Understanding hack me and other online resources

There are several other resources that can be accessed either online or installed in VirtualBox that you can use to hone your penetration testing skills. The following list contains few resources you may want to explore as a supplement to the exercises in this book:

hack.me	Easy to advanced challenges	https://hack.me/
Hack this site	Easy to advanced challenges	https://www.hackthissite.org/
Vulnerable by design	Easy to advanced challenges	https://www.vulnhub.com/
Bee-Box	Vulnerable web sites	https://sourceforge.net/projects/bwapp/files/bee-box/
Moth	Vulnerable web applications	http://www.bonsai-sec.com/en/research/moth.php
RasPwn	Vulnerable Raspberry Pi image	http://raspwn.org/
OWASP-BWA	OWASP broken web application	https://www.owasp.org/index.php/OWASP_Broken_Web_Applications_Project
Hackfest 2016 Sedna	Medium difficulty - root access	https://www.vulnhub.com/entry/hackfest2016-sedna,181/
Hackfest 2016 Quaoar	Easy machine to own	https://www.vulnhub.com/entry/hackfest2016-quaoar,180/
Pentester Lab: XSS and MySQL File	Easy SQL injection example	https://www.vulnhub.com/entry/pentester-lab-xss-and-mysql-file,66/
SQLInjection to Shell	Intermediate - SQL injection to shell	https://www.vulnhub.com/entry/pentester-lab-from-sql-injection-to-shell-ii,69/
Damn vulnerable web application	Vulnerable - PHP/MySQL application	https://github.com/Hackademic/hackademic
Hackxor	Webapp hacking game	http://hackxor.sourceforge.net/cgi-bin/index.pl
WebGoat	Medium level challenge	https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project

There's more...

The preceding resources will be installed on a variety of different methods that are beyond the scope of this book. But I will quickly mention some of the deployment options:

• Virtual machines that, can be installed in VirtualBox
• Scripts that can be run on standard Linux machines to build applications and make them specifically vulnerable to attacks
• Resources that you may attack over the internet
• Complete self contained hacking environments

Please ensure that as you are working with these sites, you read carefully the terms of service and understand all requirements and limitations of the environment or tools you are working with. Also be careful if you are remotely hacking sites across the internet. Although there are some of these options available for testing and it may be perfectly legal to do so, your Internet Service Provider (ISP) may flag the activity as malicious and take action against you.