How to send a WhatsApp chat without saving the contact

WhatsApp is one of the most popular applications. It makes communication as simple as adding the correct number of anyone in the world and voila, that’s it. However, it can be somewhat annoying that in order to message someone, you always have to first add that person in your address book, but there are so many occasions where you just want to communicate with someone for a couple of messages and nothing else.

That’s why many third-party apps take care of this simple task for you. It shouldn’t be that difficult to send messages through WhatsApp without saving the contact. The problem is that these apps can compromise the security and functionality of your smartphone. They might also be incompatible with certain operating systems.

To help you resolve this issue, we’ll show you how to send messages through WhatsApp without having to add the contact to your address book. And best of all, this method doesn’t require that you install other apps and it works for both iOS and Android operating systems.

The Process:

This process may at first glance seem somewhat confusing for users who are not very experienced using their smartphone. But once you complete the process one time, it will be a piece of cake every time after that.

  • Open your preferred browser on your smartphone.
  • Type the following link in the search bar: https://api.whatsapp.com/send?phone=XXXXXXXXXXX (In place of the Xs type the phone number of the person you want to contact, including the country code, but without the + sign.)
  • That means that if the person has a Nigerian number (with the +234 prefix), it would look something like this: https://api.whatsapp.com/send?phone=2348038657737
  • Press ‘enter‘ on your smartphone.
  • A WhatsApp window will open asking if you want to send a message to that phone number. Press on ‘send message‘.
  • You will automatically be redirected to WhatsApp with the ‘start chatting‘ window to the person you entered in your phone.

5 new cyberthreats pop up every second, here’s how to protect yourself

The start of 2018 has seen a massive rise in cryptocurrency mining and cryptojacking attacks, along with steady numbers of familiar malware and ransomware attacks, according to a Wednesday report from McAfee. On average, five new threat samples arose every second of Q1 2018, with several notable campaigns demonstrating just how sophisticated hackers have become.

“There were new revelations this quarter concerning complex nation-state cyber-attack campaigns targeting users and enterprise systems worldwide,” Raj Samani, chief scientist at McAfee, said in a press release. “Bad actors demonstrated a remarkable level of technical agility and innovation in tools and tactics. Criminals continued to adopt cryptocurrency mining to easily monetize their criminal activity.”

Of particular note was the rapid expansion of cryptojacking and other cryptocurrency mining attacks, in which criminals hijack victim’s browsers or infect their systems to mine for cryptocurrencies like Bitcoin—often without their knowledge. Coin miner malware grew a whopping 629% this year, growing from about 400,000 total known samples in Q4 2017 to more than 2.9 million in Q1 2018.

The rapid growth suggests that cybercriminals are drawn to the ease of infecting a user’s system and collecting the payments themselves, without having to rely on another party to monetize their attack, the report said.

“Cybercriminals will gravitate to criminal activity that maximizes their profit,” Steve Grobman, CTO at McAfee, said in the release. “In recent quarters we have seen a shift to ransomware from data-theft, as ransomware is a more efficient crime. With the rise in value of cryptocurrencies, the market forces are driving criminals to crypto-jacking and the theft of cryptocurrency. Cybercrime is a business, and market forces will continue to shape where adversaries focus their efforts.”

However, cryptomining is far from the only cyberthreat that businesses need to keep on their radar and protect against. Here are five campaigns the report identified as wreaking major havoc in Q1.

1. Bitcoin-stealing campaigns

A cybercrime ring called Lazarus launched a sophisticated Bitcoin-stealing phishing campaign called HaoBao this year, targeting global financial institutions and Bitcoin users, the report found. The attack came via malicious email attachments to victims, which, when opened, would implant a tool that scanned for Bitcoin activity and established a connection for ongoing data gathering and cryptomining.

2. Gold Dragon attacks

In January, the Gold Dragon attack targeted organizers of the Pyeongchang Winter Olympics in South Korea. The fileless malware attack—executed via a malicious Microsoft Word attachment that contained a hidden PowerShell implant script—encrypted stolen data and sent it to the attackers.

3. GhostSecret and Bankshot attacks

The international cybercrime group known as Hidden Cobra is believed to be associated with Operation GhostSecret, an attack targeting the healthcare, finance, entertainment, and telecommunications sectors and stealing data. The latest variation of the attack, called Bankshot, uses an embedded Adobe Flash exploit to allow hackers to get into victims’ systems.

