The following is a collection of vulnerable servers (VMs) or websites that you can use to practice your skills (sorted alphabetically).
- bWAPP : https://sourceforge.net/projects/bwapp/files/bWAPP
- Damn Vulnerable ARM Router (DVAR): http://blog.exploitlab.net/2018/01/dvar-damn-vulnerable-arm-router.html
- Damn Vulnerable iOS Application (DVIA): http://damnvulnerableiosapp.com
- Damn Vulnerable Web App (DVWA): https://github.com/ethicalhack3r/DVWA
- DOMXSS: http://www.domxss.com/domxss/
- Game of Hacks: http://www.gameofhacks.com
- Gruyere: https://google-gruyere.appspot.com
- Hack This Site: https://www.hackthissite.org
- Hack This: https://www.hackthis.co.uk
- Hackazon : https://github.com/rapid7/hackazon
- HellBound Hackers: https://www.hellboundhackers.org
- Metasploitable2 : https://community.rapid7.com/docs/DOC-1875
- Metasploitable3 : https://blog.rapid7.com/2016/11/15/test-your-might-with-the-shiny-new-metasploitable3/
- Over The Wire Wargames: http://overthewire.org/wargames
- OWASP Juice Shop : https://www.owasp.org/index.php/OWASP_Juice_Shop_Project
- OWASP Mutillidae II: https://sourceforge.net/projects/mutillidae
- Peruggia: https://sourceforge.net/projects/peruggia
- RootMe: https://www.root-me.org
- Samurai Web Testing Framework: http://www.samurai-wtf.org/
- Try2Hack: http://www.try2hack.nl
- Vicnum: http://vicnum.ciphertechs.com
- VulnHub:https://www.vulnhub.com
- Web Security Dojo: https://www.mavensecurity.com/resources/web-security-dojo
- WebSploit (maintained by Omar Santos): https://websploit.h4cker.org
- WebGoat: https://github.com/WebGoat/WebGoat