. |
| 6 | [Damn Vulnerable Hybrid Mobile App](https://github.com/logicalhacking/DVHMA) | ๐ | ๐ข | Damn Vulnerable Hybrid Mobile App (DVHMA) is a hybrid mobile app (for Android) that intentionally contains vulnerabilities. |
| 7 | [Damn Vulnerable iOS App](http://damnvulnerableiosapp.com/) | ๐ | ๐ข | Damn Vulnerable iOS App (DVIA) is an iOS application that is damn vulnerable. |
| 8 | [Damn Vulnerable Linux](http://www.computersecuritystudent.com/SECURITY_TOOLS/DVL/lesson1/) | ๐ | ๐ก | Damn Vulnerable Linux (DVL) is everything a good Linux distribution isn't. Its developers have spent hours stuffing it with broken, ill-configured, outdated, and exploitable software that makes it vulnerable to attacks. |
| 9 | [Damn Vulnerable Stateful Web App](https://github.com/silentsignal/damn-vulnerable-stateful-web-app) | ๐ | ๐ก | Short and simple vulnerable PHP web application that naรฏve scanners found to be perfectly safe. |
| 10 | [Damn Vulnerable Thick Client App](https://github.com/secvulture/dvta) | ๐ | ๐ก | DVTA is a Vulnerable Thick Client Application developed in C# .NET with many vulnerabilities. |
| 11 | [Damn Vulnerable Web App](https://github.com/digininja/DVWA/) | ๐ | ๐ข | Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and to aid both students & teachers to learn about web application security in a controlled class room environment. |
| 12 | [Damn Vulnerable Web Services](https://github.com/snoopysecurity/dvws) | ๐ | ๐ก | Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real-world web service vulnerabilities. |
| 13 | [Damn Vulnerable Web Sockets](https://github.com/interference-security/DVWS) | ๐ | ๐ก | Damn Vulnerable Web Sockets (DVWS) is a vulnerable web application which works on web sockets for client-server communication. |
| 14 | [Damnvulnerable.me](https://github.com/skepticfx/damnvulnerable.me) | ๐ | ๐ก | A deliberately vulnerable modern-day app with lots of DOM-related bugs. |
| 15 | [exploit.co.il Vulnerable Web App](https://sourceforge.net/projects/exploitcoilvuln/?source=recommended) | ๐ | ๐ก | exploit.co.il Vulnerable Web app designed as a learning platform to test various SQL injection Techniques. |
| 16 | [Hackademic](https://github.com/Hackademic/hackademic) | ๐ | ๐ก | Offers realistic scenarios full of known vulnerabilities (especially, of course, the OWASP Top Ten) for those trying to practice their attack skills. |
| 17 | [Hackazon](https://github.com/rapid7/hackazon) | ๐ | ๐ก | A modern vulnerable web app. |
| 18 | [Hacker101](https://www.hacker101.com/) | ๐ | ๐ข | ๐ NEW โ Free web-security class from HackerOne with videos, write-ups, and an always-on Capture the Flag to practice your bug-bounty skills. |
| 19 | [Hacksplaining](https://www.hacksplaining.com/) | ๐ | ๐ข | Security Training for Developers. |
| 20 | [HackTricks](https://book.hacktricks.xyz/) | ๐ | ๐ก | ๐ NEW โ A free cybersecurity knowledge base with practical pentesting, red-team, web, cloud, binary exploitation, and privilege-escalation techniques, contributed by the community. |
| 21 | [Hackxor](https://hackxor.net/) | ๐ | ๐ด | Hackxor is a web app hacking game where players must locate and exploit vulnerabilities to progress through the story. Think WebGoat but with a plot and a focus on realism&difficulty. Contains XSS, CSRF, SQLi, ReDoS, DOR, command injection, etc. |
| 22 | [Java Vulnerable Lab](https://github.com/CSPF-Founder/JavaVulnerableLab) | ๐ | ๐ก | Vulnerable Java based Web Application. |
| 23 | [Mutillidae](https://sourceforge.net/projects/mutillidae/) | ๐ | ๐ข | OWASP Mutillidae II is a free, open source, deliberately vulnerable web application providing a target for web-security enthusiast. |
| 24 | [OWASP Mutillidae II](https://owasp.org/www-project-mutillidae-ii/) | ๐ | ๐ข | OWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiast. |