4. LNK exploits

The amount of malware that exploits LNK capabilities grew 59% from Q4 2017 to Q1 2018, the report found. Meanwhile, PowerShell attacks have slowed.

5. Gandcrab ransomware

Growth in new ransomware slowed by 32% in Q1. However, the Gandcrab strain infected some 50,000 systems in the first three weeks of the quarter alone, taking Locky’s place as the ransomware leader. Gandcrab uses advanced methodologies, such as requesting ransom payments through the Dash cryptocurrency rather than through Bitcoin, to extract more value from their targets.

Tips to protect your business

Despite the rise of new attack types, business leaders can take a number of steps to protect employees and data.

In terms of cryptojacking, the attack is blocked by default in the browser Opera. Mozilla’s Firefox 63, due out in October, will block the attacks as well. Users can also download the minerBlock extension for Chrome and Firefox, as noted by TechRepublic contributor James Sanders.

Businesses can avoid the impact of ransomware by backing up files every day, and by taking other preventative steps.

Employee education remains paramount to any cybersecurity policy. Top ways to train employees to avoid cyberattacks include offering customised examples of threats that are relevant to an employee’s department and role (and particularly what phishing attacks look like), running unscheduling simulations of typical attacks, providing training models that employees can complete at their convenience, and rewarding those who take the proper actions.

Development Standards Technologies Tech Republic

Microsoft Publishes PDF With Every Windows Terminal Command

If you wanted an exhaustive reference for all the windows terminal command line tools and utilities available in Windows, “/h” was as good as it got. Well, that was until last month, when Microsoft published a whopping big PDF with information on every single terminal command the operating system has to offer.

The document, released on April 18, comes in at 4.6MB and 948 pages and covers the following platforms:

  • Windows Server (Semi-Annual Channel)
  • Windows Server 2016
  • Windows Server 2012 R2
  • Windows Server 2012
  • Windows Server 2008 R2
  • Windows Server 2008
  • Windows 10
  • Windows 8.1

Even though Windows 7 is absent, it’s fair to say a lot of the commands should work on the older OS.

The reference isn’t just limited to commands — it also contains tips for configuring the command prompt window, as well as changes you can make to the Registry to enable and disable features, such as filename / directory completion.

Best of all, hyperlinks embedded in the file for each command jump directly to online documentation, so you can always check out the most up-to-date content.

This does however raise the question: why have a gigantic reference PDF in the age of online documentation?

lifehacker

Learn How to Code with your Phone for Free

Grasshopper

A bunch of Google employees participating in the company’s Area 120 internal incubator have launched Grasshopper, a free mobile app for Android and iOS that teaches you the basics of programming.

It’s beautifully designed and is suitable for just about anyone who can be trusted to use a phone on their own. By solving simple challenges and answering quiz questions, you’ll soon get the hang of basic JavaScript.

The gamified app, named after programming pioneer Grace Hopper, currently includes three sets of lessons, which cover the fundamentals of coding (calling functions, using variables and objects, and so on), as well as animations. The idea is to spend a few minutes a day with it, so you can have the app remind you to hop in daily and take on a few challenges.

When you’re done with the content in Grasshopper, you can move on to recommended Coursera classes to learn more about JavaScript, HTML, CSS, algorithms, and web design for a fee, or simply muck around in Grashopper’s online playground and make your own JS animations. Naturally, you can also explore alternatives for learning to code, such as the courses offered by edX and FreeCodeCamp.

I’ve been meaning to get back to coding for a while now, having ditched my chops when I graduated from high school. The app is fun and easy enough to get through a few challenges when you’re on a commute, and feels like a good alternative to scrolling through social media feeds mindlessly.

Grasshopper is the latest product to emerge from Area 120, which gives Google employees a chance to work full-time on their side projects and bring them to life. It’s previously seen launches like Uptime, which lets you watch YouTube videos in sync with friends elsewhere in the world, and Supersonic, a messaging app for emoji lovers.

thenextweb

Five Apps for Keeping Windows 10 Clean

Nobody likes an operating system that’s full of unnecessary stray files, 20 annoying apps that start up when you fire up your computer, and other crap that slows down your system, makes your desktop feel disorganised, or gives you a headache whenever you’re trying to work (or game). Thankfully, there are a number of free apps that can help you clean your Windows PC.

