Practice Labs & CTF Exercises
Test your skills with hands-on labs for each major web vulnerability. Filter by category or difficulty, reveal hints, and view solutions. 13 of the 14 labs map to a PortSwigger Web Security Academy practice exercise; the last opens the SSRF topic overview instead.
This chapter is a hands-on interlude: it sits between the Exploitation chapter (6) and the Post-Exploitation chapter (8), so you can practise the techniques on real targets before moving on to what happens after a foothold.
Most platforms below host the labs for you. If you would rather host them yourself, the Web Application Lab setup guide builds DVWA, Juice Shop, WebGoat, and the API labs in Docker; this chapter is where you attack them.
Lab Platforms Comparison
Choose the platform that fits your learning style and budget. Each excels in different areas:
| Platform | Pricing | Strengths | Best For |
|---|---|---|---|
| PortSwigger Web Security Academy | Free | Best structured web security curriculum; covers every OWASP category; official Burp labs | Dedicated web pentesting practice; beginners through advanced |
| TryHackMe | Free / from $10.50/mo (annual) | Guided learning paths; browser-based VMs; beginner-friendly | Structured learning; those new to security |
| Hack The Box | Free / VIP+ $25/mo or $223/yr (VIP tier discontinued Oct 2025) | Realistic machines; competitive aspect; Pro Labs for enterprise scenarios | Intermediate-advanced; exam prep (OSCP, CPTS) |
| PentesterLab | $19.99/mo or $199.99/yr (free tier) | Focused web exercises; badge progression; covers modern vulns quickly | Web-specific skills; JWT, OAuth, deserialization |
| DVWA | Free (self-hosted) | Simple setup; adjustable difficulty; classic training tool | Local practice; basic injection & XSS |
| OWASP Juice Shop | Free (self-hosted) | Modern app (Node/Angular); 100+ challenges; CTF mode | Comprehensive self-hosted lab; OWASP Top 10 coverage |
Information
How to Practice Effectively
Do
- • Try without hints first (30-60 min per challenge)
- • Document your approach — build a personal playbook
- • After solving, read the official writeup for new techniques
- • Practice each vuln class until it's second nature
- • Combine tools with manual testing — don't rely on scanners
Don't
- • Jump to solutions immediately
- • Skip fundamentals for flashy exploits
- • Collect flags without understanding the technique
- • Only use automated tools — learn manual testing
- • Practice on real systems without authorization
Interactive Lab Explorer
Browse labs by vulnerability category and difficulty. Click on any lab for details, hints, and links to practice platforms.