| 25 | [OWASP SiteGenerator](https://en.freedownloadmanager.org/Windows-PC/OWASP-Site-Generator-FREE.html) | ๐ | ๐ก | OWASP SiteGenerator allows the creating of dynamic websites based on XML files and predefined vulnerabilities (some simple, some complex) covering .Net languages and web development architectures (for example, navigation: Html, Javascript, Flash, Java, etc...). |
| 26 | [Pentesterlab](https://pentesterlab.com/exercises/from_sqli_to_shell) | ๐ | ๐ก | This exercise explains how you can, from a SQL injection, gain access to the administration console, then in the administration console, how you can run commands on the system. |
| 27 | [Pentest-Ground](https://pentest-ground.com) | ๐ | ๐ก | Pentest-Ground is a free playground with deliberately vulnerable web applications and network services. |
| 28 | [Peruggia](https://sourceforge.net/projects/peruggia/) | ๐ | ๐ก | Peruggia is designed as a safe, legal environment to learn about and try common attacks on web applications. Peruggia looks similar to an image gallery but contains several controlled vulnerabilities to practice on. |
| 29 | [PortSwigger Web Security Academy](https://portswigger.net/web-security) | ๐ | ๐ก | ๐ NEW โ Free online training center for web application security from PortSwigger, with hands-on labs covering topics like XSS, SQL injection, SSRF, authentication, and deserialization. |
| 30 | [Puzzlemall](https://code.google.com/archive/p/puzzlemall/) | ๐ | ๐ก | PuzzleMall - A vulnerable web application for practicing session puzzling. |
| 31 | [SentinelTestbed](https://github.com/dobin/SentinelTestbed) | ๐ | ๐ก | Vulnerable website. Used to test sentinel features. |
| 32 | [SocketToMe](https://digi.ninja/projects/sockettome.php) | ๐ | ๐ข | SocketToMe SocketToMe is little application for testing web sockets. |
| 33 | [SQLI labs](https://github.com/Audi-1/sqli-labs) | ๐ | ๐ข | SQLI labs to test error based, Blind boolean based, Time based. |
| 34 | [Sqlilabs](https://github.com/himadriganguly/sqlilabs) | ๐ | ๐ข | Lab set-up for learning SQL Injection Techniques. |
| 35 | [Stanford SecuriBench / Securibench Micro](https://github.com/too4words/securibench-micro/) | ๐ | ๐ก | Stanford SecuriBench / Securibench Micro is a series of small test cases designed to excercise different parts of a static security analyzer. Each test case in Securibench Micro comes with an answer, which simplifies the comparison process. |
| 36 | [techlogia Lab](https://techlogia.de/en/lab) | ๐ | ๐ข | ๐ NEW โ techlogia Lab is a free, browser-based hacking lab teaching Linux server hardening, OWASP Top 10 web security, and GDPR-aware operations. Built for vocational schools and self-learners in the EU. Fully isolated VMs hosted in Germany, no install required, no tracking. Content licensed under CC-BY 4.0. |
| 37 | [The ButterFly - Security Project](https://sourceforge.net/projects/thebutterflytmp/?source=navbar) | ๐ | ๐ก | The ButterFly project is an educational environment intended to give an insight into common web application and PHP vulnerabilities. The environment also includes examples demonstrating how such vulnerabilities are mitigated. |
| 38 | [Vulnerable Node](https://github.com/cr0hn/vulnerable-node) | ๐ | ๐ก | A very vulnerable web site written in NodeJS to explore various vulnerabilities. |
| 39 | [WackoPicko](https://github.com/adamdoupe/WackoPicko) | ๐ | ๐ก | WackoPicko is a vulnerable web application used to test web application vulnerability scanners. |
| 40 | [Web Security Dojo](https://sourceforge.net/projects/websecuritydojo/) | ๐ | ๐ก | Web Security Dojo is a preconfigured, stand-alone training environment for Web Application Security. |
