Every lab, one search box.
Type a bug class, a technique or a target name. Each topic opens with a short lesson from The XSS Rat on how that bug actually works and how he attacks it — then the labs where you go and do it yourself. Free, no account, nothing to install.
Keep learning
The labs are the practice. This is the theory, the walkthroughs and the references that go with them — mine first, then the free material I send people to when they ask where to read more.
From The XSS Rat
Same person who built these labs.
- Medium blog Write-ups, methodology and the thinking behind the bugs — the long form version of the lessons above.
- YouTube channel Live hunting, lab walkthroughs and bug class explainers.
- Courses Structured guides per bug class, plus the certification prep tracks.
- Endless Bundle Everything current and future in one place.
- Linktree Every channel, including LinkedIn and X.
Free reference material
Not mine. Still what I open daily.
- PortSwigger Web Security Academy The best free theory on the web, with its own labs per class.
- HackTricks Technique dump for when you know the class and need the trick.
- PayloadsAllTheThings Payloads and bypasses per bug class, kept current.
- OWASP Cheat Sheet Series The defender's view. Read it to know what a correct fix looks like.
- OWASP Testing Guide (WSTG) A checklist for a whole application, when you do not know where to start.
- OWASP API Security Top 10 What breaks when there is no front end enforcing the rules.
Practise the mechanics
Tools on this site, free, nothing to install.
- Regex Trainer Cheat sheet, live builder with a token-by-token explainer, graded exercises, ReDoS playground.
- Guess the Command Drill the command line you will be living in.
- hackQuiz Quiz yourself on the theory before you go hunting.
- SubScraper Subdomain enumeration workflow, start to finish.
- Google Dork Generator Build dorks without memorising the operators.
- News Feeds Security news in one page.
Prove it
When the practice should start counting for something.
- Exam practice environments CWAP, CAPIE and OSCP-style targets, plus the certificate portal.
- RatCTF Capture the flag, same hands, scored.
- Rat Site Over 40 bugs in one application and nobody telling you the class.
- Security incidents How we run and report on our own services. Read it as a model for a report.