nikto VS metasploitable3

1-) Learn Hacking on a debian based distro like Kali Linux - I personally started with tools like nikto, camhacker... and then moved to more complex frameworks like metasploit.

Its not that much of a tool than wrappers of few awesome tools that most of you probably know and use today - sqlmap, bbot and nikto.

I'm excited to share with you my latest contributions to the GitHub community: a collection of free GitHub Actions designed to streamline and enhance security practices utilizing DAST and OSINT tooling that is widely used - sqlmap, bbot and nikto. There were no GH Actions that I could find, so I made them for my use case, but figured everyone can benefit from those awesome tools.

Cred ca aici este fix ceea ce intrebi: https://github.com/sullo/nikto/tree/master/program/databases

Nikto is a phenomenal web server scanner that eases enumeration significantly. It's free and open-source.

https://github.com/sullo/nikto running a tool like that to check for common vulnerabilities

There's also a bunch of intentionally vulnerable Webapps and VMs aimed at demonstrating potential footholds and common exploits leading to owning of the host including but not limited to: bWAPP, Damn Vulnerable Web App, WebGoat, Metasploitable 3, Mutillidae, Juice Shop

Note: to practice, you don;t have to attack real targets which are very hard for a beginner anyways.Use a vulnerable on purpose vm to train specific skills.

Set this up, have fun: Metasploitable 3

Op, this is good. But if you want to make your existing DC vulnerable, you can just make download the software rapid7 did to make this box https://github.com/rapid7/metasploitable3/wiki/Vulnerabilities

Metasploitable is a virtual machine image that includes lots of vulnerabilities (on purpose) and that can be used to learn how to hack into a machine.

If you want to do offensive security like penetration testing, learn some tools like Burp Suite and Metasploit and point them at a vulnerable Linux distro. While you're doing that, find some local security user groups and start attending so you can find out about openings right away. The job is to run automated and manual tests against specific hosts and write reports about what you find. A technical writing course is a big benefit here.

you know what i mean

Metasploitable https://github.com/rapid7/metasploitable3 and as someone else also mentioned OWASP's vulnerable/broken apps