If you’re wanting to learn a lot more about how those ‘computer things’ work, and can confidently say you understand what an IP address is - then it’s time to upgrade your dojo and improve those ninja keyboard skills by attempting to learn about some computer security - then come back here and test out your skills ;)
If you’re looking to hone your skills, practice your uber hax0r skills or learn new techniques and other aspects of security, some of the sites below will also help!
The selection of sites below are a variety of free and paid, I have also tried to list and dig through some of my old bookmarks to find a nice selection of skills that can be tested with reverse engineering, sql injection, cross-site scripting (xss), and general privilege escalation.
1. OverTheWire (Free)
The absolute gold standard for getting your hands dirty on the command line. Start with the Bandit wargame — it takes you from basic Linux terminal commands, SSH keys, and file permissions all the way up through password-cracking and privilege escalation. Once you beat Bandit, move on to Natas for web-focused vulnerabilities (server-side scripts, session tampering, SQL injection).
2. Hack The Box (HTB) (Free / Paid VIP)
One of the most popular platforms for aspiring penetration testers. Hack The Box hosts live vulnerable lab machines on a dedicated VPN. You’re tasked with discovering open ports, exploiting services, getting a user shell, and escalating privileges to root. They release new challenge boxes regularly ranging from straightforward beginner boxes to insane multi-stage beasts.
3. VulnHub (Free)
If you prefer practicing locally without relying on a shared VPN connection, VulnHub provides downloadable vulnerable virtual machine images (like Kioptrix, Metasploitable, and community CTF boxes). You can import them directly into VirtualBox or a local hypervisor and run full network scans and exploits offline.
4. PortSwigger Web Security Academy (Free)
Created by the team behind Burp Suite, this is hands-down the best modern interactive training resource for web application security. Each topic covers the theory behind a vulnerability (SQLi, XSS, CSRF, SSRF, XML external entity injection) followed by free interactive labs that you solve in your browser using an intercepting proxy.
5. Exploit Education & SmashTheStack (Free)
For folks wanting to dive deeper into binary exploitation, memory corruption, and reverse engineering, Exploit Education (formerly Protostar and Fusion) and SmashTheStack provide classic wargames covering stack-based buffer overflows, format string vulnerabilities, and heap exploits.
6. UnderTheWire (Free)
The Windows/PowerShell equivalent of OverTheWire. If you want to understand how security auditing, administration, and command-line automation work in Windows and Active Directory environments, start with their Century series.
Where to Start?
Pick one platform, start at Level 0, and resist the temptation to look up walkthroughs until you’ve genuinely banged your head against the terminal for at least a few hours. The struggle of failing and researching commands is where the real knowledge sticks.
For more security fundamentals, check out my notes on Linux authentication with PAM Panic, blocking brute force attacks with Fail2ban, or exploring cybersecurity career paths and certification routes.