Disk Cleanup

Disk CleanupOne of the first apps you can try using to get control of a messy Windows PC is Windows’ very own Desk Cleanup app—built right into the operating system and free for you to use at any time. On Windows 10, just pull up the Start Menu and start typing in “Disk,” which should make it easy to load the utility. Pick a drive you want Disk Cleanup to take a look at, likely your system’s primary c:\ drive, and click OK.

Once it’s done scanning, Disk Cleanup will tell you about all the different kinds of files that you can safely remove from your system, including the cache for your Edge browser, anything in your Recycle Bin, temporary files left over from apps or app installations, and file thumbnails you might not need anymore—to name a few. You can also click on the “Clean up system files” option to have the app check for log files Windows created during an OS installation, as well as any previous Windows installations that might be lurking around your hard drive (and taking up gigabytes of space).

Once you’ve made your selections for deletion, click “OK,” and then “Delete Files,” to begin the process.

(You can also use a utility like BleachBit to give your drive a more thorough scrubbing. Just don’t use it to muck with your Windows registry; registry cleaners tend to have little noticeable effect, except for when they completely muck up your system by deleting something they shouldn’t have.)

The PC Decrapifier

The PC Decrapifier

Though this app is more useful for desktop or laptop PCs you just purchased, it’s a great tool for eliminating the more obvious bloatware on your system that, perhaps, you simply forgot about (or never had time to clean).

You don’t have to go through any installation routine once you’ve downloaded the app. Just launch it and let it analyze your system. It’ll split any apps it finds into three categories—apps definitely recommended for deletion, questionable apps that people usually remove from their systems, and all other apps. Each app listing tells you whether its a regular application you load yourself or one what starts when your computer launches, a percent that indicates how many other PC Decrapifier users also removed that app, and occasionally a little question mark icon that takes you to the web to learn more about a particular app.

All you have to do is select what you want to remove, confirm it on the next screen (which also allows you to create a Windows restore point if you’re feeling nervous), and let the app flush your unwanted apps down the digital drain.

AdwCleaner

AdwCleaner

Toolbars, spyware, and other kinds of malware can make your PC a mess. Even if you’re a semi-savvy computer user, however, you’re probably pretty good about avoiding the common traps: apps that solicit you to add crappy third-party items to their regular installation process or websites that cajole you to try out a scammy-sounding app—things like that.

That said, it never hurts to run a quick scan every now and then to make sure there’s nothing on your computer that shouldn’t be there. You probably don’t need to pay for a real-time malware scanning app when you have something like AdwCleaner, a lightweight app that requires no installation to effectively (and efficiently) scan your system for crap.

The company that makes the ever-popular Malwarebytes anti-malware app owns AdwCleaner. While you can always switch up to the former for extra protection, given its reputation, the app feels a little more bloaty and definitely loves to let you know about its Premium services.

Steam Cleaner

Steam Cleaner

This one’s for you, gamers. You might not even know that the major online distribution services—Steam, Origin, Uplay, and GoG—might leave some crap on your hard drive even after you’ve uninstalled a game you’re done playing. Even though this app is called “Steam Cleaner,” it does a great job of scanning through each service’s default installation folders and identifying leftover files from past games that you can safely remove. With some simple scanning, you could save gigabytes of space.

(For regular apps, consider using a program like Revo Uninstaller to ensure that all traces of a program are deleted whenever you want to remove it from your system.)

MiniBin

MiniBinHaving to navigate to your Windows desktop to fiddle with your Recycle Bin is annoying. While it’s easy to delete (or shift-delete) files from File Explorer, it’s always nice to have a trash can at the ready. This tiny utility drops a Recycle Bin directly in your system tray, which makes it much easier to drag-and-drop files to oblivion, empty the trash, and restore that which you accidentally deleted.

lifehacker

Yes Chrome is scanning your Windows PC, but it might be a bug

A few days ago Kelly Shortridge, a product manager at SecurityScorecard detected some unexpected behavior on her PC, as a honeypot Canarytoken reported being accessed by Chrome.exe. That’s not what you’d expect from a web browser normally, except for one thing — Google did add some antivirus-y capabilities to its browser on Windows late last year as an enhancement to its Chrome Cleanup tool that can help reset hijacked settings. Google Chrome security lead Justin Schuh explained how the feature works and pointed to some documentation about it, and that was that —

If you are hitting this issue and you want a fix right now then go to chrome://downloads in your browser, go to the menu in the top right, and select Clear All. That will clear Chrome’s list of downloaded files so that it won’t have any files to existence-check at startup. If you have a large list of downloaded files then this will improve startup time slightly.

