More free Pentesting resources

While I wrote the articles about how to start a pentesting career I came accross more great resources that I did not mention before, so here they are. Most of it is hands-on :).

The Complete Beginner Network Penetration Testing Course for 2019

CTP/OSCE Prep – Wrapping Up Our Prep
Article with OSCE resources.
https://h0mbre.github.io/CTP_Summary/#

Web Application Exploits and Defenses
Online Webapp hacking.
https://google-gruyere.appspot.com/

XSS challenges
Online XSS challenges.
http://xss-quiz.int21h.jp/

XXE Lab
XXE Lab for downloading and hacking.
https://github.com/jbarone/xxelab

Root Me
Hacking challenges online.
https://www.root-me.org/

Cryptopals
Crypto hacking CTF.
https://cryptopals.com/

RingZer0 CTF
https://ringzer0ctf.com/challenges

Damn Vulnerable Web Application (DVWA)
Vulnerable weeb hacking VM (download).
http://www.dvwa.co.uk/

Pentesterlab
List of the free Webapp hacking excercises.
https://pentesterlab.com/exercises?dir=desc&only=free&sort=published_at

Link List with more CTFs and excercises
https://wheresmykeyboard.com/2016/07/hacking-sites-ctfs-wargames-practice-hacking-skills/

Kali Training
https://kali.training/

Vulnhub
Loads of challenges and VMs (downloads).
https://www.vulnhub.com/

Review Portswigger Web Security Academy

Link: Web Security Academy
Content: Teaches the basics of Web Application Security, so far SQL Injection, XSS, OS command injection and File Path traversal. Comes with small labs.
Career: Penetration Tester but I recommend it also for everyone interested in security
Level: Beginner
Price: Free

Web Security Academy

The description from the originial website:
Welcome to the Web Security Academy. This is a brand new learning resource providing free training on web security vulnerabilities, techniques for finding and exploiting bugs, and defensive measures for avoiding them.
The Web Security Academy contains high-quality learning materials, interactive vulnerability labs, and video tutorials. You can learn at your own pace, wherever and whenever suits you. Best of all, everything is free!

For tracking and doing the labs you need to create an accout.

I found the explanations and the labs very suitable for beginners and I think it is a great starting point for web application security.

The team behind it is the same that is behind the Burpsuite and the famous Web Application Hackers Handbook (consider buying it if you want to go deeper into the topic):

The Web Application Hackers Handbook
Authors: Daffy Stuttard, Marcus Pinto
Content: The standard book about hacking Web Applications, goes into depth about the most important topics. Authors also created the BurpSuit.
Career: Penetration Tester
Level: Good for beginners, but also useful for experienced penetration testers
Buy at Amazon U.S.
Buy at Amazon Germany