CybersLion

 Best Vulnerable Websites to Practice Security — Hands‑On Guide & How to Use Them


Description: Best Vulnerable Websites to Practice Security — Hands‑On Guide & How to Use Them

Introduction

If you’re learning web application security or penetration testing, practicing on intentionally vulnerable websites is the safest and fastest way to build skills. This blog lists the best vulnerable websites and lab targets, explains how to set up a safe environment, and gives step‑by‑step practice exercises (SQL Injection, XSS, authentication flaws, RCE) with common tools. Always practice only on sanctioned targets—never on production or third‑party sites without explicit permission.

Why use vulnerable websites?

  • Legal & safe — intentionally vulnerable apps exist for learning.

  • Realistic — they model common real‑world bugs (SQLi, XSS, CSRF, insecure deserialization).

  • Repeatable — reset state & try different approaches.

  • Structured learning — many sites include challenges, hints, and difficulty levels.

Top Vulnerable Websites and Labs (with short descriptions)

  1. OWASP Juice Shop

    • Modern JavaScript web app with huge range of vulnerabilities and a ranking system. Great for beginners→advanced.

  2. Damn Vulnerable Web Application (DVWA)

    • PHP/MySQL app with configurable security levels. Perfect for SQLi, XSS, CSRF, and file upload practice.

  3. WebGoat (OWASP)

    • Lesson‑based learning platform maintained by OWASP; each lesson teaches attack and defense.

  4. Mutillidae

    • Beginner friendly with an obvious UI for vulnerabilities and hints.

  5. Metasploitable (VM)

    • A vulnerable Linux VM loaded with services — ideal for network‑to‑web attack chains.

  6. bWAPP

    • Buggy Web Application with 100+ vulnerabilities to practice.

  7. TryHackMe & Hack The Box (walled/gated labs)

    • Hands‑on rooms/boxes for web and network challenges; good for guided learning and certification prep.

  8. PortSwigger Web Security Academy

    • Free labs and interactive lessons for XSS, SQLi, SSRF, deserialization, etc.

  9. Vulnerable by Design repos & Seeded CTF apps (GitHub)

    • Deploy small CTF-style web apps locally or in a private lab.

Setting up a Safe Practice Lab (step‑by‑step)

  1. Isolate the environment

    • Use VirtualBox/VMware and run vulnerable apps on an isolated NAT network (192.168.x.x). No external exposure.

  2. Download & install targets

    • Juice Shop: Docker docker run --rm -p 3000:3000 bkimminich/juice-shop

    • DVWA: net‑install on LAMP VM or Docker image.

    • Metasploitable: import VM image and run on same virtual network.

  3. Install tools on attacker VM

    • Kali Linux or Parrot Recommended. Install: Burp Suite (Community), OWASP ZAP, sqlmap, Nmap, Nikto, ffuf, browser plugins (Wappalyzer).

  4. Snapshot VMs

    • Take snapshots before practicing so you can revert.

  5. Document scope & rules

    • Treat lab like a real engagement: define allowed targets, timeframe, and cleanup steps.

Practice Exercise 1 — SQL Injection on DVWA (step‑by‑step)

Goal: Exploit a simple SQLi to extract user data (lab only).

  1. Set DVWA security to low. Login to DVWA admin panel.

  2. Identify input: Go to the “SQL Injection” page, input 1' OR '1'='1 in user id field and submit.

  3. Observe behavior: If app returns many users, it’s vulnerable.

  4. Use sqlmap to automate data extraction:

    sqlmap -u "http://192.168.56.101/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit" --cookie="PHPSESSID=..." --dbs

    • --dbs lists databases. Then -D dvwa -T users --dump to extract table rows.

  5. Manual validation: Use UNION SELECT or time‑based techniques to confirm behavior:
    1' UNION SELECT null, user, password FROM users-- - (adjust columns).

  6. Cleanup: Reset DVWA database if needed.

Learning outcomes: SQLi fingerprinting, blind vs error‑based, automated vs manual exploitation, importance of parameterized queries.

Practice Exercise 2 — Stored XSS on Juice Shop

Goal: Find and exploit a stored XSS vector to execute JavaScript.

  1. Identify candidate fields: Product review, feedback, or user profile fields.

  2. Test payload: <script>alert('XSS')</script> in review.

  3. Trigger & observe: Navigate to the page where review is displayed — alert should pop up.

  4. Escalation: Try stealing CSRF tokens or cookies in lab (document ethical constraints).

  5. Mitigation check: Explore how input sanitization or Content Security Policy (CSP) can block your payload.

Learning outcomes: Differences between stored/reflected XSS, defense-in-depth, CSP, input sanitization.

Practice Exercise 3 — Remote Code Execution (Metasploitable)

Goal: Identify a vulnerable service and gain a shell (lab only).

  1. Scan target with Nmap:

    nmap -sV -p- 192.168.56.102 -oN metaspo_scan.txt

  2. Identify outdated service (e.g., vsftpd, Tomcat).

  3. Search exploit (local DB / Exploit-DB): searchsploit tomcat 7.0

  4. Exploit carefully: Use Metasploit or manual exploit (only in lab). Get reverse shell and practice post‑exploitation basics (enumeration, privilege escalation).

Learning outcomes: Service discovery, exploit research, safe exploitation workflows.

Tools & shortcuts (must‑have list)

  • Burp Suite — proxy, repeater, intruder.

  • OWASP ZAP — automated scanning & spidering.

  • sqlmap — SQLi automation.

  • Nmap — discovery & service info.

  • Nikto — basic web server vulnerabilities.

  • ffuf/gobuster — directory fuzzing.

  • SearchSploit / Exploit-DB — exploit research.

Reporting & Remediation (how to close the loop)

  • Document findings: affected URL, request/response, PoC payloads, screenshots, potential impact.

  • Risk rating: CVSS or a simple Low/Medium/High mapping.

  • Remediation advice: e.g., parameterized queries for SQLi, output encoding & CSP for XSS, patching/outdated services for RCE.

  • Proof‑of‑fix: re‑test after fixes applied.

Ethics & Legal Considerations

  • Only test on explicitly authorized systems.

  • Don’t reuse exploits on public networks or third‑party servers.

  • Use lab snapshots and wipe artifacts after tests.

  • Share findings responsibly with stakeholders; avoid publishing PoCs that enable mass exploitation without a fix.

Conclusion & Next Steps

Vulnerable websites and labs are essential for skill growth. Start with guided platforms like OWASP Juice Shop, PortSwigger Academy, and DVWA, progress to CTFs (TryHackMe, HTB), and always document, learn both attack and defense, and practice ethically.