Security skills should be built inside operator-sanctioned labs, not on live services — that's where the learning actually sticks.
To learn hacking legally, start in a lab whose operator has explicitly allowed attacks. What confuses beginners most is not which tool to use but how far they may go, and if you test on a real service or a friend's device without knowing that line, saying you were just learning will not help. This list gathers eight places offering deliberately vulnerable environments, CTFs, and defensive analysis training.
The order weighs how easy each one is to start with and how broad its coverage is. If you want a systematic grounding in web vulnerabilities, begin at rank 1; if networking and operating system basics are weak, try ranks 2 and 5; if Korean is easier for you, open rank 6 first. If defense and log analysis appeal more than attacking, rank 7 is the fit.
Selection criteria
- The operator clearly defines the targets and scope
- You can begin with just a browser or the provided environment
- It offers stepwise paths or difficulty levels
- It covers defense or Korean regulations as well
PortSwigger Web Security Academy
TryHackMe
Hack The Box Academy
picoCTF
OverTheWire Wargames
Dreamhack
CyberDefenders
KISA Academy
How to choose
If you only want web security, pick rank 1; for networking and Linux step by step, ranks 2 and 5; for deep role-based paths, rank 3. To sample challenges and find your aptitude, rank 4 is easy, and rank 6 is comfortable for starting in Korean. For defense and monitoring, go with rank 7, and for Korean regulations and training programs, rank 8.
Whichever you choose, compare three things: whether the lab scope is documented, how much works for free, and whether there is material to review after solving. Writing a line or two on why something was vulnerable and how to block it keeps the skill lasting. Information reflects the research date and may change, so confirm on the official channel before signing up or applying.
Frequently asked questions
Where should a complete beginner start?
Start somewhere with browser-based labs and clear guidance. PortSwigger Web Security Academy is a common pick for web security, while TryHackMe is often recommended for broad fundamentals.
Can I try what I learned on another website?
No. Going beyond the target and account scope a platform provides becomes unauthorized access, whether the target is a live system or a friend's device. If you are curious about a specific service, check its official disclosure or bug bounty policy first.
Are there Korean-language options?
Yes. Dreamhack offers Korean-language lectures alongside wargames and CTFs, and KISA Academy covers domestic regulations and training programs. Check the official page for the free range and difficulty before signing up.
Which one is right if I want to learn defense instead of attack?
CyberDefenders offers blue-team practice analyzing logs, memory, and network data. It trains you to trace how a breach happened, so it suits people interested in monitoring or incident response.
My Linux commands are weak. What should I practice with?
OverTheWire Wargames teaches the command line and Linux basics level by level. TryHackMe's introductory rooms also walk through networking and operating systems step by step.
I have never done a CTF. Will it be too hard?
picoCTF targets students and beginners with short, bite-sized challenges, so the burden is light. Read the competition rules and account policy before you begin.
Get new lists before anyone else
Once a week — only the new lists worth your time.
No spam · unsubscribe in one click
You may also like
Someone Asked You to Carry Their Bag Home: Here's Why You Should Say No
Never carry luggage you haven't packed and checked yourself, whoever asks; if things get complicated, the Consular Call Center and 112 are the first calls.
Looking for Drug Prevention Education in Korea? Check Who Runs It First
Match the program to your age group and setting, and verify the operating institution and its official domain before you sign up.
A Wi-Fi Password Alone Doesn't Make Your Home Network Safe
Router security isn't one Wi-Fi password — it's eight steps, from the admin account to the firmware version, done in order.
Worried About a Family Member's Drug Use? Connect Before You Confront
If you're worried about a family member's drug use, connecting them to official counseling and treatment comes before confronting them directly.