Build the lab.
Practice the trade.
A curated index of attack distributions, vulnerable targets, analysis tools, and reference material for offensive security practice.
21 tools / 8 categories
Kali Linux Installer
The industry standard penetration testing distribution. Clean ISOs for installing on bare metal or creating fresh VMs.
Kali Pre-built VMs
Get started instantly with configured virtual machines. Optimized for VirtualBox and VMware. Default credentials: kali/kali.
Windows Environment
ISOs for setting up Windows-based target machines, Active Directory labs, or malware analysis workstations.
Metasploitable 2
An intentionally vulnerable Linux virtual machine. The classic starting point for practicing network scanning and exploitation.
Metasploitable 3
The next generation of the intentionally vulnerable VM framework, with Windows and Linux targets and full exploit chains for realistic lab practice.
OWASP Juice Shop
Probably the most modern and sophisticated insecure web application. Perfect for practicing OWASP Top 10 vulnerabilities.
Oracle VirtualBox
A powerful, free, and open-source hosted hypervisor for x86 virtualization, allowing you to run multiple operating systems.
Burp Suite Community
The essential toolkit for web application security testing. Intercept, analyze, and modify web traffic between your browser and target.
Wireshark
The world’s foremost network protocol analyzer. Essential for deep-dive inspection of traffic within your virtual lab network.
Nessus Vulnerability Scanner
A widely used, proprietary vulnerability scanner developed by Tenable for auditing systems for security weaknesses.
Zenmap (Nmap GUI)
The official cross-platform GUI for the Nmap Security Scanner, making network discovery and security auditing easy.
Netcat for Windows
A versatile networking utility for reading from and writing to network connections using TCP or UDP.
Autopsy Digital Forensics
A powerful forensics tool to recover deleted files, analyze internet history, and reconstruct timelines of user activity.
XAMPP Server
An easy to install Apache distribution containing MariaDB, PHP, and Perl. Perfect for local web development.
7-Zip
A free and open-source file archiver with a high compression ratio. It supports its own 7z format as well as ZIP, RAR, and other popular formats.
Notepad++
A free and powerful source code editor and Notepad replacement that supports several languages for Windows.
Microsoft Visual C++ Redistributable
Permalink for the latest supported x64 version. Contains both ARM64 and X64 binaries required by many applications.
MITRE ATT&CK
A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.
WAF Guide
Web Application Firewall (WAF) is one of the security measures to protect web applications from the attacks that try to exploit the vulnerabilities in web applications.
Nmap Cheat Sheet
A quick reference guide that lists commonly used Nmap commands for various scanning and enumeration tasks.
DVWA Cheat Sheet
A guide for the Damn Vulnerable Web Application, designed to help practice web security skills in a legal environment.
Hashcat Lab Material
Resources for practicing with Hashcat, a powerful open-source password recovery and cracking tool.