Platforms (HTB, THM…)

There are platforms to practice hacking continuously and legally, from zero to expert level. Choosing the right one for your level and goal (guided learning, OSCP prep, competing) greatly speeds up progress.

The main ones

TryHackMe (THM)   guided, ideal to START; learning paths by topic
Hack The Box (HTB)  machines and Academy; beginner to expert; very realistic
HTB Academy       structured training by module (theory + practice + exam)
PortSwigger Web Security Academy  THE FREE reference for web hacking (labs + theory)
VulnHub           downloadable machines to set up in your own lab
PentesterLab      web-focused, by exercise

By goal

Start from zero    TryHackMe (guided paths) + PortSwigger (web, free)
Web in depth       PortSwigger Web Security Academy (essential, free)
Prepare OSCP       HTB (OSCP-like machines), PG Practice (Offensive Security), TJnull list
Prepare OSWE       PortSwigger + HTB web + source code
Compete            CTFtime (CTF calendar), picoCTF (to start in Jeopardy)
AD / Windows       HTB (AD machines and Pro Labs), GOAD (your own AD lab)

Recommended paths

Beginner       THM (fundamentals) -> PortSwigger (web) -> easy HTB -> HTB Academy
Toward OSCP    HTB (TJnull list) + PG Practice; practice reporting (see ctf-writeups, bb-reporte)
Specialization  pick an area (web/AD/pwn) and go deep with the platform that covers it best

Setting up your own lab

- VulnHub + VirtualBox/VMware for offline machines
- GOAD / DetectionLab to practice AD (offense and detection)
- your own vulnerable environment (DVWA, Juice Shop) for web
- ALWAYS on an isolated network; never attack systems without permission

Blue Team / learning

Choose the platform by level and goal: THM to start, PortSwigger for web, HTB for realism/OSCP.
PortSwigger Web Security Academy is free and the web reference: don’t skip it.
For the OSCP, TJnull’s HTB machine list + PG Practice is the classic path.
Set up your own lab (GOAD/VulnHub) to practice what platforms don’t cover, always isolated.

Tips and common mistakes

Start with guided platforms (TryHackMe, picoCTF) before jumping into HTB unguided.
To prep for OSCP, follow lists like TJnull’s; don’t pick boxes at random.
Common mistake: grinding only easy boxes for the point streak; seek ones that push you out of your comfort zone.

Testing checklist

Choose platform(s) by level and goal
Start with THM (guided) if you’re a beginner
PortSwigger Web Security Academy for web (free)
HTB for realism and OSCP prep (TJnull list)
CTFtime to compete; picoCTF to start in Jeopardy
Set up your own lab (GOAD/VulnHub) on an isolated network
Practice reporting/writeups (How to write writeups)