| 41 | [XSS-game](https://xss-game.appspot.com/) | ๐ | ๐ข | In this training program, you will learn to find and exploit XSS bugs. You'll use this knowledge to confuse and infuriate your adversaries by preventing such bugs from happening in your applications. |
| 42 | [XVWA](https://github.com/s4n7h0/xvwa) | ๐ | ๐ก | XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security. |
| 43 | [CryptoHack](https://cryptohack.org/) | ๐ | ๐ข | ๐ NEW โ A free, fun platform for learning modern cryptography by solving challenges and cracking insecure code, from classic ciphers to RSA, AES, and post-quantum crypto. |
| 44 | [CryptOMG](https://github.com/SpiderLabs/CryptOMG) | ๐ | ๐ก | CryptOMG is a configurable CTF style test bed that highlights common flaws in cryptographic implementations. |
| 45 | [Arizona Cyber Warfare Range](http://azcwr.org/) | ๐ | ๐ก | The ranges offer an excellent platform for you to learn computer network attack (CNA), computer network defense (CND), and digital forensics (DF). You can play any of these roles. |
| 46 | [AzureGoat](https://github.com/ine-labs/AzureGoat) | ๐ | ๐ก | AzureGoat : A Damn Vulnerable Azure Infrastructure. |
| 47 | [BodgeIt Store](https://github.com/psiinon/bodgeit) | ๐ | ๐ข | The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing. |
| 48 | [Crackmes.one](https://crackmes.one/) | ๐ | ๐ก | ๐ NEW โ A free, community-driven place to download crackmes to practice and improve your reverse-engineering skills, with submissions and a leaderboard. |
| 49 | [Cyber Degrees](http://www.cyberdegrees.org/resources/free-online-courses/) | ๐ | ๐ก | Free online cyber security Massive Open Online Courses (MOOCS). |
| 50 | [Damn Vulnerable Router Firmware](https://github.com/praetorian-inc/DVRF) | ๐ | ๐ด | The goal of this project is to simulate a real-world environment to help people learn about other CPU architectures outside of the x86_64 space. This project will also help people get into discovering new things about hardware. |
| 51 | [Dareyourmind](https://web.archive.org/web/20170618221231/http://www.dareyourmind.net/) | ๐ | ๐ก | Online game, hacker challenge (mirror archive). |
| 52 | [GOAD (Game Of Active Directory)](https://github.com/Orange-Cyberdefense/GOAD) | ๐ | ๐ก | GOAD is a pentest active directory LAB project. The purpose of this lab is to give pentesters a vulnerable Active directory environment ready to use to practice usual attack techniques. |
| 53 | [Google Gruyere](http://google-gruyere.appspot.com/) | ๐ | ๐ข | Labs that cover how an application can be attacked using common web security vulnerabilities, like cross-site scripting vulnerabilities (XSS) and cross-site request forgery (XSRF). Also, you can find labs how to find, fix, and avoid these common vulnerabilities and other bugs that have a security impact, such as denial-of-service, information disclosure, or remote code execution. |
| 54 | [HackSys Extreme Vulnerable Driver](https://github.com/hacksysteam/HackSysExtremeVulnerableDriver/) | ๐ | ๐ด | HackSys Extreme Vulnerable Driver is intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level. |
| 55 | [Microcorruption CTF](https://microcorruption.com/login) | ๐ | ๐ก | Challenge: given a debugger and a device, find an input that unlocks it. Solve the level with that input. |
| 56 | [Overthewire](http://overthewire.org/wargames/) | ๐ | ๐ข | The wargames offered by the OverTheWire community can help you to learn and practice security concepts in the form of fun-filled games. |
| 57 | [OWASP MASTG Crackmes](https://github.com/OWASP/mastg/tree/master/Crackmes) | ๐ | ๐ก | ๐ NEW โ A set of reverse-engineering and cracking challenges for Android and iOS apps, maintained by the OWASP Mobile Application Security (MAS) project to accompany the MASTG. |
