I've recently spotted that DVL (Damn Vulnerable Linux) has gone inactive. My first question is what happened to cause them to stop releasing it?

Secondly, I have found some references to other testing environments, but was curious if there was an official/unofficial replacement for DVL that provides a large test bed for pentesting learning?

  • 14
    How horrible! DVL being inactive means that there will be no more security patches for it and all users will be damn vulnerable to... wait...
    – Philipp
    Commented Aug 14, 2014 at 6:57
  • I highly recommend lab.pentestit.ru; you connect virtual labs via vpn and proceed from bottom to top on your own. Commented Oct 26, 2017 at 8:15
  • Metasploitable is most likely the closest for what you are asking. It's only a VM though, which isn't great for certain needs.
    – bashCypher
    Commented Mar 21, 2018 at 15:04

4 Answers 4


There are stacks: Metasploitable, DVWA, BWaPP, Mutillidae, WebGOAT (although the last few are vulnerable web apps).

There is also Hack.Me, a community project where people upload vulnerable sandboxes for others to practice against.

26/10/17 Edit to add: Vulnhub is a great resource for vulnerable & practice VMs. Meant to add this ages ago, apologies.

Troy Hunt has an online vulnerable web app to test against: http://hackyourselffirst.troyhunt.com

Alternatively, you could pay for access to Muts' student network (the gang that have released Kali - Offensive Security is the thing to search for.

There's loads of them around :)


I'd recommend http://vulnhub.com/ as a place to start looking, as they have been building a repository for pentesting VMs for a while now.


Try http://www.codebashing.com/sql_demo .. they have created an interactive security war-game with integrated tutorials that walk you through a security vulnerability .. currently they support OWASP top 10 threats and are also working on a mobile security training portal.

Disclosure: I work for Codebashing as a developer


There's a really good list of resources which was created in 2016.

Just to pick out some vulnerable operating systems/builds:

Not the answer you're looking for? Browse other questions tagged .