One of the most common questions we get from beginners is "where do I actually practice hacking?" The answer is CTF (Capture the Flag) platforms and intentionally vulnerable machines. These provide safe, legal environments where you can develop your skills without worrying about breaking laws or damaging real systems. This guide covers the best platforms and how to approach each one.
Why Practice on CTF Machines?
Reading tutorials and watching videos will only take you so far. Penetration testing is a hands-on skill, and you need to develop the instinct for enumeration, the patience for trial and error, and the creativity to chain multiple vulnerabilities together. CTF machines provide this practice in a structured way.
They also build a skill set that directly translates to certifications like OSCP, where you need to compromise multiple machines in a timed exam. The methodology you develop through CTF practice - enumerate, research, exploit, escalate, document - is exactly what professional engagements require.
VulnHub
Website: vulnhub.com
VulnHub is a collection of downloadable virtual machines designed to be vulnerable. You run them locally in VirtualBox or VMware alongside your attacking machine (typically Kali Linux).
Why VulnHub Is Great for Beginners
- Completely offline - no internet connection required after download
- No time limits or restrictions
- Huge library of machines at every difficulty level
- Community writeups available after you finish (or get stuck)
Getting Started
- Download and install VirtualBox (free) or VMware Workstation
- Download Kali Linux and set it up as a VM
- Download a beginner VulnHub machine
- Import the VM and set both VMs to use the same host-only or NAT network
- Start hacking
Recommended Starting Machines
- Kioptrix Level 1 - a classic beginner machine. Straightforward enumeration leads to a known exploit. Perfect first machine.
- Mr. Robot - themed after the TV show. Engaging story-driven challenges that teach web app enumeration and Linux privilege escalation.
- DC Series (DC-1 through DC-9) - progressive difficulty series by DCAU. Start with DC-1 and work through them in order.
- Stapler - multiple entry points, teaches you that real-world targets often have several ways in.
- SickOs 1.1 - great for learning web application attacks and pivoting.
Tips for VulnHub
- Always start with a full port scan:
nmap -sV -sC -p- <target> - Read the machine description carefully - authors often hint at the intended path
- Take notes on everything you find during enumeration
- If you are stuck for more than an hour on the same step, look at a writeup for a hint (not the full solution)
HackTheBox
Website: hackthebox.eu
HackTheBox (HTB) is the most popular online hacking platform. It hosts live machines that you connect to through a VPN, and new machines are released weekly.
How It Works
- Connect to the HTB network via OpenVPN
- Choose a machine and start hacking
- Find two flags: user.txt and root.txt
- Submit flags on the website for points
The HTB Experience
Active machines (those currently available) do not have public writeups. This forces you to actually work through the challenges. When machines are retired, writeups become available and you can learn from other approaches.
Recommended Starting Machines (Retired, Writeups Available)
- Lame - one of the simplest machines. A single exploit gets you root. Great confidence builder.
- Jerry - teaches Tomcat exploitation, a very common real-world finding.
- Blue - EternalBlue exploitation. Simple but teaches you an important historical exploit.
- Netmon - FTP anonymous access leading to credential discovery. Teaches enumeration patience.
- Bashed - web shell exploitation and Linux privilege escalation with sudo misconfigurations.
HTB Tips
- Start with Easy-rated retired machines that have writeups available
- Watch IppSec's YouTube walkthroughs - he explains his methodology, not just the solution
- Do not jump to Hard machines too quickly. Build a solid foundation with Easy and Medium boxes first
- Use the HTB forum for hints on active machines (no spoilers, just nudges)
TryHackMe
Website: tryhackme.com
TryHackMe (THM) is the most beginner-friendly platform. Instead of just dropping you into a machine and saying "hack it," THM provides guided learning paths with step-by-step instructions.
Why TryHackMe Stands Out
- Structured learning paths (Beginner, Offensive Pentesting, Cyber Defense, etc.)