| 58 | [Reversing.kr](http://reversing.kr) | ๐ | ๐ก | This site tests your ability to Cracking & Reverse Code Engineering. |
| 59 | [RPISEC/Malware](https://github.com/RPISEC/Malware) | ๐ | ๐ด | Malware Analysis Course materials. |
| 60 | [Vulnserver](http://www.thegreycorner.com/2010/12/introducing-vulnserver.html) | ๐ | ๐ก | Windows-based threaded TCP server application that is designed to be exploited. |
| 61 | [CTFlearn](https://ctflearn.com/) | ๐ฏ | ๐ข | ๐ NEW โ Beginner-friendly CTF platform with hundreds of free challenges across crypto, forensics, web, reversing, and stego, plus an active learning community. |
| 62 | [CyberTalents](https://cybertalents.com/) | ๐ฏ | ๐ก | ๐ NEW โ Global platform where cybersecurity talents can learn, practice, compete, and get ranked through free CTFs, courses, and competitions. |
| 63 | [Defbox](https://defbox.io/) | ๐ฏ | ๐ก | Experience real-Life Cyber Threats in a safe Environment. |
| 64 | [EchoCTF](https://echoctf.com/) | ๐ฏ | ๐ก | ๐ NEW โ Cyber range built by Echothrust Solutions for running CTFs and trainings on real IT infrastructure, including fully functional smart-city dioramas with 200+ hackable elements. |
| 65 | [Exploit-exercises.com](https://exploit-exercises.com/) | ๐ฏ | ๐ก | exploit-exercises.com provides a variety of virtual machines, documentation and challenges that can be used to learn about a variety of computer security issues such as privilege escalation, vulnerability analysis, exploit development, debugging, reverse engineering, and general cyber security issues. |
| 66 | [GameOver](https://sourceforge.net/projects/null-gameover/) | ๐ฏ | ๐ก | Project GameOver was started with the objective of training and educating newbies about the basics of web security and educate them about the common web attacks and help them understand how they work. |
| 67 | [Gh0stlab](http://www.gh0st.net/?p=19) | ๐ฏ | ๐ก | A security research network where like-minded individuals could work together towards the common goal of knowledge. |
| 68 | [GoatseLinux](http://neutronstar.org/goatselinux.html) | ๐ฏ | ๐ก | GSL is a Vmware image you can run for penetration testing purposes. |
| 69 | [Gracefully Vulnerable Virtual Machine](https://www.vulnhub.com/entry/seattle-v03,145/) | ๐ฏ | ๐ก | Gracefulโs VulnVM is VM web app designed to simulate a simple eCommerce style website which is purposely vulnerable to a number of well know security issues commonly seen in web applications. |
| 70 | [Hack The Box](https://www.hackthebox.eu/) | ๐ฏ | ๐ก | Hack The Box is an online platform allowing you to test your penetration testing skills and exchange ideas and methodologies with other members of similar interests. In order to join you should solve an entry-level challenge. |
| 71 | [Hack The Box Academy](https://academy.hackthebox.com/) | ๐ฏ | ๐ก | ๐ NEW โ Free tier of Hack The Box Academy's structured cybersecurity learning paths and modules covering offensive, defensive, and general security skills. |
| 72 | [Hack This Site](https://www.hackthissite.org/) | ๐ฏ | ๐ข | More than just another hacker wargames site, Hack This Site is a living, breathing community with many active projects in development, with a vast selection of hacking articles and a huge forum where users can discuss hacking, network security, and just about everything. |
| 73 | [Hack Yourself First](https://hackyourselffirst.troyhunt.com/) | ๐ฏ | ๐ก | This course is designed to help web developers on all frameworks identify risks in their own websites before attackers do and it uses this site extensively to demonstrate risks. |
| 74 | [Hackertest.net](http://www.hackertest.net/) | ๐ฏ | ๐ข | HackerTest.net is your own online hacker simulation with 20 levels. |