It turns out the “AV scanning” wasn’t that at all, and what it was doing could affect you right now. It turns out that Chrome is checking the integrity of downloaded files at startup, and a bug lead it to that particular folder. It relies on the Downloaded History list for this check, and if you have a lot of files in there, it could slow down your computer when you start Chrome. While the dev team is working to skip the check entirely in a future update, users worried about it can fix it by clearing their download history.

711 Million Email Addresses Exposed: How to Protect Yourself

Typically, your spam folder catches a lot of the malware-infected crud sent by the mischievous never-do-wells from the darker corners of the internet. Unfortunately, a newly discovered attack has targeted more than 711 million email accounts.

Fortunately, only some — not all — of the targets’ passwords have been taken.

The Onliner spambot, first discovered by a Paris-based security researcher who goes by the Benkow pseudonym, was confirmed by well-regarded security expert Troy Hunt in an August 30 blog post. Hunt — a Microsoft Regional Director who runs the breach-tracking website Have I Been Pwned — referred to a data dump from Onliner as “a mind-boggling amount of data,” in which he even found his own email address.

How does Onliner do it?

According to a ZDNet report, the hooligans behind the spambot compiled a massive database of 80 million email credentials from a number of other breaches, such as the LinkedIn hack. These logins were then used to spam 630 million email addresses, whose spam filters they jumped right over.

What can you do?

First, check Have I Been Pwned to see if your email account information is in the hack, Onliner may not have much of your information beyond your address. Onliner worked by sending two rounds of emails, as only a fraction of the 711 million targets could actually be infected by its malware.

If Have I Been Pwned says your email address appeared in the Onliner dump, there are three steps you need to take immediately. The first is changing the password to your email account. Second, make sure you’re not using that password in any other online accounts — especially those for banking. Lastly, enable two-factor authentication, so your email address and password alone aren’t enough for your account to be cracked.

The spambot campaign whittled its target list down by placing a difficult-to-see, pixel-sized image in its initial emails, which contained code to send a user’s IP address and system information back to HQ. If the pixel detected its recipient was a Windows PC (Androids, iOS devices and Macs are protected), it would tell the server to send more-targeted emails — which looked like invoices — to the addresses it identified as vulnerable.

Now’s a good time to look into a password manager, which can help you create strong, hard-to-guess passwords. And of course, do your best to avoid opening suspicious-looking emails, especially those that look like invoices for services you don’t pay for.

The secondary wave of emails is smaller for the sake of obscurity, since larger attacks are more likely to draw the attention of law enforcement and security experts. The infectious emails contain a JavaScript file that does all the dirty work, pwning your machine.

tom's guide

6 tips to protect your personal information when using public Wi-Fi

As the Internet has become a crucial part of everyday life, so too has the need to access it virtually anytime, anywhere.

In fact, according to a recent survey completed by Symantec, over 66 per cent of Canadians consider access to public Wi-Fi when making travel or entertainment arrangements.

Based on these numbers – and the risk of using public networks – it’s important to know how to protect yourself. Here are six tips you can use to protect your personal information on public Wi-Fi networks, before and after you connect.

Before you log on

Keep on top of security updates

As the world learned from the WannaCry ransomware attack, which started by delaying a Windows update and went on to affect hundreds of thousands of computers, staying on top of software updates is the most prudent way to protect yourself against hackers and cybercriminals.

According to Forbes, “there’s no magic bullet to data security,” and diligently running updates for your operating system and web browser is one of the primary ways to protect yourself.

Turn off file-sharing and close shared folders on your laptop

While shared folders can be a great way to work collaboratively with colleagues, and share photos amongst family, make sure to close them and turn off file-sharing before logging onto a public network with your laptop or mobile device.

A blog post from the online security company Zone Alert states that once your computer connects to a public Wi-Fi service, those folders can be viewed by anyone else on the network. A public Wi-Fi field guide from Gizmodo concurs with this suggestion.

