No need to use high-risk sites. The below sites are reputable and guard-railed.
Note the Blue Teaming Defensive Security labs at the bottom of the page.
Beginner-Friendly (Zero Experience to Foundational)
picoCTF (By Carnegie Mellon University)
Created specifically for students and beginners. It uses a gamified interface where challenges (ranging from basic web exploitation to cryptography) come with helpful hints and structural guides so users rarely get completely stuck.
OverTheWire (Bandit Series)
Aka War Games. The gold standard for learning the Linux command line, which is an essential prerequisite for any security practice. Players log into a text-based environment via SSH and solve puzzles to unlock the password for the next level.
TryHackMe (Free Tier)
A highly interactive platform that uses bite-sized, guided laboratory environments. While they have a premium layer, they provide massive value through their free rooms covering Linux fundamentals, basic network scanning, and introductory defensive security.
Intermediate (For IT Admins & Emerging Professionals)
Hacker101 CTF
Run by the major bug-bounty platform HackerOne, this is a completely free training ecosystem focused entirely on Web Application Security. It features video lectures paired with targeted CTF challenges.
Root-Me
A massive, community-supported French/English platform with over 500 free challenges covering network analysis, forensics, reverse engineering, and web hacking. It gives minimal context per challenge, forcing users to research and think like real attackers.
Advanced (For Systems Engineers & Advanced Practitioners)
Hack The Box (HTB Labs)
A legendary cyber-range platform that hosts fully live, vulnerable corporate networks and machines. It simulates real-world exploitation paths and requires users to think critically about complex enterprise architectural flaws.
CyberDefenders
Most CTFs focus on attacking (offensive security). CyberDefenders focuses strictly on Blue Teaming (Defensive Security). Their free challenges give users real, compromised memory dumps and network logs, requiring them to perform digital forensics and incident response (DFIR).
Legal Notice
Soveren Cyber may provide information about third-party products or services, including security tools, videos, templates, guides, and other resources included in our website (collectively, “Third-Party Content”). You are solely responsible for your use of Third-Party Content, and you must ensure that your use of Third-Party Content complies with all applicable laws, including applicable laws of your jurisdiction and applicable export compliance laws. We provide Third-Party Content as a service to those interested in such content. Your dealings or correspondence with third parties and your use of or interaction with any Third-Party Content are solely between you and the third party. Soveren Cyber does not control or endorse, and makes no representations or warranties regarding any Third-Party Content, and your access to and use of such Third-Party Content is at your own risk.