Build a hacking lab on your own PC
Before you can learn to attack anything, you need something you are allowed to attack. In this mission you stand up a safe, isolated practice lab on your own machine: Docker running, a private network the lab lives on, and OWASP Juice Shop (a web app built on purpose to be broken into) waiting at 127.0.0.1. Nothing is online, nothing points at anyone else, and one command wipes it back to clean. This is the foundation for the whole ethical-hacking track.
- Windows 11 (64-bit). Docker Desktop also runs on macOS and Linux, and the commands are nearly identical. Written for Windows 11
- About 4GB of free disk space (Docker Desktop, plus the 511MB Juice Shop image and a little room to work)
- A terminal: Windows PowerShell, which is already on your PC. If the terminal is new to you, the Level 0 lesson Install anything from GitHub covers the basics first
- Virtualisation enabled in your PC's firmware (it almost always is already). Step 2 shows how to check in ten seconds
The rules: what you may and may not hack
Learn the one line that keeps this legal before you install anything, so you never cross it by accident.
Learning to attack software is a genuine, well-paid skill. Companies pay people to break into their own systems on purpose, to find the holes before criminals do. That job has a name, penetration testing, and it has one hard rule underneath it.
You may only test systems you own, or that the owner has given you permission in writing to test. That is the whole line. On one side is lawful security research. On the other side is a computer-misuse offence, and in the UK (the Computer Misuse Act 1990) and almost everywhere else, that is a crime even if you never cause any damage and even if you were only looking.
So how does anyone practise? With software that was built to be attacked. A deliberately vulnerable app is a real web application whose makers left the security holes in on purpose and published it so that learners can break into it legally. OWASP Juice Shop (the one we use here) is the best known. DVWA, WebGoat and the hosted CTF ("capture the flag") sites like Hack The Box and TryHackMe exist for the same reason. Attacking those is not only allowed, it is the point of them.
That is why we build a lab. Everything in this track happens on your own PC, against an app that wants you to attack it, on a private network that cannot reach your real devices. You never point any of this at a website, a company, a friend's computer or anything else you do not own.
CarefulRunning these techniques against any system you do not own or have explicit written permission to test is illegal, whatever your intention. Practise only on the vulnerable apps in this track, on your own machines, or on the CTF platforms that invite it. Never on a real website, a shop, an employer, a router that is not yours, or anyone else's account.TipA simple test for the rest of this track: before you run any tool against anything, ask "do I own this, or do I have written permission?". If the answer is not a clear yes, the answer is no.