19

I've recently spotted that DVL (Damn Vulnerable Linux) has gone inactive. My first question is what happened to cause them to stop releasing it?

Secondly, I have found some references to other testing environments, but was curious if there was an official/unofficial replacement for DVL that provides a large test bed for pentesting learning?

Insecure
  • 289
  • 1
  • 2
  • 4
  • 14
    How horrible! DVL being inactive means that there will be no more security patches for it and all users will be damn vulnerable to... wait... – Philipp Aug 14 '14 at 06:57
  • I highly recommend https://lab.pentestit.ru/; you connect virtual labs via vpn and proceed from bottom to top on your own. – JackSparrow Oct 26 '17 at 08:15
  • Metasploitable is most likely the closest for what you are asking. It's only a VM though, which isn't great for certain needs. – bashCypher Mar 21 '18 at 15:04

4 Answers4

11

There are stacks: Metasploitable, DVWA, BWaPP, Mutillidae, WebGOAT (although the last few are vulnerable web apps).

There is also Hack.Me, a community project where people upload vulnerable sandboxes for others to practice against.

26/10/17 Edit to add: Vulnhub is a great resource for vulnerable & practice VMs. Meant to add this ages ago, apologies.

Troy Hunt has an online vulnerable web app to test against: http://hackyourselffirst.troyhunt.com

Alternatively, you could pay for access to Muts' student network (the gang that have released Kali - Offensive Security is the thing to search for.

There's loads of them around :)

3

I'd recommend http://vulnhub.com/ as a place to start looking, as they have been building a repository for pentesting VMs for a while now.

Ryan Gooler
  • 759
  • 4
  • 9
2

Try http://www.codebashing.com/sql_demo .. they have created an interactive security war-game with integrated tutorials that walk you through a security vulnerability .. currently they support OWASP top 10 threats and are also working on a mobile security training portal.

Disclosure: I work for Codebashing as a developer

mgjk
  • 7,535
  • 2
  • 20
  • 34
Toby
  • 61
  • 1
1

There's a really good list of resources which was created in 2016.

Just to pick out some vulnerable operating systems/builds:

Joe
  • 2,734
  • 2
  • 12
  • 22