Security skills should be built inside operator-sanctioned labs, not on live services โ that's where the learning actually sticks.
Learning security starts with knowing where you're allowed to practice, not with tool syntax. Golladream picked only labs and CTF platforms deliberately built to be vulnerable by their operators, where attack practice is fully legal. Trying the same techniques against a real service or someone else's device is never justified without explicit permission, no matter how curious you are.
Use each platform strictly within the target and account scope it provides. If you're new, follow one track through to the end rather than jumping between topics, and after each challenge, jot down not just the answer but why the flaw existed and how it's fixed โ that habit is what actually builds skill.
PortSwigger Web Security Academy
TryHackMe
Hack The Box Academy
picoCTF
OverTheWire Wargames
Dreamhack
CyberDefenders
KISA Academy
Frequently asked questions
Where should a complete beginner start?
Start somewhere with browser-based labs and clear guidance. PortSwigger Web Security Academy is a common pick for web security, while TryHackMe is often recommended for broad fundamentals.
Can I try what I learned on another website?
No. The moment you go beyond the target and account scope a platform provides, it becomes unauthorized access โ whether the target is a live system or a friend's device. If you're curious about a specific service, check its official vulnerability disclosure or bug bounty policy first.
Are there Korean-language options?
Yes. Dreamhack offers Korean-language lectures alongside wargames and CTFs, and KISA Academy covers domestic regulations and training programs. Check the official page before signing up for the current free tier and difficulty levels.
Get new lists before anyone else
Once a week โ only the new lists worth your time.
No spam ยท unsubscribe in one click
