# Where can you practice ethical hacking with permission? The questions to ask before you touch anything, and the age rules of three programs. You can practice on anything whose owner has said yes: a lab that hands you a target, a competition challenge, or a practice app you run on your own computer. A website being public doesn't count. Testing a site without its owner's permission is illegal, and a site you can open is still someone else's site. Here are the questions I'd ask before touching anything. If the answer to any of them is no, or you aren't sure, leave it alone. This is a checklist, it isn't legal advice, and nothing on it guarantees a place is safe. ## Did someone give you this target? A provided practice target is something set up for you to test, and whoever runs it says so. A public website is a site anyone can open. You can read it and buy things from it, but being able to reach it tells you nothing about whether you're allowed to test it. That goes for your school's site, the games you play and any site that looks badly built. A practice app on your own computer is the plainest case, as long as the computer really is yours. Read its setup notes first, because these apps have bugs on purpose. [DVWA's README](https://github.com/digininja/DVWA) says not to put it on "any Internet facing servers" because "they will be compromised." It also recommends running it inside a virtual machine. ## Can you point to the words that put it in scope? Scope is the written list of what you can test and how. A decent practice program states it: which apps, which machines, what's off limits. If you can't point to the sentence that covers what you're about to do, it's out of scope, even when it looks related. The company running the labs usually isn't a target either. [TryHackMe's policy](https://tryhackme.com/legal/acceptable-use-policy) says "The TryHackMe platform itself is not in scope." ## Is the data made up? Everything in a practice target should be fake: fake customers, fake orders, fake messages. If you break something, no real person's account goes with it. A bug bounty program fails this one. It's real permission for whatever the company lists, as long as you meet its rules, and those can include an age limit. But real customers are behind those systems, so it isn't practice. ## Do you know when you'll stop? Decide before you start. Stop when: - You've shown the bug is real. One harmless proof is enough. - You see something that looks real, like a person's details, a working password or a way into another system. - You've drifted off the target, or you can't tell whether you're still on it. - What you're doing gets in the way of anyone else using the target. Then write down what you did and tell whoever runs it. [Hack The Box's policy](https://resources.hackthebox.com/hubfs/Legal/AUP.pdf) puts it well: if you find personal data, real logins or access to real systems in a training environment, "stop immediately and report it." ## Do the terms let you in at your age? Read the terms before you make an account. This is what three programs said on their official sites in November 2026. Terms change, so read the current ones yourself. - [TryHackMe](https://tryhackme.com/legal/acceptable-use-policy): You must be at least 13 to create an account. If you're under 18, some content and community features may be restricted. - [Hack The Box](https://resources.hackthebox.com/hubfs/Legal/UA.pdf): You must be at least 18, or have a parent or guardian accept the agreement for you and take responsibility for how you use the service. You register with your real name, and you get one account. - [CyLab Security Academy](https://www.cylabacademy.org/terms.html), formerly picoCTF: You must be at least 13. If you're 13 to 17, a parent or legal guardian gives their email address when you register (teacher registrations work differently). Attacking machines that aren't designated as targets counts as cheating. ## Which kind of practice suits you? Permission comes first, then format. An app on your own computer gives you the most freedom and the least help, a lab site hands you the target and the instructions, a competition gives you an event to work toward, and a class gives you a teacher and a set time each week. The [alternatives page](https://bugclubhq.com/alternatives) goes through specific programs. ## BugClub's rules are stricter Everything above is general advice. This part applies only to students in the course. Every student signs the [ethics agreement](https://bugclubhq.com/ethics) before week 1, and a student under 18 signs it with a parent or guardian. It says "Only touch the targets you're given" and "Don't test any real website, app, network, phone or account." It names BugClub itself, your school and the games you play. Testing a real system on purpose ends your place in the course. It also says what happens when you find something: "Once you've shown a bug is real, stop. Don't dig further, don't collect anyone's data, don't show it off." If you come across a real problem outside the course, you don't test it. You tell your instructor, and we help you report it the right way. The [curriculum](https://bugclubhq.com/curriculum) shows what each week's lab covers. - [All guides](https://bugclubhq.com/learn) - [The ethics agreement](https://bugclubhq.com/ethics)