Choosing and installing a legal training environment

You cannot learn to find vulnerabilities by looking at real websites: that would be illegal and unfair to their owners. Fortunately, the security community has built applications that are broken on purpose, so that you can practise safely and as hard as you like. In this lesson you pick one and install it in an isolated lab.

The main legal options

These platforms are designed and published for learning. Using them within their terms is entirely legitimate.

Platform	Type	Good for
DVWA (Damn Vulnerable Web Application)	Application you install yourself	Classic flaws with adjustable difficulty; ideal for first steps
OWASP Juice Shop	Application you install yourself	A realistic modern web shop with many challenges and a score board
PortSwigger Web Security Academy	Online labs and free learning material	Guided, topic-by-topic labs, accessed through your browser
TryHackMe	Online guided rooms	Step-by-step learning paths, beginner-friendly
HackTheBox	Online machines and challenges	More advanced practice once you are comfortable

These are simply training resources, mentioned here without any commercial recommendation. The important point is that each one explicitly authorises you to attack its content, and nothing else.

Our common thread

For the guided parts of this course, we will use a deliberately vulnerable shop-type application running in your own lab as the target of a fictional audit. You can pick DVWA, OWASP Juice Shop, or both. We describe vulnerabilities in generic terms so that the lessons apply to whichever you choose, and we point to the equivalent PortSwigger Academy topics when you want guided labs. Your notebook will accumulate findings from lesson to lesson.

Building a safe lab

A good lab has three properties: isolated, disposable and separate from your daily life.

Option A: a virtual machine

Install VirtualBox or VMware, then create a Kali Linux virtual machine (Kali ships many testing tools, including Burp Suite). Configure its network adapter in NAT or host-only mode so that the VM does not sit exposed on your home network. Take a snapshot once the machine is installed and clean. If you break something, you can go back in a minute.

Option B: containers on your own machine

If you already know Docker from the previous course, both DVWA and Juice Shop are published as container images. The key is to publish the port to the local address only, using 127.0.0.1 in the mapping. The general pattern is:

docker run --rm -p 127.0.0.1:3000:3000 <official-image-of-the-training-app>

Replace the placeholder with the image name given in the project’s official documentation, and check that documentation for the exact command, as images and options evolve. The 127.0.0.1: prefix is what keeps the application invisible to the rest of your network. The --rm option deletes the container when you stop it, which gives you a clean start every time.

Then open http://localhost:3000 in your testing browser. For DVWA, follow the project’s installation guide: it usually asks you to create the database from a setup page the first time, then log in with the default credentials documented by the project.

DVWA security levels

DVWA lets you choose a difficulty level, typically low, medium, high and impossible. This is a clever teaching feature:

• Low shows the flaw in its raw form with no protection.
• Medium adds an incomplete defence that a curious tester can sometimes work around, which illustrates why half-measures fail.
• High adds stronger but still imperfect defences.
• Impossible shows the correct, secure implementation. Its source code is excellent reading material.

Start at low to understand the concept, then raise the level to see how defences change the game. At the end of each topic, read the secure version of the code; that is where the real learning happens.

Juice Shop and its score board

OWASP Juice Shop looks like a real online shop selling fruit juices, built with current web technologies. It contains many hidden challenges, graded by difficulty, covering the OWASP Top 10 categories. A score board tracks which ones you solved, and hints are available if you get stuck. Because it behaves like a real application, with a front end that talks to an API, it teaches you to look at the traffic in your proxy rather than only at the pages.

PortSwigger Web Security Academy

This free online learning resource is organised by vulnerability type. Each topic has a clear explanation, then interactive labs that run in the cloud, so you do not need to install anything beyond your browser and, ideally, Burp. It works well as a complement to this course: after reading a chapter here, find the matching topic there for extra practice. Always stay inside the lab environment the platform gives you.

Good habits for your lab

• Snapshots or fresh containers before each session: you can always return to a known state.
• No real data in the lab: never reuse a real password on a training application, since the application is designed to be insecure.
• Keep it updated as far as your tools go. The tools themselves, such as Burp or your VM, should be kept current.
• Document the setup in your notebook: versions, ports, how to start and stop, and how to reset.

Your turn: build and check your lab

Choose one training application (DVWA or Juice Shop) and install it using the project’s official instructions in an isolated VM or a local container. Then verify three things and record them in your notebook: it is reachable at a local address, it is not reachable from another device on your network, and you know how to reset it to a clean state.

See a solution

A checklist you can reuse:

1. Reachable locally: the login page appears in your testing browser at http://localhost:<port>.
2. Not reachable from outside: from a phone on the same Wi-Fi, try the address of your computer and the same port. It should fail or time out. If it loads, change your port mapping to bind to 127.0.0.1 or switch the VM to host-only networking.
3. Resettable: you can recreate the container or restore the VM snapshot and get a fresh application.

Write the exact commands or menu paths you used. Future you will be grateful.

With your lab running and your proxy ready, you can now start the actual audit: mapping what the application contains.