Practice ethical hacking legally

Nine topics, each with a safe place to practise and a link to the official material.

Cover graphic for ethical hacking practice labs with Pankaj Isharwal

Legal notice. Unauthorised access to computers is an offence under sections 43, 66, 66C and 66D of the Information Technology Act, 2000. Practise only on systems you own, or on targets that give explicit permission. These are guides to legal practice, not hosted targets.

Beginner to intermediate

SQL injection

Learn how injectable queries look and how parameterised queries fix them.

Setup: PortSwigger Web Security Academy has free guided labs. For a local target, install DVWA in a virtual machine.

PortSwigger SQL injection labs

Beginner

Cross-site scripting (XSS)

Stored, reflected and DOM-based XSS, and why output encoding matters.

Setup: Use OWASP Juice Shop in a container, or the PortSwigger XSS labs.

OWASP Juice Shop

Beginner

Network scanning with Nmap

Host discovery, port states and service detection.

Setup: Install Nmap. Scan your own machines, or scanme.nmap.org, which the Nmap project allows for light testing.

Nmap reference guide

Intermediate

Packet analysis with Wireshark

Reading captures and spotting unencrypted credentials or ARP trouble.

Setup: Open the public sample capture files on the Wireshark wiki.

Wireshark sample captures

Intermediate

Web testing with Burp Suite

Intercepting requests, changing parameters and using Repeater.

Setup: Install Burp Suite Community and work through the PortSwigger Academy labs.

Burp Suite documentation

Intermediate

Password auditing

How hashes are stored and why slow hashes like bcrypt matter.

Setup: Create your own test hashes and audit them with John the Ripper or Hashcat. Never run this on hashes you do not own.

Hashcat wiki

Intermediate

Metasploit in an isolated lab

Modules, payloads and handlers, practised safely.

Setup: Run Metasploitable in a host-only virtual network. Never expose it to the internet.

Metasploit documentation

Beginner

Capture the flag practice

Small puzzles in cryptography, forensics, steganography and web.

Setup: picoCTF and OverTheWire Bandit are free and designed for learners.

picoCTF

All levels

OWASP Top 10

The most common web application risk categories with examples and defences.

Setup: Read the current list, then map each item to a lab above.

OWASP Top 10