EMZETT.
Login

Emzett Wiki

CTF and legal practice platforms: learning to hack without committing a crime

Properties1
tagsglossar, it-sicherheit, lernen

3 min read

CTF and legal practice platforms: learning to hack without committing a crime

In short: Capture-the-flag competitions and practice platforms such as TryHackMe, Hack The Box or PortSwigger Academy allow legal practice of IT security in environments built for it.

In more detail: Whoever understands security protects better. But you may practise only on your own or explicitly authorised systems. In Germany spying out and intercepting data (§ 202a, 202b StGB) and preparing such acts (§ 202c, the “hacker paragraph”) are punishable; the limits are important for learners.

In Depth

What is CTF?

Capture the flag: tasks (challenges) where you find flags (text strings like flag{...}). Categories: web (SQLi, XSS, logic flaws), crypto (weak encryption), pwn/binary exploitation (memory errors), reverse engineering, forensics (captures, files), misc/OSINT/steganography. Formats: Jeopardy (task list with points) and attack-defence (teams defend and attack). Organisers: universities, companies, CTFtime.org lists dates; for teenagers e.g. Cyber Security Challenge Germany, picoCTF (beginners).

Platforms and labs

  • TryHackMe: guided “rooms”, ideal for beginners (browser terminal/VPN).
  • Hack The Box (HTB) & HTB Academy: machines, challenges, training.
  • PortSwigger Web Security Academy: free, excellent for web security (Burp Suite).
  • OverTheWire (Bandit): Linux/shell basics as a game.
  • OWASP Juice Shop, DVWA, WebGoat: run vulnerable web apps locally (Docker).
  • VulnHub, Metasploitable, Damn Vulnerable projects; own VM labs (VirtualBox, isolated network).
  • picoCTF, CyberDefenders (blue team), Blue Team Labs. Cheat sheets, read write-ups (after your own attempt!), keep notes.
  • Test only own systems/labs or with written permission (scope!).
  • Bug bounty programmes (HackerOne, Bugcrowd, YesWeHack, Intigriti) and responsible disclosure legalise tests within clear rules (scope, no data destruction/DoS, no social engineering without permission).
  • Scanning or attacking third-party networks/Wi-Fi, even “just for fun”, is punishable; port scans can be regarded as preparation.
  • § 202c targets programs/passwords for committing crimes; dual-use tools (nmap, Metasploit) are common for learning/testing own systems; intent and context count.
  • Privacy: use no real third-party data.
  • Minors: inform parents, platform rules.
  • Not legal advice: when unsure specialist lawyer/CERT.

Learning path and career

  1. Basics: networking (TCP/IP, DNS, HTTP), Linux/shell, Windows, programming (Python/Bash).
  2. Cryptography basics, OWASP Top 10.
  3. Practice platforms (TryHackMe → PortSwigger → HTB).
  4. Tools: Wireshark, nmap, Burp Suite, Ghidra, CyberChef.
  5. Blue team: logs, SIEM, incident response, hardening.
  6. Certificates (as needed): Security+, eJPT, OSCP, GIAC; IHK: IT specialist for system integration/application development with focus on IT security, IT security officer.
  7. Community: hackerspaces, CCC Erfa circles, meetups.
  8. Ethics: hacker ethic – share knowledge, protect systems, take responsibility.

See also: Pentesting, Responsible disclosure, OWASP Top 10, Black-hat hacker

Backlinks