HACKR.GG
hackr.gg teaches web security: how websites get hacked, and how to stop it. The Academy has short lessons on the attacks behind real breaches, each followed by a quick check, and many with a practice exercise you do right in your browser. No VM, no VPN, no setup.
We built hackr.gg because most security material is either an hour-long video or a wall of jargon. Our lessons are short and concrete: what the bug is, what the vulnerable code looks like, how attackers use it, and how to fix it.
Then you check yourself with a few questions, and where it helps, you try the attack against a practice app to see it work. Skills stick when you have done them once yourself.
When a lesson has an exercise, a deliberately vulnerable practice app runs right inside the page. You type the payload (SQL injection, XSS, IDOR, command injection and more) and see straight away whether it worked. Nothing to install and nothing to set up.
Everything runs safely in your browser — you can't accidentally attack anything real, and nothing you do can affect anyone else. Reload the page and the lab resets.
Everything on hackr.gg is designed for educational use in isolated, controlled environments. The skills taught here — SQL injection, XSS, command injection, privilege escalation — are the same skills used by professional penetration testers and bug bounty hunters operating legally with explicit authorisation.
We take this seriously. Labs are sandboxed and network-isolated. Techniques are taught in the context of defensive security — you learn how attacks work so you can defend against them, find them in bug bounty programmes, and build systems that don't have them.