To avoid any information falling into the wrong hands, users should adjust their privacy settings to ensure they are different for public and private networks.

Enable 2-factor authentication on any accounts that contain personal information

Two-factor authentication is a good option for anyone desiring a second layer of security on their physical electronic devices, including their mobile device and laptop.

Enabling multiple layers of authentication on email, social networking and bank accounts can also act as an additional line of defence against cyber criminals lurking on public networks, reports The Next Web.

Use a VPN (virtual private network)

One of the most effective ways to protect your information while using public Wi-Fi is to use a Virtual Private Network (VPN). Simply download a VPN app on your phone or mobile device and log into your VPN before connecting to the Internet.

A VPN reroutes your traffic through a private, encrypted network. Kevin Haley, director of product management for security response at Symantec, explains exactly why a VPN is so useful.

“What you’re doing is, within a public network, creating a private network that’s just for you, if you will,” Haley says.

“The other way it’s referred to is a tunnel. It’s really just making sure that your communication is surrounded by protection as you talk between where you are and wherever, the website that you’re going to.”

According to PCMag, some of the best VPN services of 2017 include NordVPN and Private Internet Access for Android, or KeepSolid or NordVPN for iPhone.

After you log on

Avoid signing in to accounts that contain personal information, including social media and online banking

Assuming that you’ve taken precautions beforehand, the next step is to be cautious after logging onto a public network. One of the best ways to play it safe is to avoid logging into any accounts that contain personal information, such as social media, work email and especially, online banking.

Haley pointed out that even though a website itself might be reputable, personal information still isn’t secure as long as the network is insecure.

While email remains relatively low-risk, Stephen Neville, founder of the Centre for Advanced Security at the University of Victoria, noted in an email that any financial transactions should never be completed over a public network.

“If you use encrypted transmissions, wireless access points offer reasonable security for low-risk activities, e.g. email, and security, that is more or less on par with a wired connection. But the security is insufficient for any higher-risk things like e-banking,” Neville wrote.

Make sure the URL is encrypted

It’s also helpful for users to know how to identify whether a website has taken steps to protect their information. Users can do this by checking the beginning of a URL to see whether it begins with HTTP or HTTPS.

Haley explained that website URLs containing HTTPS use an SSL encryption to protect visitors to their site. Sites that use HTTPS will also show a small padlock next to the search bar.

“Users just need to look for the little lock that’s in the browser bar, and that tells you that your traffic is being encrypted,” said Haley.

globalnews

3 Things Developers Need to Know about Cross-Marketing

With a limited budget, small businesses should consider partnership with other companies or independent developers who offer related products and try cross-marketing. It consists in combining efforts of two or more companies for achieving the common goal.

Nowadays hundreds of apps a day are being created making the intensely competitive IT industry one of the biggest spenders when it comes to marketing. However, there are many companies that do not have massive budgets for product promotion and, therefore, need to use affordable methods to attract potential customers.

With a limited budget, such small businesses should consider partnership with other companies or independent developers who offer related products and try cross-marketing. It consists in combining efforts of two or more companies for achieving the common goal – improving the sales performance by merging customer bases. Basically, your products get promoted and promote other software.

What are the advantages of cross-marketing?

Cross-marketing is a cost-effective method for breaking through the white noise of advertising and motivating customers to purchase products that they initially have not been after. Moreover, it provides you with a possibility to:

  • Establish your business credibility. By placing your product’s name next to the better-known brand, you develop a positive association in customers’ minds, and gain more trust from them, so they do not treat you like another dark horse. Obviously, it works only if you collaborate with a reputable company.
  • Increase the coverage of the target audience. With a customer base of your partner, you are able to reach more people who are potentially interested in your product. Your product will be shown to
  • Broad your company’s visibility. People tend to opt for products they have already heard about; therefore, you need to get exposure, and cross-marketing lets you do this without spending much.

Rules for choosing the right partner for cross-marketing

To make your cooperation with another company or developer effective and mutually beneficial, you have to consider several things.

The first one is about learning whether a potential partner(s) is your indirect competitor. Your products have to complement each other, but not to offer the same features, even if there are a few of them. Customers may need exactly what you have in common, and the comparison may not be in your favor.

