# Best Websites for Learning Web Security **URL:** \ **Category:** General\ **Created:** [May 25, 2019, 12:19pm UTC](https://forum.freecodecamp.org/t/best-websites-for-learning-web-security/279588 "2019-05-25T12:19:47Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![RobbeD](https://avatars.discourse-cdn.com/v4/letter/r/edb3f5/32.png) [@RobbeD](https://forum.freecodecamp.org/u/RobbeD)\ **Post date:** [May 25, 2019, 12:19pm UTC](https://forum.freecodecamp.org/t/best-websites-for-learning-web-security/279588/1 "2019-05-25T12:19:47Z")
Hi, I am a 15 year old student who has been programming for 2 years now. I have recently taken an interest in Web Security/White-Hat Hacking. Does anyone know any websites that are good at teaching beginner -\> Intermediate level Web Security? I would prefer it if they were free as I do not have that much expendable income being a student. Many Thanks, Rob ---
**Author:** ![RobbeD](https://avatars.discourse-cdn.com/v4/letter/r/edb3f5/32.png) [@RobbeD](https://forum.freecodecamp.org/u/RobbeD)\ **Post date:** [May 25, 2019, 1:15pm UTC](https://forum.freecodecamp.org/t/best-websites-for-learning-web-security/279588/2 "2019-05-25T13:15:47Z")
am i allowed to bump this? ---
**Author:** ![username1001](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/username1001/32/72268_2.png) [@username1001](https://forum.freecodecamp.org/u/username1001)\ **Post date:** [November 6, 2019, 12:28am UTC](https://forum.freecodecamp.org/t/best-websites-for-learning-web-security/279588/3 "2019-11-06T00:28:08Z")
While this doesn’t directly _teach_ you by giving you instructions, it gives you the hands on experience you’ll need, best to use to attack while you follow along some other tutorial(s), of which I’ll list below. Anyway, it is called Juice Shop: [https://github.com/bkimminich/juice-shop](https://github.com/bkimminich/juice-shop) Juice Shop is a web application built with modern technologies. A lot of the vulnerabilities are frequently found in real-world apps, which makes Juice Shop so good - it is essentially a real-world app. Now, with Juice Shop installed, you want to attack it. You might follow along the videos and CTFs created by HackerOne (a bug bounty platform): [https://www.hackerone.com/hacker101](https://www.hackerone.com/hacker101) to get a feel for things. The book considered to be the holy grail of web application security is _The Web Application Hacker’s Handbook_. It’s a little old, but is still super useful. You might also find _The Tangled Web_ a to be useful. Some additional resources: [https://www.owasp.org/index.php/Main\_Page](https://www.owasp.org/index.php/Main_Page) [https://pentesterlab.com/](https://pentesterlab.com/) (Offers free, but is mostly premium $19.99/month) Also, an extremely useful tool to have is Burp Suite: [https://portswigger.net/burp](https://portswigger.net/burp) (created by the coauthor of the Web Application Hacker’s Handbook). OWASP also has ZAP: [https://www.owasp.org/index.php/OWASP\_Zed\_Attack\_Proxy\_Project](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project). Anyway, a glimpse threw the Web Application Hacker’s Handbook will provide a solid understanding into attacking web applications, it is invaluable. I hope this provides enough for you to dig into. However, I apologize that it isn’t in a much better order. ---
**Author:** ![JacksonBates](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/jacksonbates/32/123402_2.png) [@JacksonBates](https://forum.freecodecamp.org/u/JacksonBates)\ **Post date:** [November 6, 2019, 8:19am UTC](https://forum.freecodecamp.org/t/best-websites-for-learning-web-security/279588/4 "2019-11-06T08:19:49Z")
This is a bit of a necropost, and the OP hasn’t logged in for months… But I love the topic! I had a lot of fun playing with [https://www.hackthissite.org/](https://www.hackthissite.org/) It appears to be currently down for maintenance, so hopefully it’s not completely offline now. It’s not the best way to get into real pentesting etc, but it is a lot of fun! ---
**Author:** ![username1001](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/username1001/32/72268_2.png) [@username1001](https://forum.freecodecamp.org/u/username1001)\ **Post date:** [November 6, 2019, 11:10am UTC](https://forum.freecodecamp.org/t/best-websites-for-learning-web-security/279588/5 "2019-11-06T11:10:26Z")
Yeah, I thought the OP was new until I read the date. Guess it’s new in the new category. 😉 Love HTS. It originally got me interested in the web. > It’s not the best way to get into real pentesting It can be, though - they give you full permission to attack their website. 😃 ---
**Author:** ![ILM](https://sea3.discourse-cdn.com/freecodecamp/user_avatar/forum.freecodecamp.org/ilm/32/363239_2.png) [@ILM](https://forum.freecodecamp.org/u/ILM)\ **Post date:** [January 16, 2021, 2:46pm UTC](https://forum.freecodecamp.org/t/best-websites-for-learning-web-security/279588/6 "2021-01-16T14:46:04Z")
Closed on January 16, 2021, 2:46pm UTC