| 75 | [Hacking-Lab](https://www.hacking-lab.com/Remote_Sec_Lab/) | ๐ฏ | ๐ก | Hacking-Lab is an online ethical hacking, computer network and security challenge platform, dedicated to finding and educating cyber security talents. Furthermore, Hacking-Lab is providing the CTF and mission style challenges for the European Cyber Security Challenge with Austria, Germany, Switzerland, UK, Spain, Romania and provides free OWASP TOP 10 online security labs. |
| 76 | [HackThis!!](https://www.hackthis.co.uk/) | ๐ฏ | ๐ข | Test your skills with 50+ hacking levels, covering all aspects of security. |
| 77 | [Magical Code Injection Rainbow](https://github.com/SpiderLabs/MCIR) | ๐ฏ | ๐ก | The Magical Code Injection Rainbow! MCIR is a framework for building configurable vulnerability testbeds. MCIR is also a collection of configurable vulnerability testbeds. |
| 78 | [MysteryTwister C3](https://www.mysterytwisterc3.org/en/) | ๐ฏ | ๐ก | MysteryTwister C3 lets you solve crypto challenges, starting from the simple Caesar cipher all the way to modern AES, they have challenges for everyone. |
| 79 | [OWASP Broken Web Applications Project](https://sourceforge.net/projects/owaspbwa/) | ๐ฏ | ๐ก | OWASP Broken Web Applications Project is a collection of vulnerable web applications that is distributed on a Virtual Machine. |
| 80 | [PicoCTF](https://picoctf.com/) | ๐ฏ | ๐ข | picoCTF is a computer security game targeted at middle and high school students. The game consists of a series of challenges centered around a unique storyline where participants must reverse engineer, break, hack, decrypt, or do whatever it takes to solve the challenge. |
| 81 | [Professor Messer](http://www.professormesser.com/) | ๐ฏ | ๐ข | Good free training video's, not only on Security but on CompTIA A+, Network and Microsoft related as well. |
| 82 | [pwn.college](https://pwn.college/) | ๐ฏ | ๐ก | ๐ NEW โ Free hands-on cybersecurity education platform where learners develop and practice core cybersecurity skills, from Linux basics to memory corruption and exploitation. |
| 83 | [Pwnable.kr](http://pwnable.kr/) | ๐ฏ | ๐ด | 'pwnable.kr' is a non-commercial wargame site which provides various pwn challenges regarding system exploitation. while playing pwnable.kr, you could learn/improve system hacking skills but that shouldn't be your only purpose. |
| 84 | [RingZer0 CTF](https://ringzer0ctf.com/) | ๐ฏ | ๐ก | ๐ NEW โ Online CTF with tons of challenges across cryptography, forensics, web exploitation, reverse engineering, and steganography. |
| 85 | [Root Me](https://www.root-me.org/) | ๐ฏ | ๐ก | Hundreds of challenges and virtual environments. Each challenge can be associated with a multitude of solutions so you can learn. |
| 86 | [SG6 SecGame](http://sg6-labs.blogspot.nl/2007/12/secgame-1-sauron.html) | ๐ฏ | ๐ก | Spanish language, vulnerable GNU/Linux systems. |
| 87 | [Smashthestack](http://smashthestack.org/) | ๐ฏ | ๐ก | This network hosts several different wargames, ranging in difficulty. A wargame, in this context, is an environment that simulates software vulnerabilities and allows for the legal execution of exploitation techniques. |
| 88 | [TryHackMe](https://tryhackme.com) | ๐ฏ | ๐ข | TryHackMe is an online platform that teaches Cybersecurity through hands-on virtual labs. Whether you are an expert or beginner, learn through a virtual room structure to understand theoretical and practical security elements. |
| 89 | [W3Challs](https://w3challs.com) | ๐ฏ | ๐ก | W3Challs is a penetration testing training platform, which offers various computer challenges, in categories related to security |
| 90 | [Web Attack and Exploitation Distro](https://www.youtube.com/watch?v=EBaFeuFlqyw) | ๐ฏ | ๐ก | WAED is pre-configured with various real-world vulnerable web applications in a sandboxed environment. It includes pen testing tools as well. |