You have probably identified your and your potential partner’s target audiences already. Do they coincide? If no, you will probably fire blanks trying to get exposure among customers who are not interested in your product. For example, if you sell an app for Mac optimization like this one, you should try to reach developers oriented on users who pay much attention to their computers’ maintenance, but want to do it quickly and easy, and whose work is connected with processing of large amounts of information. It could be professional photographers, for example, who use photo editors. It is unlikely for you to benefit from partnering with companies that create apps for kids or low-code development platforms.

One more thing to take into account is how much your partner’s target audience is used to spend on software – you have to be in the same price segment.

You also have to make sure your potential partner would not harm your reputation. Small companies often try to get their name in as many places as possible in the pursuit of money; however, it is not a viable option for businesses that aim to sell quality products. For instance, a free software segment is known for advertising and forced downloads of harmful and unnecessary apps said to be designed for “improving user experience”. In fact, loyal customers are often scared off by such “bonuses” and may stop using your product. Therefore, you should guard against accepting potentially harmful offers and reconsider a monetization model if needed. Devote enough time for studying the company’s history and its products’ reviews before initiating a cooperation.

How to make cross-promotion effective

Before you start working with your partner(s), you should determine:

  • Who will be the main contact from each business?
  • How the billing will be handled?
  • How long your promotion campaigns will last?
  • How the profits will be shared?
  • Who will be in charge of implementing new approaches while cross-promoting products?

This way you can avoid disagreements with your partner(s), which usually significantly reduce the efficacy of collaboration.

It is also worth remembering that barter projects need to be constantly monitored to make sure that both parties are satisfied. Collect statistics of traffic and sales and conduct analysis on a regular basis. It is probable that you will need to change your tactics in order to get better results.

Obviously, there are other ways to promote your product without investing much and you should not rely on cross-marketing only. However, this method like no other can help you to make a big step forward in a very short time.

15 Vulnerable Sites To (Legally) Practice Your Hacking Skills

As technology grows, so does the risk of getting hacked. So, it should come as no surprise that InfoSec skills are becoming more important and more in demand. No matter if you’re a beginner or an expert, nor if you’re a security manager, developer, auditor, or pentester – you can now get started by using these 15 sites to practice your hacking skills – legally. They say the best defense is a good offense – and it’s no different in the InfoSec world. Here’s our updated list of 15 sites to practice your hacking skills so you can be the best defender you can – whether you’re a developer, security manager, auditor or pen-tester. And remember – practice makes perfect! Are there any other sites you’d like to add to this list? Let us know below!

1 bWAPP

bWAPP, which stands for Buggy Web Application, is “a free and open source deliberately insecure web application” created by Malik Messelem, @MME_IT. Vulnerabilities to keep an eye out for include over 100 common issues derived from the OWASP Top 10.bWAPP is built in PHP and uses MySQL. Download the project here. For more advanced users, bWAPP also offers what Malik calls a bee-box, a custom Linux VM that comes pre-installed with bWAPP.

2 Damn Vulnerable iOS App (DVIA)

Recently re-released as a free download by InfoSec Engineer @prateekg147, DVIA was built as an especially insecure mobile app for iOS 7 and above. For mobile app developers the platform is especially helpful, because while there are numerous sites to practice hacking web applications, mobile apps that can be legally hacked are much harder to come by!Get going with DVIA by watching this YouTube video and reading the ‘Getting Started‘ guide.

3 Game of Hacks

Alright, this one isn’t exactly a vulnerable web app – but it’s another engaging way of learning to spot application security vulnerabilities, so we thought we’d throw it in. Call it shameless self-promotion, but we’ve received amazing feedback from security pros and developers alike, so we’re happy to share it with you, too! The game is designed to test your AppSec skills and each question offers a chunk of code which may or may not have a security vulnerability – it’s up to you to figure it out before the clock runs out. A leaderboard makes Game of Hacks just that much more enticing.

4 Google Gruyere

This ‘cheesy’ vulnerable site is full of holes and aimed for those just starting to learn application security. The goal of the labs are threefold:

  • Learn how hackers find security vulnerabilities
  • Learn how hackers exploit web applications
  • Learn how hackers find security vulnerabilities
  • Learn how to stop hackers from finding and exploiting vulnerabilities

“‘Unfortunately,’ Gruyere has multiple security bugs ranging from cross-site scripting and cross-site request forgery, to information disclosure, denial of service, and remote code execution,” the website states. “The goal of this code lab is to guide you through discovering some of these bugs and learning ways to fix them both in Gruyere and in general.”

