If you're into offensive security, one of the best places to safely practice your craft is Vulnhub, which is a collection of virtual machines which are vulnerable by design.
What do I mean by that?
Well, their creators allowed some breaches in their security protocols. These breaches would be exploited by penetration testers, hackers, and people who are interested in cybersecurity. The ultimate purpose is to own the machine - to escalate your privileges to root or administrator, depending on the system that's to be breached.
Now, Vulnhub is not the only online repository; there are many others. However, it's the one with the most free resources that I know. And don't we just love open source and free resources? :)
As you may imagine, some machines are easier to breach, while some others are very difficult. So, there's a place for anyone.
However, if you know nothing about cybersecurity, computer networks, security and communication protocols, you might want to first begin with a course or book about networks, Linux, and penetration testing.
So, once you download one of these vulnerable virtual machines, you import them into VMWare or VirtualBox, you turn them on and you begin your attack. The go-to distribution that most folks use is Kali Linux.
I've been using the latest version of Kali and one of the virtual machines that I've breached the fastest was Stapler.
After doing a 'netdiscover' and scanning the target with nmap, I found out this machine ran a version of Samba that could be exploited via metasploit. And I not only got immediate access via this exploit, but I got root without having to work my way up to escalating my privileges.
Then, I looked at some walkthroughs for breaching this machine that have been blogged or video recorded by other users and I saw that many of them took much more time to get in and had to work to escalate privileges. The exploit I used was only publicly released late 2017 though...
Anyway, to reiterate, the purpose of breaching these machines is to fully own them (get root or administrator rights). Once you do that, you'll most often than not find a flag (text file) in the root or admin directory of the machine. That flag marks the success of your attack.
Vulnhub has probably more than 200 vulnerable by design machines and if one is able to penetrate only a tenth of those, they could be considered relatively well skilled in offensive security and penetration testing.
And these are some skills that are going to see an exploding demand in the upcoming years (and now too!!!) because basically any device connected to the internet is vulnerable and can be breached (easier or harder).
Now's the time...
To stay in touch with me, follow @cristi
Cristi Vlad Self-Experimenter and Author