Hacking Without All the Jailtime

http://ha.ckers.org/blog/20090406/hacking-without-all-the-jailtime/

Hacking Without All the Jailtime

There’s been more and more legislation put in place to try to discourage hacking in general, and even tool development. Not that I think it’ll lead to many prosecutions anywhere, but nevertheless, it’s always nice to have a place to test. I got an email from one of my readers asking about the hackme series:

Hello and thank you for an awesome blog, and a daily read.

I while back you mentioned some “ready-made” websites that were used in the web app sec sphere to test scanners and specific tools. More specifically you mentioned 2, one of which that was somewhat depreciated, but still had some educational value. I’ve been looking though your posts, but I have had no success finding this entry.

I’ll do one better - here’s a short list I compiled that includes a lot of the more popular tools for ethical testing, without all the muss and fuss of prison time. If you want to hone your skills or just have some fun at work, try these out (in no particular order):

• http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
• http://testasp.acunetix.com/Default.asp
• http://test.acunetix.com/
• http://hackme.ntobjectives.com/
• http://www.foundstone.com/us/resources/proddesc/hacmeshipping.htm
• http://www.foundstone.com/us/resources/proddesc/hacmecasino.htm
• http://www.foundstone.com/us/resources/proddesc/hacmebooks.htm
• http://www.foundstone.com/us/resources/proddesc/hacmetravel.htm
• http://zero.webappsecurity.com/
• http://www.hackertest.net/
• http://www.hackthissite.org/
• http://www.mavensecurity.com/WebMaven.php
• http://ha.ckers.org/challenge/
• http://ha.ckers.org/challenge2/
• http://demo.testfire.net/
• http://scanme.nmap.org/
• http://www.hellboundhackers.org/
• http://www.overthewire.org/wargames/
• http://roothack.org/
• http://heorot.net/
• http://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-owasp-top-10
• http://wocares.com/xsstester.php
• https://how2hack.net
• http://hax.tor.hu/

If there are others that should be added to this list, please drop me a line and I’ll add them. I hope everyone had a good April 1st and that insurance covers whatever was damaged.