Stage 2 · Lesson 3 of 7

Intentionally vulnerable practice apps

are built to be broken, so you can learn safely. OWASP Juice Shop is the best known: a modern web shop full of documented weaknesses. Many platforms offer similar practice targets.

Run them in a or a on a or internal lab network, never on a public server. Each path uses them differently. Defenders watch the logs the app produces.

learners read the code and fix the weakness. Future testers practise their method and their reports. After each exercise, write notes on what the weakness is and how it is prevented.

Common trapdeploying one of these apps to a cloud server "to share with friends", which puts a deliberately broken app on the open internet.

A question to check yourself, an AI practice session and 2 cheat sheet entries come with the full roadmap. Unlock

Resources for this stage

Start with

GuideFree
Docker Docs: Get Started
Docker · Beginner
Enough Docker to run, reset and remove practice targets and tools cleanly

Practise

OWASP Juice Shop
The standard intentionally vulnerable web app: run it locally and use it throughout your path
LetsDefend
Blue-team practice with a simulated SOC, so your lab time goes into analysis rather than setup

Keep handy

Wireshark User's Guide
Capture and read your own lab traffic to see what normal and unusual look like

Also worth your time

Linux Upskill ChallengeGo deeper
A month of daily tasks on a real Linux server if you want your Linux administration to be solid