Beginner · Your legal practice lab · topic 7 of 35 · 18 min
Vulnerable targets: Metasploitable, DVWA and Juice Shop
Explanation
Why "deliberately vulnerable" targets exist
Teams build broken-on-purpose applications so learners have something legal to attack. Every weakness is intended, with a matching lesson, so you can practise finding and fixing it. This is the legal way to get hands-on without touching anyone else's system.
The common practice targets
| Target | What it is | Good for learning |
|---|---|---|
| Metasploitable 2/3 | A Linux VM with many old, weak network services | Scanning, enumeration, service exploits in Metasploit |
| DVWA | Damn Vulnerable Web Application (PHP) | Web flaws with easy/medium/hard levels: SQLi, XSS, CSRF |
| OWASP Juice Shop | A modern JavaScript shop app, broken on purpose | Modern web flaws, a built-in scoreboard of challenges |
| bWAPP / WebGoat | More vulnerable web apps | Extra practice on OWASP-style issues |
DVWA has a security level you can set to low, medium or high. Start at low to see the raw flaw, then raise the level to see how each defence makes the attack harder. Reading DVWA's own "view source" for each level teaches you the fix.
Juice Shop and the scoreboard
OWASP Juice Shop is a realistic modern web app with dozens of hidden challenges. Solving one unlocks points on a scoreboard. It covers the OWASP Top 10 and is a friendly way to practise because it gives instant feedback and hints.
How to use a target well
Do not just "win" the challenge. For each flaw, write down three things: how you found it, how an attacker could misuse it, and how a developer would fix it. That habit turns a game into real, report-ready knowledge — and it is exactly what a client pays for.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Vulnerable targets: Metasploitable, DVWA and Juice Shop · 1/7
Deliberately vulnerable apps exist so you can attack something legally.
Prefer a video by a teacher? Find free videos on “DVWA OWASP juice shop metasploitable setup tutorial” on YouTube ↗
In real life: Learning SQL injection safely
A learner sets DVWA to "low" and finds that typing ' OR '1'='1 into a login form logs him in without a password. He notes how he found it and how it could be misused. Then he opens DVWA's source for the "high" level and sees it uses a prepared statement, which blocks the trick. He writes the fix in his own words: "use parameterised queries". He has learned the attack and the defence together, with nobody harmed.
Practice (0/3 done)
DVWA stands for…
DVWA's security levels (low/medium/high) help you…
Describe the habit you will follow for every flaw you practise on a target, so that it becomes report-ready knowledge.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Legal online platforms: TryHackMe, Hack The Box and moreYour legal practice lab · same module
- Metasploit basics (in the lab)Deeper lab skills: passwords, privilege, Metasploit, wireless
- The OWASP Top 10: the most common web risksBackend Development · Backend security
- The OWASP Top 10 with fixesCyber Security: from zero to SOC analyst · Malware and web security
- The OWASP approach to web testingWeb application testing: Burp Suite and the basics
- SQL injection (SQLi)Web attacks and their fixes
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
OWASP Juice Shop is best described as…
Answer: A modern web app that is broken on purpose, with a challenge scoreboard
It is a deliberately vulnerable modern web app used for legal practice.
Metasploitable is most useful for practising…
Answer: Scanning, enumeration and service exploits
It is a Linux VM full of weak network services to scan and exploit in your lab.
Where should these vulnerable targets live?
Answer: On a host-only/internal lab network only
They must stay isolated; never expose them to the internet or a shared network.
The best way to learn from a vulnerable target is to…
Answer: Record how you found it, how it is misused, and the fix
Pair every attack with its defence and write it up.
Which VirtualBox network keeps targets off the internet?Related
Answer: Host-only or internal
Host-only/internal networks connect the VMs privately without internet access.
The single most effective defence against a Metasploit exploit is…Related
Answer: Patching the vulnerability it targets
With no unpatched flaw, the matching exploit fails.
What is the OWASP Top 10?Related
Answer: A list of the most common and serious web app security risks
The Top 10 is a free awareness list of the most common and serious risks found in real web apps.
On a practice platform, which target may you attack?Related
Answer: Only the practice targets the platform assigns you
Permission covers only the assigned practice targets.
From Legal online platforms: TryHackMe, Hack The Box and more
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 1 more topic in “Your legal practice lab” before its exam: Legal online platforms: TryHackMe, Hack The Box and more.
- Module 2 exam: the practice lab · 12 questions · 20 min, without help. 4 topics of this module still to finish first.
- Then the next module, Methodology and reconnaissance. 35 topics left in the course before the final exam.