- Rooms with questions that guide you through each step
- Built-in AttackBox browser VM - no setup required
- Free tier with plenty of content to get started
Recommended Learning Path
- Complete Beginner path - covers Linux basics, networking, web fundamentals
- Pre Security path - foundational knowledge
- Offensive Pentesting path - the core hacking skills path
- Individual rooms - branch out based on your interests
Standout Rooms
- Basic Pentesting - walks through a complete beginner-level pentest
- Vulnversity - teaches web app reconnaissance and exploitation
- Kenobi - exploiting Samba shares and SUID binaries on Linux
- Blue - guided EternalBlue exploitation with Metasploit
- Ice - Windows exploitation and post-exploitation basics
THM Tips
- Do not skip the guided questions - they teach methodology, not just answers
- The learning paths are designed in order, so follow the sequence
- THM is the best starting point if you have never done any hacking before
PentesterLab
Website: pentesterlab.com
PentesterLab focuses heavily on web application security. If you want to specialize in web app pentesting or bug bounty hunting, this is the platform for you.
What Makes PentesterLab Different
- Focus on specific vulnerability classes (XSS, SQLi, XXE, SSRF, deserialization, etc.)
- Progressive exercises from basic to advanced for each vulnerability type
- Badges system that tracks your progress through different topics
- Exercises based on real CVEs and vulnerability disclosures
Recommended Starting Exercises
- Web for Pentester (free) - covers the basics: XSS, SQL injection, file inclusion, command injection
- From SQL Injection to Shell - complete walkthrough of chaining SQLi to server access
- Essential Badge - start here for the core web vulnerabilities
PentesterLab Tips
- The Pro subscription is worth it if you are serious about web security
- Complete exercises in order within each badge - they build on each other
- Try to understand why each vulnerability exists, not just how to exploit it
OWASP WebGoat
Website: owasp.org/www-project-webgoat
WebGoat is an intentionally vulnerable web application maintained by OWASP. It runs locally and teaches web security concepts through interactive lessons.
Why WebGoat Matters
- Created by OWASP, the authority on web application security
- Covers the OWASP Top 10 vulnerabilities with hands-on exercises
- Self-paced with built-in hints and solutions
- Free and open source
Getting Started
Install WebGoat using Docker (the easiest method):
docker run -p 8080:8080 -p 9090:9090 webgoat/webgoat
Navigate to http://localhost:8080/WebGoat and create an account.
What You Will Learn
- Injection attacks (SQL, LDAP, XPath)
- Broken authentication
- Cross-site scripting (reflected, stored, DOM-based)
- Insecure deserialization
- XML External Entity (XXE) attacks
- Access control vulnerabilities
WebGoat Tips
- Work through each lesson category systematically
- Use the built-in developer tools (F12) to examine requests
- WebGoat also includes WebWolf, a companion application for practicing attacks that need an external server
Building Your Practice Routine
Here is a suggested progression for someone starting from zero:
Weeks 1 to 4: TryHackMe Complete Beginner and Pre Security paths. Get comfortable with Linux, networking, and basic tools.
Weeks 5 to 8: TryHackMe Offensive Pentesting path plus easy VulnHub machines (Kioptrix, DC-1). Start developing your own methodology.
Weeks 9 to 12: Easy HackTheBox retired machines with IppSec walkthroughs. OWASP WebGoat for web fundamentals.
Ongoing: Mix of HTB active machines, PentesterLab web exercises, and harder VulnHub machines. Start participating in CTF competitions with your local community or online teams.
General Tips for CTF Success
- Take detailed notes. Use tools like CherryTree, Notion, or plain markdown files. Document every command, every finding, every failed attempt.
- Develop a methodology. A repeatable checklist for enumeration ensures you do not miss obvious things.
- Learn to read exploit code. Do not just run exploits blindly. Understand what they do, which makes troubleshooting much easier.
- Join the community. Discord servers for HTB, THM, and InfoSec in general are full of helpful people. Ask questions when stuck, and help others when you can.
- Set a timer. Spending 8 hours on one machine without progress leads to frustration. Set time limits, take breaks, and come back fresh.
Conclusion
The platforms above give you everything you need to go from complete beginner to competent penetration tester. The key is consistent practice - even 30 minutes a day adds up quickly. Pick a platform that matches your current level, start working through machines, and do not be afraid to struggle. Every experienced pentester started exactly where you are now.
Happy hacking, and remember to stay legal - only attack systems you have explicit permission to test.