Training Lab
Public practice targets for web security — free, isolated, reset daily.
- ModernAmusement Development
- Shady Nathan Tawfik
- Full-Stack · Data Science · ML/AI · Cybersecurity · Design · Open Source
Rules
This lab is intentionally vulnerable. Play fair so it stays online for everyone:
- Only attack the three targets below — never systems outside the lab
- No DoS, no flooding, no brute-force at scale
- No illegal content uploads (reviews, guestbook, file uploads)
- The lab resets every night — progress is temporary
- Access is logged; abuse means a ban
- Found a clever exploit? Great — that is the point
Targets
Three independent environments, each in its own isolated network. Pick one and start.
OWASP Juice Shop — Modern web shop with 100+ challenges across the OWASP Top 10. Your score grows with every puzzle you solve — from DOM XSS to broken authentication.
WebGoat — Guided lessons with explanations: injection, authentication, access control and CSRF. Work through the hints and compare with the reference solutions.
DVWA — Damn Vulnerable Web Application — every vulnerability on three difficulty levels. Exploit it on low, then read the source why medium and high are harder.
Learning path
A route that works from zero to solid web-security fundamentals:
| # | Station | Focus |
|---|---|---|
| 1 | Juice Shop | Find the score board, then the first challenges along the OWASP Top 10 |
| 2 | DVWA — low | Exploit SQL injection, XSS, LFI and CSRF yourself |
| 3 | DVWA — medium/high | Same bugs, now with filters — read the source why the fix matters |
| 4 | WebGoat | Work through the guided lessons: injection, auth, access control |
| 5 | Your tools | Burp, ZAP, sqlmap against the targets — analyse requests and responses |
| 6 | Hardening | Write fixes for each bug you exploited — input validation, prepared statements, CSP |
Access & reset
| Targets | Access |
|---|---|
juice.lab.modern-amusement.dev | Register yourself |
webgoat.lab.modern-amusement.dev | WebGoat / WebGoat |
dvwa.lab.modern-amusement.dev | admin / password |