This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →

For those who might feel intimidated by a virtual machine, Jeremy Druin (@webpwnized) has made available a lot (72!) of videos explaining possible attacks and how to carry them out. It's an excellent complement for learning the basics of appsec.

Web Application Pen-testing Tutorials With Mutillidae

These are things you'll be able to come and practice at the next Hackfest during the Friday and Saturday night security games :-)

To wrap up, a little reminder... Never pentest systems you're not authorized to test. It might earn you a visit to jail and would put a quick end to a career in security.