Sign in with Google

Learn ethical hacking: practice apps and tools

Practice on apps made to be hacked, then learn the tools security testers use every day. Only test what you own or have permission to test.

For beginners and students who want to learn security testing the legal way. Start with the practice apps, then learn one tool for each step: find, scan, exploit and analyze. Only test what you own or have permission to test.

11 picks in 6 sections · checked by an editor on Oct 30, 2026 · How we pick

01Practice2 picks

  1. OWASP Juice Shopjuice-shop/juice-shop

    Start here. A shop full of bugs, made for practice, with hints and a score board.

    Docker / self-host · MIT · active last week · ★ 14k

    86worth
  2. SecListsdanielmiessler/SecLists

    The word lists and payloads most tools and courses expect you to have.

    CLI · MIT · active yesterday · ★ 74k

    81worth

02Scan2 picks

  1. RustScanbee-san/RustScan

    Pick this to find open ports fast, then hand them to Nmap.

    Docker / self-host · CLI · GPL-3.0 · active 4 weeks ago · ★ 21k

    63worth
  2. ffufffuf/ffuf

    Pick this to find hidden pages and parameters on a web app.

    CLI · MIT · active last month · ★ 17k

    70worth

03Exploit2 picks

  1. sqlmapsqlmapproject/sqlmap

    Pick this to learn how SQL injection is found and proven.

    CLI · Custom (read before use) · active yesterday · ★ 39k

    69worth
  2. Metasploit Frameworkrapid7/metasploit-framework

    The classic framework for exploits, used in most courses and exams.

    CLI · Custom (read before use) · active 24 hours ago · ★ 39k

    71worth

04OSINT1 pick

  1. sherlocksherlock-project/sherlock

    Pick this to see how much one username reveals across sites.

    Docker / self-host · CLI · MIT · active last month · ★ 95k

    85worth

05Analyze1 pick

  1. CyberChefgchq/CyberChef

    Decode, decrypt and convert data in the browser. Every CTF uses it.

    Web · Apache-2.0 · active 3 days ago · ★ 36k

    85worth

06Reverse engineering3 picks

  1. GhidraNationalSecurityAgency/ghidra

    Pick this to read compiled programs. Free and as strong as paid tools.

    Desktop · Apache-2.0 · active yesterday · ★ 96k

    92worth
  2. ImHexWerWolv/ImHex

    Pick this to look inside binary files with patterns and colors.

    Desktop · GPL-2.0 · active 3 weeks ago · ★ 56k

    79worth
  3. JADXskylot/jadx

    Pick this to read the code of Android apps.

    Desktop · CLI · Apache-2.0 · active yesterday · ★ 51k

    77worth

More in Security

Protect your server and your code

Scan for weak spots, block attacks and keep secrets out of Git, on a home server or a small company stack.Inside: Trivy, Gitleaks, gosec + 5 more8 picks · 4 sections

Passwords, 2FA and privacy for everyone

Open-source password managers, 2FA apps and privacy tools that one person can set up in an afternoon.Inside: KeePassXC, KeePassDX, Bitwarden + 6 more9 picks · 3 sections

Test the security of AI apps and agents

Red-team your chatbot, scan an LLM for weak spots, or let an AI agent pentest your own app.Inside: promptfoo, garak, iFixAi + 5 more8 picks · 3 sections

Other groups

See every project in this category on Explore →Missing a project? Suggest it →

How we pick

An editor picks 6 to 12 projects for one job and writes when to choose each one. Every pick had a commit in the last 6 months. It is not archived. Its worth score is 60 or more. An editor breaks a rule only for a reason, and writes that reason in the pick's note. We check every list again each quarter. A pick goes when it breaks a rule or a clearly better project appears.