My friends have expressed an interest in hacking, but we don't want to do anything illegal, and considered CTF365, but it was WAY to expensive. Is it possible/legal for one of us to create a private website for us to hack, or play attack/defend with two websites of our own?
To the best of my knowledge, yes, it's legal. Every anti-hacking law I'm aware of refers to unauthorized access, and if you've got permission to hack it, it's not unauthorized, is it?
Note that there are some things you'll need to watch out for. Some jurisdictions prohibit the possession of "hacking tools" (akin to prohibiting possession of lockpicks, but less well-defined), and some techniques, such as packet spoofing or (D)DoS, can have collateral damage that would fall afoul of the law.
You'll also want to check your webhost's opinion of what you're doing. They may not permit this because of possible effects on other customers; if you're hosting the website on your home connection, you might be violating your ISP's terms of service.
If you want to be completely safe, do this on a dedicated network that is isolated from the Internet entirely. A cheap Ethernet switch and a Raspberry Pi or two can get you a setup you can play with for under $100.
As Mark states, it more or less has to be legal to do this, since it's effectively authorized access, although perhaps by unconventional routes.
Also consider the many hacking contests where the prize is the hacked machine (or whatever). Some (if not many) of these contests are not on a private network, but are conducted over the public Internet. Search for "pwn to own" and similar "leetspellings" of that phrase, and I'm sure you'll find sites for such events -- and their terms and conditions ought to be of interest to you.
Here in Denmark, Henrik Kramshøj is quite an authority on all things related to IT (and especially network) security, and he frequently states that one may (attempt to!) hack his website as long as he's notified in advance. And that's over the public Internet, although in this case, he actually owns his Internet provider, so that's less of a risk factor.
Have a look at Rory's answer to a similar question, which includes a link to a list of hacker-welcome sites.
First of all: No one can answer this question because we don't know what country you are talking about. Even if we would know we are not lawyers and can not answer this. I guess in most countries the legal situation about this would not be clear anyway. It would probably be in a grey area.
In reality it does not matter if is legal because your server will get hacked and your hoster/ISP will take it offline anyway.
Make the system non public (VPN or similar) and you will have no problems.
In a nutshell, regardless of what country you are in, 'Hacking' is defined as unauthorised access to a system. You are not necessarily 'hacking' so much as 'testing a system for vulnerability'
You need to be a little more lateral in your thinking. To practice hacking on a web site, you don't need a public web site - in fact, you don't want a public web site because once it is public, you no longer have control over who can try to hack it. I would also suggest, without wanting to be rude, that based on your question, you and your friends are unlikely to have the skills necessary to setup a public web site in such a way to allow hacking, but control/manage who can hack it.
The big problem with a public web site for hacking is that not many hosting organisations will be willing to do this. For them, it is too high a risk as anyone who can successfully hack the site could very well end up getting sufficient access to be a threat to the other customaers/sites they are hosting. Most hosting companies will have the sites they host build on top of their own infrastructure, which is designed to make their job of hosting as easy as possible and there is no guarantee that a successful hack won't be at the level of their infrastructure i.e. your exposing them to the hacking, not just your site. This doesn't mean you won't find a hosting company who would be willing to allow this as it could be viewed as a type of pen test for them, but it is unlikely.
The best solution is to setup a site using a VM. Even if your not all on the same local network, you can have each person run their own VM. You could use one of the many 'hacking' VMs which have been designed specifically for this sort of thing, or you could role your own, create a snapshot and then give a snapshot to each person to run. This will then allow everyone to hack away on their own site without interferring with each other.
Often when your trying to hack things, you can do things which either make the site/host unstable or even render it unable to run. When learning how to hack, you regularly need to restore everything to a known state so that you can confirm that a successful hack works and you fully understand how it works. Once you think you have found a 'recipe' which works, you can restore your VM to a known state and attempt to repeat the process. If you succeed, then you hve more confidence you know exactly how to do it. On the other hand, if you fail, then you know that your recipe is missing something - probably a side effect caused by a previous attempt.
The other benefit of using the VM approach is that you avoid any possible legal issues. Your doing it all on a private host and in an environment you control. It is also relatively cheap to do. All you need is a PC with sufficient memory to run one or more virtual box or vmware images. I use a Linux box running virtuabox with 16Gb of RAM. I can run multiple VMs at once - simulating a netowrk etc.
For an idea of how you can do this, see Set up your Pen Testing/Hacking Lab Network using a Single System.
In most website hostings, the part that is "your website" is very thin, and there is not much to hack except php/asp input sanitization. The bigger, hackable part is not actually yours - it is provider's infrastructure shared among your website and many others.
You need to consider this: unless you run the website on your own computer, your friends are not hacking your website. They're hacking hosting provider's computers.
This is one of the reason why CTF has to be expensive: one needs to dedicate up-to-date set of commercial infrastructure to create a playground that accurately represents commercial environment - without compromising an actual commercial environment.
You should set up a dedicated computer for this task, possibly in local network and inaccessible from the internet. It has it's benefits: no one will ever know it was hacked, except you and your friends.
Is it legal? In most jurisdictions, yes, but read up on local law first. A few answers above highlight jurisdictions where hacking is illegal even when authorized, but for the most part, the kinds of exercises you're talking about are authorized, since the owner of the machine is setting it up this way deliberately and expressly for the purpose of security testing.
Is it a good idea? Only if you are very careful. Remember that if you can hack it, so can someone else. Keep the vulnerable machines well away from the open Internet: this means you'll need to get at the machines through a LAN or VPN, but this is still better than having it get hijacked by someone or something you didn't expect.