| 91 | [Wechall](http://www.wechall.net/) | ๐ฏ | ๐ก | Focussed on offering computer-related problems. You will find Cryptographic, Crackit, Steganography, Programming, Logic and Math/Science. The difficulty of these challenges varies as well. |
| 92 | [Blue Team Labs Online (BTLO)](https://blueteamlabs.online/) | ๐ก๏ธ | ๐ก | ๐ NEW โ A gamified platform for cyber defenders to practice security investigations and challenges covering Incident Response, Digital Forensics, Security Operations, and Reverse Engineering. |
| 93 | [CyberDefenders](https://cyberdefenders.org/) | ๐ก๏ธ | ๐ก | ๐ NEW โ Free platform to upskill and benchmark SOC analysts with real-world cyber-range investigations, blue-team challenges, and structured learning paths. |
| 94 | [LetsDefend](https://letsdefend.io/) | ๐ก๏ธ | ๐ข | ๐ NEW โ Hands-on blue-team training platform with learning paths, MITRE ATT&CK-mapped courses, and browser-based incident-response challenges for SOC analysts. |
| 95 | [CloudGoat (AWS)](https://github.com/RhinoSecurityLabs/cloudgoat) | โ๏ธ | ๐ก | ๐ NEW โ A deliberately vulnerable AWS infrastructure by Rhino Security Labs for learning cloud-pentesting techniques; spins up vulnerable scenarios you can attack and tear down. |
| 96 | [DIVA Android](https://github.com/payatu/diva-android) | ๐ฑ | ๐ข | Damn Insecure and vulnerable App for Android. |
| 97 | [ExploitMe Mobile](http://securitycompass.github.io/AndroidLabs/index.html) | ๐ฑ | ๐ก | Set of labs and an exploitable framework for you to hack mobile an application on Android. |
| 98 | [OWASP GoatDroid](https://github.com/jackMannino/OWASP-GoatDroid-Project) | ๐ฑ | ๐ข | OWASP GoatDroid is a fully functional and self-contained training environment for educating developers and testers on Android security. GoatDroid requires minimal dependencies and is ideal for both Android beginners as well as more advanced users. |
| 99 | [OWASP iGoat](https://wiki.owasp.org/index.php/OWASP_iGoat_Tool_Project) | ๐ฑ | ๐ข | iGoat is a learning tool for iOS developers (iPhone, iPad, etc.). |
| 100 | [Holynix](https://sourceforge.net/projects/holynix/files/) | ๐ฅ๏ธ | ๐ก | Holynix is a Linux VMware image that was deliberately built to have security holes for the purposes of penetration testing. |
| 101 | [LAMPSecurity Training](https://sourceforge.net/projects/lampsecurity/) | ๐ฅ๏ธ | ๐ก | LAMPSecurity training is designed to be a series of vulnerable virtual machine images along with complementary documentation designed to teach Linux,apache,PHP,MySQL security. |
| 102 | [Metasploit Unleashed](https://www.offensive-security.com/metasploit-unleashed/) | ๐ฅ๏ธ | ๐ก | Free Ethical Hacking Course. |
| 103 | [Metasploitable 3](https://github.com/rapid7/metasploitable3) | ๐ฅ๏ธ | ๐ก | Metasploitable3 is a VM that is built from the ground up with a large number of security vulnerabilities. |
| 104 | [Morning Catch](http://blog.cobaltstrike.com/2014/08/06/introducing-morning-catch-a-phishing-paradise/) | ๐ฅ๏ธ | ๐ก | Morning Catch is a VMware virtual machine, similar to Metasploitable, to demonstrate and teach about targeted client-side attacks and post-exploitation. |
| 105 | [Pwnos](https://www.vulnhub.com/entry/pwnos-20-pre-release,34/) | ๐ฅ๏ธ | ๐ก | PwnOS is a vulnerable by design OS .. and there are many ways you can hack it. |
| 106 | [Scene One](https://www.vulnhub.com/entry/21ltr-scene-1,3/) | ๐ฅ๏ธ | ๐ก | Scene One is a pen testing scenario liveCD made for a bit of fun and learning. |
| 107 | [Vulnhub](https://www.vulnhub.com/) | ๐ฅ๏ธ | ๐ก | An extensive collection of vulnerable VMs with user-created solutions. |
| 108 | [Cyber Security Base](https://cybersecuritybase.github.io/) | ๐งฐ | ๐ข | Cyber Security Base is a page with free courses by the University of Helsinki in collaboration with F-Secure. |
