Free cybersecurity labs & hacking tools FULL LIST

[Xworld]

Hey everyone,

I thought I should share this well-curated list of free labs, platforms, and tools for hands-on cybersecurity practice, broken down by skill level and focus area.
Overall it's a great starting point or reference to keep handy. Figured I’d drop it here in case anyone finds it useful.

[ Hidden Content! ]

🔻 For Beginners:

TryHackMe – Free Rooms
Over 650 free rooms covering Linux, Networking, Web Security, Windows, Threat Hunting, etc.
https://lnkd.in/dHvV5FPi

OverTheWire – Bandit
One of the best practical intros to Linux and the command line.
https://lnkd.in/denYK4xB

picoCTF
Free challenges in Web Exploitation, Cryptography, Forensics, Reverse Engineering, and Binary Exploitation.
https://picoctf.org

🔻 SOC & Blue Team:

LetsDefend
Simulates SOC Analyst work – handling alerts and incidents.
https://letsdefend.io

CyberDefenders
Practical labs in SOC, DFIR, Threat Hunting, Threat Intel, and Malware Analysis.
https://lnkd.in/dGFyMj6Z

CyberDefenders – Starting Point
Good if you're new to Blue Team labs.
https://lnkd.in/dd4yfMVr

🔻 Web Application Security:

PortSwigger Web Security Academy
One of the best free resources out there. Labs on SQLi, XSS, CSRF, SSRF, Auth, Access Control, JWT, API, GraphQL, LLM attacks, and more.
https://lnkd.in/d2iXq-_t

Video: What is SQL Injection? – PortSwigger
Straight from PortSwigger before diving into the labs.
https://lnkd.in/dt9WWsJh

OWASP Juice Shop
Intentionally vulnerable web app for hands-on training.
https://lnkd.in/ddEMXS-h

OWASP WebGoat
Deliberately weakened environment for learning web vulnerabilities.
https://lnkd.in/duTHdSyF

🔻 Penetration Testing:

TryHackMe – Free Rooms
Start with easy rooms, move up to harder machines and challenges.
https://lnkd.in/dHvV5FPi

Hack The Box
Machines and labs for pentesting practice.
https://lnkd.in/dhM9jt5A

VulnHub
Download vulnerable VMs and run them locally.
https://vulnhub.com

Metasploitable 2
Classic vulnerable system for exploit practice.
https://lnkd.in/d4icNC2v

🔻 Active Directory Security:

GOAD – Game of Active Directory
Free project to build an AD lab full of misconfigs and vulns. Train on enumeration, Kerberos attacks, lateral movement, priv esc, etc.
https://lnkd.in/d2iKXBM4

If your machine can't handle the full setup, they also offer smaller environments like GOAD-Light and MINILAB.

🔻 Digital Forensics & Incident Response (DFIR):

CyberDefenders
Practical challenges in incident investigation and digital evidence.
https://lnkd.in/dGFyMj6Z

Volatility 3
Memory forensics training with memory dumps.
https://lnkd.in/dP3YhxUm

Autopsy
Free, open-source digital forensics tool.
https://autopsy.com

Tip: Grab a real memory dump and start hunting for processes, network connections, malicious DLLs, command history, and IOCs.

🔻 Malware Analysis & Reverse Engineering:

Malware Unicorn Workshops
Free workshops on malware analysis and RE.
https://lnkd.in/d3yYvjhe

OpenSecurityTraining2
Free advanced content on RE, Assembly, OS internals, low-level security.
https://p.ost2.fyi

Ghidra
Free and open-source RE tool from the NSA.
https://ghidra-sre.org

Video: Beginner Malware Analysis Course – John Hammond
Good starting point for beginners.
https://lnkd.in/dWEx7P5w

🔻 Threat Hunting & Detection Engineering:

MITRE ATT&CK
Essential reference for attacker tactics and techniques.
https://attack.mitre.org

Sigma
Open-source project for writing detection rules that work across SIEMs.
https://sigmahq.io




CyberDefenders – Threat Hunting Labs
Practical scenarios instead of just theory.
https://lnkd.in/dGFyMj6Z

🔻 Cloud Security:

CloudGoat
Deliberately vulnerable AWS environment for hands-on cloud security training.
https://lnkd.in/d-BkfrQs

flaws.cloud
Another AWS-focused challenge site.
http://flaws.cloud

Hope this helps someone out. If you've tried any of these, drop your thoughts – always curious to hear what others think.