16

I've recently spotted that DVL (Damn Vulnerable Linux) has gone inactive. My first question is what happened to cause them to stop releasing it?

Secondly, I have found some references to other testing environments, but was curious if there was an official/unofficial replacement for DVL that provides a large test bed for pentesting learning?

closed as off-topic by Anders, schroeder Oct 26 '17 at 10:18

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 13
    How horrible! DVL being inactive means that there will be no more security patches for it and all users will be damn vulnerable to... wait... – Philipp Aug 14 '14 at 6:57
  • I highly recommend lab.pentestit.ru; you connect virtual labs via vpn and proceed from bottom to top on your own. – JackSparrow Oct 26 '17 at 8:15
  • Metasploitable is most likely the closest for what you are asking. It's only a VM though, which isn't great for certain needs. – bashCypher Mar 21 '18 at 15:04
10

There are stacks: Metasploitable, DVWA, BWaPP, Mutillidae, WebGOAT (although the last few are vulnerable web apps).

There is also Hack.Me, a community project where people upload vulnerable sandboxes for others to practice against.

26/10/17 Edit to add: Vulnhub is a great resource for vulnerable & practice VMs. Meant to add this ages ago, apologies.

Troy Hunt has an online vulnerable web app to test against: http://hackyourselffirst.troyhunt.com

Alternatively, you could pay for access to Muts' student network (the gang that have released Kali - Offensive Security is the thing to search for.

There's loads of them around :)

3

I'd recommend http://vulnhub.com/ as a place to start looking, as they have been building a repository for pentesting VMs for a while now.

2

Try http://www.codebashing.com/sql_demo .. they have created an interactive security war-game with integrated tutorials that walk you through a security vulnerability .. currently they support OWASP top 10 threats and are also working on a mobile security training portal.

Disclosure: I work for Codebashing as a developer

1

There's a really good list of resources which was created in 2016.

Just to pick out some vulnerable operating systems/builds:

Not the answer you're looking for? Browse other questions tagged or ask your own question.