Practise legally: CTFs and labs

The best way to learn security is to practise, but you must do it legally. This tutorial shows you where to practise safely, the rules you must follow, and walks you through your first hands-on lab: running OWASP Juice Shop on your own computer and completing your first challenges. Prerequisites: Docker Desktop (or Docker Engine) and a web browser, plus the basics from *The OWASP Top 10 explained* and *Injection attacks: SQL, command and XSS*.

Hacking is not illegal because of the technique. It is illegal because of the missing permission. Trying to get into a system you do not own, without the owner's written permission, can be a criminal offence in India (the Information Technology Act, 2000 covers unauthorised access and damage to computers) and in most countries. "I was only testing" or "I told them afterwards" is not a defence. This is general information, not legal advice.

Features, tiers and prices of platforms change, so check each site for what is free today.

A CTF (Capture The Flag) is a game where you solve security puzzles to find a hidden text string, the flag, such as flag{example}. Challenges are grouped into categories: web (flaws in web apps), crypto (broken or weak encryption), forensics (find clues in files, images and network captures), reverse engineering (understand a program without its source), pwn (memory-corruption bugs; advanced) and misc. Two formats are common: jeopardy (a board of independent challenges) and attack-defence (teams attack each other's services while defending their own).

docker run --rm -p 3000:3000 bkimminich/juice-shop

Starts Juice Shop on http://localhost:3000. --rm removes the container when it stops. Keep it bound to your own machine and do not expose it to the internet, because it is deliberately insecure.

Juice Shop tracks your progress on a hidden Score Board page listing all challenges by difficulty. Finding it is the first challenge. A good habit for every web challenge is to look at what the browser already received:

1. Open your browser's developer tools (F12) and go to the Sources or Debugger tab. 2. Look at the JavaScript files the page loaded (for example main.js). Front-end code often lists page routes. 3. Search the file (Ctrl+F) for words like score. 4. Try the route you find by typing it into the address bar after http://localhost:3000/#/.

If you get stuck, the Juice Shop community has a free companion guide called the Pwning OWASP Juice Shop book, and each challenge on the scoreboard has a hint button.

Use the scoreboard hints. For every challenge you solve, write a short note in your own words: what was the flaw, why did it exist, and how the developer should fix it. The "how to fix" part is what makes you a better developer, not just a better player.

Many CTF challenges start with decoding. Try this one. The text below is a flag hidden with Base64, an encoding (not encryption: anyone can reverse it without a key, see *Cryptography basics: hashing, encryption and TLS*).

ZmxhZ3tiYXNlNjRfaXNfbm90X2VuY3J5cHRpb259

Decode this in your terminal or with Python.

# Linux, macOS or Git Bash
echo 'ZmxhZ3tiYXNlNjRfaXNfbm90X2VuY3J5cHRpb259' | base64 -d

# Python, works everywhere
python -c "import base64; print(base64.b64decode('ZmxhZ3tiYXNlNjRfaXNfbm90X2VuY3J5cHRpb259').decode())"

Both print the flag.

This is exactly how real mistakes happen: a developer "hides" a password or token in Base64 and thinks it is secret. Anyone can decode it.

A bug bounty programme is an invitation from a company to find and report security bugs in their systems, often with rewards. Platforms such as HackerOne and Bugcrowd list programmes. It is real work with real rules: only test what the scope lists, follow the rules (no data destruction, no testing other users' accounts, no denial of service), and report privately. Beginners often get duplicates or invalid reports at first, so build skills in labs and CTFs before you start, and do not expect it to be an income.

I am practising on [platform, e.g. picoCTF]. The challenge category is [web/crypto/forensics/etc.]. I got stuck here: [describe what you tried and what you saw, without pasting anything from a live system you do not own]. Do not give me the flag. Give me one hint at a time, starting with the most general, and explain the underlying concept so I learn it.

What to expect: Using AI for hints is fine in practice labs. Check each platform's and competition's rules: live CTFs often ban outside help or AI during the event.