Beginner · Your legal practice lab · topic 8 of 35 · 15 min
Legal online platforms: TryHackMe, Hack The Box and more
Explanation
Why these platforms are safe
On these platforms, the targets belong to the platform and you are explicitly allowed to attack them. Often each person gets their own private copy. So you get realistic practice, legally, without building everything yourself. They also provide lessons, hints and a path from easy to hard.
| Platform | Style | Good for |
|---|---|---|
| TryHackMe | Guided rooms, beginner friendly | Learning step by step with explanations |
| Hack The Box | Machines and challenges, some harder | Practising realistic boxes; HTB Academy for lessons |
| PortSwigger Web Security Academy | Free web labs by the makers of Burp | Deep, free web-app practice (SQLi, XSS, SSRF, etc.) |
| OverTheWire | Wargames over SSH (e.g. Bandit) | Linux and basic security fundamentals |
The PortSwigger Web Security Academy deserves a special mention: it is free, made by the company behind Burp Suite, and its labs match the web topics in this course almost one to one. It is one of the best free resources for web security anywhere.
The golden rule still applies
How to use them well
Start with guided content (a TryHackMe beginner path, or the PortSwigger "apprentice" labs) before free-roaming harder machines. Keep notes exactly as you would in a real engagement: what you tried, what worked, and the fix. Those notes become your study material and, later, proof of your skills for a job.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Legal online platforms: TryHackMe, Hack The Box and more · 1/7
Some websites exist so you can legally attack their targets.
Prefer a video by a teacher? Find free videos on “tryhackme hack the box portswigger academy for beginners” on YouTube ↗
In real life: From zero to a first certificate
A job-seeker in Jaipur with no budget spends two months on TryHackMe's free beginner path and all the free PortSwigger "apprentice" web labs, writing notes for each. The structured lessons teach him recon, scanning and the main web flaws, each with its fix. When he later attempts the eJPT exam, the hands-on habits he built on these legal platforms carry him through. Total spend: nothing but time.
Practice (0/3 done)
Why are TryHackMe and Hack The Box legal to practise on?
Which free platform is made by the company behind Burp Suite?
Make a two-month, no-budget study plan using only free lab resources from this module.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Kali Linux: the attacker machineYour legal practice lab · same module
- Ethics and the law: permission firstCyber Security: from zero to SOC analyst · Security basics
- Building a portfolio and getting hiredBug bounties, disclosure and careers
- The CCNA 200-301 exam and your study planComputer Networking (CCNA level) · Troubleshooting and the CCNA exam
- Building a home lab and a portfolioCyber Security: from zero to SOC analyst · Careers and certifications
- GitOps and platform engineeringDevOps: Git, Docker, Kubernetes and CI/CD · GitOps, platform engineering and DevOps careers
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
OverTheWire is known for…
Answer: Wargames over SSH that teach Linux and fundamentals
Its wargames (like Bandit) teach Linux and security basics over SSH.
On a practice platform, which target may you attack?
Answer: Only the practice targets the platform assigns you
Permission covers only the assigned practice targets.
A good order for a beginner is…
Answer: Guided lessons first, then harder challenges
Build fundamentals with guided content before free-roaming.
Do you need to pay to start learning on these platforms?
Answer: No, free tiers are enough to begin
Free tiers are plenty to get started; pay only if you want more later.
The most important property of a practice lab is…Related
Answer: Isolation from real systems and the internet
Isolation keeps your attacks safe and legal.
Which is the safest place to practise your skills?Related
Answer: Your own deliberately vulnerable practice VM
Your own lab VMs and legal practice platforms are made for this. The others are off-limits.
The best way to learn from a vulnerable target is to…Related
Answer: Record how you found it, how it is misused, and the fix
Pair every attack with its defence and write it up.
From Vulnerable targets: Metasploitable, DVWA and Juice Shop
Who can authorise a security test of a website?Related
Answer: The owner of the system, in writing
Only the true owner (or someone they formally authorise) can give permission, and it should be written.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- This is the last topic of “Your legal practice lab”. The module exam comes next.
- Module 2 exam: the practice lab · 12 questions · 20 min, without help. 4 topics of this module still to finish first.
- Then the next module, Methodology and reconnaissance. 35 topics left in the course before the final exam.
← Previous: Vulnerable targets: Metasploitable, DVWA and Juice Shop