Stage 2 · Lesson 4 of 7

Practice platforms and their rules

Practice platforms give you legal , guided lessons and machines you can use in the browser. Examples are , Academy, , CyLab Security Academy (formerly picoCTF) and PortSwigger's Web Security Academy.

Each one has rules, set out in its . Attack only the machines and addresses they give you. Do not attack the platform itself.

Do not publish solutions for challenges that are still active. Many have free tiers and some offer student discounts; check the current plans on the official page before paying. Pick one main platform for your path rather than collecting accounts. Often you connect to the lab through a VPN, a private tunnel into their network.

Common traptreating that VPN connection as permission to scan anything: the lab scope is exactly the targets they list, nothing more.

A question to check yourself, an AI practice session and 2 cheat sheet entries come with the full roadmap. Unlock

Resources for this stage

Start with

GuideFree
Docker Docs: Get Started
Docker · Beginner
Enough Docker to run, reset and remove practice targets and tools cleanly

Practise

OWASP Juice Shop
The standard intentionally vulnerable web app: run it locally and use it throughout your path
TryHackMe
Browser-based machines if your laptop cannot run a full lab, with clear rules on what you may target

Keep handy

Kali Linux Documentation
Official guides for running Kali as a virtual machine, the usual testing workstation
Wireshark User's Guide
Capture and read your own lab traffic to see what normal and unusual look like

Also worth your time

Linux Upskill ChallengeGo deeper
A month of daily tasks on a real Linux server if you want your Linux administration to be solid