[coocochi]

Hey everyone,

I thought I should share this well-curated list of free labs, platforms, and tools for hands-on cybersecurity practice, broken down by skill level and focus area.
Overall it's a great starting point or reference to keep handy. Figured I’d drop it here in case anyone finds it useful.

🔻 For Beginners:

TryHackMe – Free Rooms
Over 650 free rooms covering Linux, Networking, Web Security, Windows, Threat Hunting, etc.
https://lnkd.in/dHvV5FPi

OverTheWire – Bandit
One of the best practical intros to Linux and the command line.
https://lnkd.in/denYK4xB

picoCTF
Free challenges in Web Exploitation, Cryptography, Forensics, Reverse Engineering, and Binary Exploitation.
https://picoctf.org

🔻 SOC & Blue Team:

LetsDefend
Simulates SOC Analyst work – handling alerts and incidents.
https://letsdefend.io

CyberDefenders
Practical labs in SOC, DFIR, Threat Hunting, Threat Intel, and Malware Analysis.
https://lnkd.in/dGFyMj6Z

CyberDefenders – Starting Point
Good if you're new to Blue Team labs.
https://lnkd.in/dd4yfMVr

🔻 Web Application Security:

PortSwigger Web Security Academy
One of the best free resources out there. Labs on SQLi, XSS, CSRF, SSRF, Auth, Access Control, JWT, API, GraphQL, LLM attacks, and more.
https://lnkd.in/d2iXq-_t

Video: What is SQL Injection? – PortSwigger
Straight from PortSwigger before diving into the labs.
https://lnkd.in/dt9WWsJh

OWASP Juice Shop
Intentionally vulnerable web app for hands-on training.
https://lnkd.in/ddEMXS-h

OWASP WebGoat
Deliberately weakened environment for learning web vulnerabilities.
https://lnkd.in/duTHdSyF

🔻 Penetration Testing:

TryHackMe – Free Rooms
Start with easy rooms, move up to harder machines and challenges.
https://lnkd.in/dHvV5FPi

Hack The Box
Machines and labs for pentesting practice.
https://lnkd.in/dhM9jt5A

VulnHub
Download vulnerable VMs and run them locally.
https://vulnhub.com

Metasploitable 2
Classic vulnerable system for exploit practice.
https://lnkd.in/d4icNC2v

🔻 Active Directory Security:

GOAD – Game of Active Directory
Free project to build an AD lab full of misconfigs and vulns. Train on enumeration, Kerberos attacks, lateral movement, priv esc, etc.
https://lnkd.in/d2iKXBM4

If your machine can't handle the full setup, they also offer smaller environments like GOAD-Light and MINILAB.

🔻 Digital Forensics & Incident Response (DFIR):

CyberDefenders
Practical challenges in incident investigation and digital evidence.
https://lnkd.in/dGFyMj6Z

Volatility 3
Memory forensics training with memory dumps.
https://lnkd.in/dP3YhxUm

Autopsy
Free, open-source digital forensics tool.
https://autopsy.com

Tip: Grab a real memory dump and start hunting for processes, network connections, malicious DLLs, command history, and IOCs.

🔻 Malware Analysis & Reverse Engineering:

Malware Unicorn Workshops
Free workshops on malware analysis and RE.
https://lnkd.in/d3yYvjhe

OpenSecurityTraining2
Free advanced content on RE, Assembly, OS internals, low-level security.
https://p.ost2.fyi

Ghidra
Free and open-source RE tool from the NSA.
https://ghidra-sre.org

Video: Beginner Malware Analysis Course – John Hammond
Good starting point for beginners.
https://lnkd.in/dWEx7P5w

🔻 Threat Hunting & Detection Engineering:

MITRE ATT&CK
Essential reference for attacker tactics and techniques.
https://attack.mitre.org

Sigma
Open-source project for writing detection rules that work across SIEMs.
https://sigmahq.io

CyberDefenders – Threat Hunting Labs
Practical scenarios instead of just theory.
https://lnkd.in/dGFyMj6Z

🔻 Cloud Security:

CloudGoat
Deliberately vulnerable AWS environment for hands-on cloud security training.
https://lnkd.in/d-BkfrQs

flaws.cloud
Another AWS-focused challenge site.
http://flaws.cloud

Hope this helps someone out. If you've tried any of these, drop your thoughts – always curious to hear what others think.

[Bastille]

Very good list, my favorite is definitely TryHackMe, I've completed almost all easy rooms and challenges, rank around 1800 I guess, I should now go with medium rooms I think

I've tried LetsDefend, especially for their SOC alerts simulator, but I didn't find it very accurate on some cases, besides you don't use a real SIEM like Splunk or ELK, so you don't get familiar with the filters / requests and I think it's a bad habit. Instead I've set up a SOC in a homelab to get familiar with Splunk. TryHackMe has some SOC alerts simulator tho, with Splunk running, really realistic but only a couple of free rooms I guess.

Thanks for the share !

[_Bender_]

Thank you, that's a really comprehensive list. I'm working through the HackTheBox and Sherlock challenges, I find them to be a great starting point for learning cybersec.

[thecipherGo]

thankyou sir

[coocochi]

Very good list, my favorite is definitely TryHackMe, I've completed almost all easy rooms and challenges, rank around 1800 I guess, I should now go with medium rooms I think

I've tried LetsDefend, especially for their SOC alerts simulator, but I didn't find it very accurate on some cases, besides you don't use a real SIEM like Splunk or ELK, so you don't get familiar with the filters / requests and I think it's a bad habit. Instead I've set up a SOC in a homelab to get familiar with Splunk. TryHackMe has some SOC alerts simulator tho, with Splunk running, really realistic but only a couple of free rooms I guess.

Thanks for the share !

Yeah, TryHackMe is solid, rank 1800 is impressive bro, especially if you've cleared most of the easy ones. Medium rooms are definitely the next step, that's where things start getting more interesting imo. The privilege escalation ones really force you to think outside the box.
I haven't dug deep into TryHackMe's SOC rooms yet, good to know they have some with Splunk.

---

Thank you, that's a really comprehensive list. I'm working through the HackTheBox and Sherlock challenges, I find them to be a great starting point for learning cybersec.

Nice, HTB and Sherlocks are a solid combo. How are you finding the Sherlocks compared to regular boxes?

[BrainArchitect]

it seems you also forgot to mention Burpsuite is one of the best tool