Written in Python, Gruyere offers opportunities for both black box and white box testing so “hackers” have the chance to play on both sides of the fence.

Get started here: http://google-gruyere.appspot.com/

5 HackThis!!

HackThis!! was designed to teach how hacks, dumps, and defacement are done, and how you can secure your website against hackers. HackThis!! offers over 50 levels with various difficulty levels, in addition to a lively and active online community making this a great source of hacking and security news and articles.
Get started with HackThis!! here.

6 Hack This Site

HackThisSite! is a legal and safe place for anyone to test their hacking skills. The hub offers hacking news, articles, forums, and tutorials and aims to teach users to learn and practice hacking through skills developed by completing challenges.Start your training on HackThisSite here

7 Hellbound Hackers

Hellbound Hackers, the hands-on approach to computer security, offers a wide array of challenges with the aim to teach how to identify exploits and suggest the code to patch it. And Hellbound Hackers really is the ultimate site for hacking tutorials, covering a large range of topics from encryption and application cracking, to social engineering and rooting. With a community of nearly 100k registered members, it’s also one of the biggest hacking communities out there.
Read more and get started here.

8 McAfee HacMe Sites

Foundstone, a practice within McAfee’s Professional Services, launched a series of sites in 2006 aimed for pen testers and security professionals looking to increase their InfoSec chops. Each simulated app offers a “real-world” experience, built with “real-world” vulnerabilities. From mobile bank apps to apps designed to take reservations, these projects cover a wide array of security issues to help any security-minded professional stay ahead of the hackers.
The group of sites include:

9 Mutillidae

Yet another OWASP project on our list, Mutillidae is another deliberately vulnerable web application built for Linux and Windows. This project is actually a set of PHP scripts containing all the OWASP Top Ten vulnerabilities and more and is armed with hints to help users get started.
Get started with Mutillidae here, and be sure to check out the projects dedicated YouTube channel and Twitter account, run by Mutillidae’s second-generation developer, Jeremy Druin.

10 OverTheWire

OverTheWire is great for developers and security professionals of all experience levels to learn and practice security concepts. This pracrice comes in form of fun-filled wargames – beginners should start with “Bandit”,. where the basics are taught, and will progress to higher levels and to advanced games all with more complex bugs and exploits to patch as you go.Jump in the game here

11 Peruggia

Peruggia is a safe environment for security professionals and developers to learn and test common attacks on web applications. Peruggia is set as an image gallery in which you can download projects to help you learn how to locate and limit potential issues and threats.Download Peruggia here.

12 Root Me

Root Me is a great way to challenge and improve your hacking skills and web security knowledge through over 200 hacking challenges and 50 virtual environments. Check out Root Me here.

13 Try2Hack

Created by ra.phid.ae and considered one of the oldest challenge sites still around, Try2Hack offers multiple security challenges.
The game features diverse levels which are sorted by difficulty, all created to practice hacking for your entertainment. There is an IRC channel for beginners where you can join the community and ask for help, in addition to a full walkthrough based on GitHub.Try2Hack is available here.

14 Vicnum

An OWASP project, Vicnum is a series of basic and obviously web apps based on games “commonly used to kill time.” Because of their simple frameworks, the applications can be tailored for different needs, making Vicnum a great choice for security managers looking to help teach developers AppSec in a fun way.

The goal of Vicnum is “to strengthen the security of web applications by educating different groups (students, management, users, developers, auditors) as to what might go wrong in a web app, the site says. “And of course it’s OK to have a little fun.”

Check out the site, developed by Mordecai Kraushar here to find the games and available CTFs for download.

15 WebGoat

One of the most popular OWASP projects is WebGoat. This insecure app provides a realistic teaching and learning environment with lessons designed to teach users about complex application security issues. WebGoat is aimed for developers looking to learn more about web app security. The name WebGoat is a scapegoat reference: “Even the best programmers make security errors. What they need is a scapegoat, right? Just blame it on the ‘Goat!’”
Installs are available for Windows, OSX Tiger and Linux and has separate downloads for J2EE and .NET environments. There is an “easy-run” version as well as a “source distribution” version that allows users to modify the source code.

Check out the OWASP project page here or the GitHub page to get started with WebGoat.

For help with the lessons, take a look at this series of videos available for download.