| 109 | [CyberTraining 365](https://www.cybertraining365.com/cybertraining/FreeClasses) | ๐งฐ | ๐ข | Cybertraining365 has paid material but also offers free classes. The link is directed at the free classes. |
| 110 | [Cybrary.it](https://www.cybrary.it/) | ๐งฐ | ๐ข | Free and Open Source Cyber Security Learning. |
| 111 | [Information Assurance Support Environment (IASE)](https://public.cyber.mil/cyber-training/training-catalog/?_training_types=3-training-student-self-paced) | ๐งฐ | ๐ข | Great site with Cybersecurity Awareness Training, Cybersecurity Training for IT Managers, Cybersecurity Training for Cybersecurity Professionals, Cybersecurity Technical Training, NetOps Training, Cyber Law Awareness, and FSO Tools Training available online. |
| 112 | [National Institutes of Health (NIH)](https://irtsectraining.nih.gov/publicUser.aspx) | ๐งฐ | ๐ข | Short courses on Information Security and Privacy Awareness. They have a section for executives, managers and IT Administrators as well. |
| 113 | [OpenSecurityTraining.info](http://opensecuritytraining.info/Training.html) | ๐งฐ | ๐ก | OpenSecurityTraining.info is dedicated to sharing training material for computer security classes, on any topic, that are at least one day long. |
| 114 | [Roppers Academy Training](https://www.hoppersroppers.org/training.html) | ๐งฐ | ๐ข | Free courses on computing and security fundamentals designed to train a beginner to crush their first CTF. |
| 115 | [RPISEC/MBE](https://github.com/RPISEC/MBE) | ๐งฐ | ๐ด | Modern Binary Exploitation Course materials. |
| 116 | [SANS Cyber Aces](http://www.cyberaces.org/courses/) | ๐งฐ | ๐ข | SANS Cyber Aces Online makes available, free and online, selected courses from the professional development curriculum offered by The SANS Institute, the global leader in cyber security training. |
| 117 | [SEED Labs](https://seedsecuritylabs.org/) | ๐งฐ | ๐ก | The SEED project has labs on Software, Network, Web, Mobile and System security and Cryptography labs. |
| 118 | [UltimateLAMP](http://www.amanhardikar.com/mindmaps/practice-links.html) | ๐งฐ | ๐ก | UltimateLAMP is a fully functional environment allowing you to easily try and evaluate a number of LAMP stack software products without requiring any specific setup or configuration of these products. |
| 119 | [SlaveHack](http://www.slavehack.com/) | ๐ฎ | ๐ข | My personal favorite: Slavehack is a virtual hack simulation game. Great for starters, I've seen kids in elementary school playing this! |
| 120 | [SlaveHack 2 *BETA*](https://www.slavehack2.com/) | ๐ฎ | ๐ข | Slavehack 2 is a sequel to the original Slavehack. It's also a virtual hack simulation game but you will find features much closer to today's Cyber reality. |
## ๐ธ All Sites Are Free
> [!TIP]
Every entry on this list is **completely free**. No trials, no freemium, no paywalls. If a site later becomes paid, it will be removed from the list.
## ๐ Contributors
]
Special thanks to all the people who have contributed to this list:
[foleranser](https://github.com/foleranser) โข [filinpavel](https://github.com/filinpavel) โข [BenDrysdale](https://github.com/BenDrysdale) โข [HrushikeshK](https://github.com/HrushikeshK) โข [deveyNull](https://github.com/deveyNull) โข [nirmalunagar](https://github.com/nirmalunagar) โข [roya0045](https://github.com/roya0045) โข [photoelf](https://github.com/photoelf) โข [AverageS](https://github.com/AverageS) โข [pentesttools-com](https://github.com/pentesttools-com) โข [Warxim](https://github.com/Warxim)
## ๐ค Contributing
> [!IMPORTANT]
Contributions are welcome! See [CONTRIBUTING.md](https://github.com/joe-shenouda/awesome-cyber-skills/blob/master/CONTRIBUTING) for guidelines.
