Burp Suite Community

CloudGoat

DVWA (Damn Vulnerable Web App)

Damn Vulnerable MCP Server (DVMCP)

GOAD-Light (Game of Active Directory)

Gandalf by Lakera

Garak (LLM vulnerability scanner)

HackerOne / Bugcrowd / Intigriti

Kali Linux + VirtualBox/ VMware

Metasploitable 2

Nessus Essentials

OWASP Juice Shop

OWASP crAPI

Ollama with a local open model

Own machine / Replit

PortSwigger Web Security Academy

PyRIT (AI red teaming toolkit)

Semgrep Community Edition

VulnHub (Kioptrix series)

Vulnerable Flask/Django app (Ostad repo)

Wazuh SIEM

ANY.RUN

Blue Team Labs Online

CyberDefenders

Hack The Box

TryHackMe

Hosted LLM API key