Uma grande preocupação de quem quer iniciar na área de Pentest é como obter experiência técnica para atuar como um profissional nessa área.
É possível baixar máquinas virtuais ou até mesmo criar as suas VMs com software vulneráveis e assim pôr em prática tudo o que está se estudando. Uma outra forma é participar de CFTs[1] onde são testados suas habilidades em diversas áreas como criptografia, segurança de redes, programação, banco de dados entre outras. Abaixo segue uma lista de sites com essa finalidade:
EnigmaGroup
http://www.enigmagroucp.org/
Exploit Exercises
http://exploit-exercises.com/
Google Gruyere
http://google-gruyere.appspot.com/
Gh0st Lab
http://www.gh0st.net/
Hack This Site
http://www.hackthissite.org/
HackThis
http://www.hackthis.co.uk/
HackQuest
http://www.hackquest.com/
Hack.me
https://hack.me
Hacking-Lab
https://www.hacking-lab.com
Hacker Challenge
http://www.dareyourmind.net/
Hacker Test
http://www.hackertest.net/
hACME Game
http://www.hacmegame.org/
Hax.Tor
http://hax.tor.hu/
OverTheWire
http://www.overthewire.org/wargames/
pwn0
https://pwn0.com/home.php
RootContest
http://rootcontest.com/
Root Me
http://www.root-me.org/?lang=en
Security Treasure Hunt
http://www.securitytreasurehunt.com/
Smash The Stack
http://www.smashthestack.org/
TheBlackSheep and Erik
http://www.bright-shadows.net/
ThisIsLegal
http://thisislegal.com/
Try2Hack
http://www.try2hack.nl/
WabLab
http://www.wablab.com/hackme
XSS: Can You XSS This?
http://canyouxssthis.com/HTMLSanitizer/
XSS: ProgPHP
http://xss.progphp.com/
DigitalCorpora
http://digitalcorpora.org/
Digital Forensics Tool Testing Images
http://dftt.sourceforge.net/
DFRWS 2014 Forensics Rodeo
http://www.cs.uno.edu/~golden/dfrws-2014-rodeo.html
Linux LEO Supplemental Files
http://linuxleo.com/
volatility memory samples
https://code.google.com/p/volatility/wiki/FAQ
ISFCE Sample Practical Exercise
http://www.isfce.com/sample-pe.htm
ForGe Forensic test image generator
https://github.com/hannuvisti/forge
Network Forensics
Wireshark Sample Captures
http://wiki.wireshark.org/SampleCaptures
Wireshark Network Analysis Book Supplements
http://www.wiresharkbook.com/studyguide.html
pcapr
http://www.pcapr.net
PacketLife Capture Collection
http://packetlife.net/captures/
DigitalCorpora Packet Dumps
http://digitalcorpora.org/corpora/packet-dumps
Evil Fingers PCAP Challenges
https://www.evilfingers.com/repository/pcaps_challenge.php
PCAPS Repository
https://github.com/markofu/pcaps
Chris Sanders Packet Captures
http://chrissanders.org/packet-captures/
Tcpreplay Sample Captures
http://tcpreplay.appneta.com/wiki/captures.html
Enron Email Dataset
http://www.cs.cmu.edu/~enron/
MAWI Working Group Traffic Archive
http://mawi.wide.ad.jp/mawi/
LBNL-FTP-PKT
http://ee.lbl.gov/anonymized-traces.html/
Malware Analysis
Open Malware / Offensive Computing
http://openmalware.org/
Contagio
http://contagiodump.blogspot.com/
VX Heaven
http://vxheaven.org/
VirusShare.com / VXShare
http://virusshare.com/
VXVault
http://vxvault.siri-urz.net
MalShare
http://malshare.com/
Virusign
http://www.virusign.com/
theZoo / Malware DB
http://ytisf.github.io/theZoo/
malc0de
http://malc0de.com/database/
FakeAVs blog
http://www.fakeavs.com/
malware_traffic
http://malware-traffic-analysis.net/
Georgia Tech malrec page
http://panda.gtisc.gatech.edu/malrec/
Kernelmode Forum
http://www.kernelmode.info
Malware Hub Forum
http://malwaretips.com/categories/malware-hub.103/
MalwareBlacklist.com
http://www.malwareblacklist.com
Joxean Koret’s List
http://malwareurls.joxeankoret.com
Sucuri Research Labs
http://labs.sucuri.net/?malware
CLEAN MX realtime database
http://support.clean-mx.de/clean-mx/viruses.php
Contagio Mobile Malware
http://contagiominidump.blogspot.com/
Android Sandbox
http://androidsandbox.net/samples/
maltrieve
http://maltrieve.org/
HoneyDrive
http://bruteforce.gr/honeydrive
Online and CTFs
Honeynet Challenges
https://www.honeynet.org/challenges
http://old.honeynet.org/scans/index.html
I Smell Packets
http://ismellpackets.com/
Network Forensics Puzzle contest
http://forensicscontest.com/puzzles
DEF CON CTF Archive
https://www.defcon.org/html/links/dc-ctf.html
DFRWS
http://www.dfrws.org/2013/challenge/index.shtml
http://www.dfrws.org/2010/challenge/
http://www.dfrws.org/2011/challenge/index.shtml
http://www.dfrws.org/2007/challenge/index.shtml
http://www.dfrws.org/2006/challenge/
http://www.dfrws.org/2005/challenge/
ForensicKB Practicals
http://www.forensickb.com/2008/01/forensic-practical.html
http://www.forensickb.com/2008/01/forensic-practical-2.html
http://www.forensickb.com/2010/01/forensic-practical-exer
Hack The Box
https://www.hackthebox.eu/
Agora é só estudar e se divertir! :)
-------------------
[1] - CTF significa Capture the Flag. No âmbito da informática, são competições que envolvem diversas competências dos profissionais/estudantes/entusiastas para a resolução de desafios relacionados à infosec (segurança da informação), com o objetivo de capturar a bandeira (normalmente um código) e pontuar. Para mais informações acesse https://ctf-br.org/
