Because penetration testing and hacking is best learned by just doing it, I decided to find a way of practicing various techniques.
Of course, I could be hacking just some website, but this has some disadvantages. ( You could call being arrested and put in jail a disadvantage
)
So I decided to google for someone who had created a webpage that was created with the intention of being hacked. So, I found www.hackthissite.org.
After registration in the left menu several mission categories are presented, of which I have mastered the “basics” and currently busy with the “Realistic”. Especially the “realistic” missions give you a real rush if you have completed the mission. My current favourite mission was breaking into the website of bank and transfer money to a different account. Although the missions are quite realistic, the one with the bank is in a way unrealistic and realistic at the same time. It is realistic because of the mission ( transfer money to another account ) but banks now-a-days have much better protection that this one. For example, SSL is not used, no token based authentication, even clear text cookies and md5 password hashes are shown in HTML… But hey, if they had used ( or not at )all of these techniques it probably would not have been hackable
I can really recommend this site if you want to learn more about hacking websites.