HTB / THM / VulnHub

# Practice platforms - sanctioned environments

> Always use sanctioned, legal practice environments. Attacking systems you
> do not own or have written authorisation for is illegal in most
> jurisdictions.

## CTF-style (offense + defense)

- HackTheBox - retired boxes free, season boxes paid; broad
- TryHackMe - learning-path focused; great for beginners
- PortSwigger Web Security Academy - free, web-focused, world class
- PicoCTF - educational, K-12 friendly
- OverTheWire (Bandit, Natas) - Linux + web fundamentals
- Root-Me - large catalogue
- pwnable.kr / pwnable.tw - binary exploitation focus

## Blue team / detection engineering

- Blue Team Labs Online (BTLO) - DFIR and analyst scenarios
- LetsDefend - SOC analyst simulation
- DetectionLab + Atomic Red Team in your own lab
- SOC Simulator (by Splunk and others)

## Cloud-specific

- AWS Cloud Quest, Skill Builder
- CloudGoat (Rhino Security) - intentionally vulnerable AWS scenarios
- TerraGoat, KubernetesGoat - misconfig labs
- flAWS / flAWS2 - free AWS attack/defence walkthroughs

## Threat modelling + tabletop

- OWASP Threat Dragon
- Microsoft Threat Modeling Tool
- Backdoors & Breaches card game

## Bug bounty learning (do not attack live targets without scope)

- HackerOne CTF + reports archive
- Bugcrowd University
- intigriti Challenges

## Build-your-own lab

- VirtualBox / VMware / Proxmox + Vulnhub VMs
- DetectionLab for SIEM/EDR experimentation
- A small Kubernetes cluster via kind or k3d

## Legal + ethical reminder

- Only test systems you own, or where you have written authorisation
- Read each platform's terms; some forbid sharing solutions
- Keep work logs for your own portfolio

## How to use platforms well

- Treat each box as a real engagement: enumeration, hypotheses, notes, write-up
- Maintain a personal write-up repo; private until polished
- Pair offensive boxes with a defensive question - 'how would we detect this?'

# Learn in legal labs:
#   - HackTheBox     — flagship, broad difficulty.
#   - TryHackMe      — structured rooms, beginner-friendly.
#   - VulnHub        — offline VMs.
#   - PortSwigger Academy — best-in-class web tutorials.