Learning
Cybersecurity
Web security, defensive practice, and legal places to break things.
Where to start
Everything here is legal to practise on — that matters, and it is why no list of "vulnerable sites to try" appears. PortSwigger is the single best free security resource on the internet and it is not close. Work through OWASP alongside it so you learn the vocabulary the industry hires on.
Learn the attacks4
- Web Security AcademyCoreFree
Free, complete, and with a live lab for every vulnerability class. Written by the team behind Burp Suite.
- OWASP Top TenStart hereFree
The reference list of web application risks. The vocabulary every security conversation assumes you have.
- CryptoHackAdvancedFree
Cryptography taught by breaking it. Fixes the gap between "I use AES" and "I understand what I chose".
- Exploit EducationAdvancedFree
Memory corruption and privilege escalation on deliberately vulnerable virtual machines you run yourself.
Defend4
- OWASP Cheat Sheet SeriesCoreFree
Short, specific guidance on doing one thing safely — password storage, CSRF, file upload. Where to look before you implement.
- NCSC GuidanceStart hereFree
Practical, government-issued guidance aimed at organisations rather than researchers.
The catalogue of vulnerabilities being exploited right now. The correct patching priority list, free.
- MITRE ATT&CKCoreFree
The shared taxonomy of how intrusions actually proceed. What detection engineering is written against.
Practise legally4
- TryHackMeStart hereFree tier
Guided rooms with a browser machine. The gentlest on-ramp; a subscription unlocks the full paths.
- Hack The BoxAdvancedFree tier
Less guidance, harder boxes. The step after TryHackMe rather than instead of it.
- OverTheWire WargamesStart hereFree
Ancient, text-only, and still the best way to get genuinely comfortable on a Linux command line.
- picoCTFStart hereFree
Capture-the-flag built for teaching, with past competitions permanently playable.
About this list
12 resources, checked automatically every week so dead links do not sit here unnoticed. Nothing on this page is sponsored and none of these links pay us — which is the only reason a recommendation on it is worth anything. Every link goes to the original source, and we take nothing with you when you leave.