[](https://github.com/joe-shenouda/awesome-cyber-skills/blob/master/CONTRIBUTING)
[](https://github.com/joe-shenouda/awesome-cyber-skills/pulls)
[](https://github.com/joe-shenouda/awesome-cyber-skills/issues)
## ๐บ๏ธ Roadmap
This list is actively maintained. Here is what is done and what is on the horizon:
- [x] ๐ Initial launch with curated sites
- [x] ๐ 100+ practice platforms listed
- [x] ๐ Dead-link cleanup (8 broken entries removed)
- [x] ๐ Added 17 vetted new entries with category & difficulty tags
- [x] ๐ท๏ธ Category & difficulty tags added to every entry
- [ ] ๐ธ Add screenshots / demo GIFs per platform
- [ ] ๐ค Set up GitHub Actions for automated weekly link checks
- [ ] ๐ Build a Mermaid diagram of platform relationships
- [ ] ๐ Add internationalization (translations)
- [ ] ๐ Split into per-category reference pages
## โจ Show Some โค๏ธ
If you found this list useful, please consider starring the repository and sharing it with others who might benefit. It helps the project grow and reach more people who want to learn security safely.
[](https://github.com/joe-shenouda/awesome-cyber-skills/stargazers)
[](https://twitter.com/JoeyShenouda)
## ๐ค About the Author
[LinkedIn](https://www.linkedin.com/in/josephshenouda/) ๐ [Twitter](https://twitter.com/JoeyShenouda) ๐ [Cybersecurity News](https://www.cyber-consult.org)
**[Joe Shenouda](https://nl.linkedin.com/in/josephshenouda)** โ _"Our work is no longer to secure computers alone, it's now about securing society."_
Joe Shenouda is a seasoned cybersecurity expert with experience in engineering, consulting, and research. He has worked with leading companies like Verizon and Accenture, specializing in operational cybersecurity. Joe is passionate about mentoring and training the next generation of cybersecurity specialists, using industry standards like **ISO**, **NIST**, and **CIS Controls** to guide organizations in adopting best practices.
**Accolades:**
- ๐ Named one of the **50 most talented young leaders** in the Netherlands by MT Magazine
- ๐ Received the **Goudhaantje Award** in 2019
**Geography:** Benelux, Middle-East & Nordics (Belgium, Netherlands, Luxembourg, Denmark, Norway, Sweden, Finland, Egypt, Monaco, Vatican City)
**GitHub Portfolio:** [https://github.com/joe-shenouda/](https://github.com/joe-shenouda/)
โจ **Active security clearance** โจ
Please share this list if you find it useful. Let me know if you like it!
## โ Support
If you would like to support this project, you can make a donation through PayPal:
[](https://www.paypal.com/donate/?business=P9L4Y9YQYEW3Y&no_recurring=0¤cy_code=EUR)
[](https://github.com/sponsors/joe-shenouda)
[](https://www.buymeacoffee.com/joeshenouda)
Don't forget to give this repo a โจ **STAR**!
[](https://awesome.re)
[](https://commonmark.org)
[](LICENSE)
แบ ฬธอฬฬฬwฬทฬออฬฬฬอฬฬฬแบปฬธฬฬฬอ sฬธฬฬฬฃอฬฬชฬฆออฬออoฬทอฬบอออฬmฬตอฬอฬฬฬอฬแบปฬดอฬฒฬณอ ฬธฬบฬฝฬฬฬฬฤฬทฬบฬฉฬญฬออแปณฬดฬจฬฑอฬbฬทฬฬฬฬฬอฬฬฬอ
แธฬธฬฒฬฬฬฬฬฬฬพอฬฬฬrฬดฬฐฬฌฬฬปอฬฬฬอฬ ฬดฬฐอSฬทฬซฬฬอฬอฬkฬธฬขฬฏออฬฬฬฝอออ รฏฬดฬฬออlฬดฬคฬฌอฬบฬฬฎฬฑออฬแธฝฬทฬฬฃฬชฬฬฬ
sฬทฬผฬฬฬอฬฬ