Recommended Free Tools
Build your portfolio in intentionally vulnerable training environments, then document each exercise as a small, reproducible security assessment. State exactly what was in scope and why you were authorized to test it; show the method and sanitized evidence; explain the security impact and a proportionate fix. Keep all testing inside the lab or another system you own or have explicit permission to assess.
Choose a lab that makes the authorization boundary clear
For a first portfolio project, use a purpose-built training environment rather than a public website or a device you do not control. Two useful options have different strengths: OWASP Juice Shop is software you can run and manage yourself, while PortSwigger Web Security Academy provides hosted, interactive exercises.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Spy Labs: Forensic Investigation Kit | Detective Set | $34.95 | Buy on Amazon |
| 2 |
|
MindWare Science Academy Detective lab - Science Kits for Kids Age 8-12 - Kids Detective Kit... | $26.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
| Environment | Practice format | How to use it in a portfolio |
|---|---|---|
| OWASP Juice Shop | A deliberately insecure application for training, demonstrations, CTFs, and security-tool testing. OWASP documents software setup options including Docker, Node.js, and Vagrant. | Build a bounded assessment: document your local setup and scope, reproduce one vulnerability class, include sanitized evidence, explain impact, and recommend a fix. |
| PortSwigger Web Security Academy | Free interactive labs and learning materials covering topics including SQL injection, XSS, access control, authentication, and API testing. It includes progress tracking. | Write up a specific Academy lab. Name the lab as the scope, explain the concept in your own words, show suitable sanitized evidence, and describe what the exercise teaches a defender. |
Juice Shop is suited to an open-ended project where you control the application environment and can document setup. Academy labs are suited to focused exercises organized by topic. Neither requires you to claim that you tested a real organization’s systems.
Pick a project that demonstrates one skill well
A portfolio does not need to claim expertise across every cybersecurity role. Choose a narrow question, then make the result understandable and verifiable.
#1 Best Overall
- Spy Labs Incorporated's activity kits and equipment provide an engaging and interactive way for kids to learn about detective work, including forensic analysis and tracking techniques.
- Includes a large laboratory setup with materials needed to collect and analyze evidence, such as a UV flashlight, fingerprint powder, pH test strips, and more.
- The 20-page, full-color manual guides kids through experiments as they assume the role of a forensic scientist, solving make-believe crimes and mysteries presented in the manual.
- Promotes pretend play as kids ages 8 and up take on the role of detective, setting out to unravel mysteries one tough case at a time.
- Become a first-class secret agent with Spy Labs, the Detective Gear Experts; your trusted source for all your essential spy tools and gear!
Assess one vulnerability class in Juice Shop
Select a topic such as access control or injection. Identify the application as your deliberately vulnerable local lab and define what was in scope. Describe the conditions and steps needed to reproduce the behavior, include only evidence relevant to the finding, explain its effect within the lab, and propose a defensive change. OWASP presents Juice Shop as a training application and documents software-based ways to run it, so a dedicated lab computer is not established as a requirement by the project page.
Write up a Web Security Academy lab
Complete one exercise and identify its exact Academy context. Explain the underlying vulnerability rather than merely listing the steps used to solve it. A sanitized request and response, or another appropriate piece of evidence, can show what happened. Close the technical explanation with the lesson a defender should take from the exercise. PortSwigger describes the Academy as a place to learn web security safely and legally: Web Security Academy.
Publish a short testing-workflow note
Use a structured methodology to explain how you approached an application: set scope, map the application, analyze its attack surface, and test for vulnerabilities. PortSwigger’s testing guidance describes these stages and notes that many tutorials can be practiced against its deliberately vulnerable site or an Academy lab. Keep the note tied to the authorized practice target, not to an implication that you tested a third-party production system: PortSwigger testing for vulnerabilities.
Show a learning path over several projects
Turn related exercises into a series: link each project to a guided learning path, record what you completed and learned, and identify the next topic you intend to study. PortSwigger supports guided learning paths and tracked progress. NIST NICE also curates education and training resources, including cyber ranges and work-based learning, that can help you choose projects aligned with a career direction: PortSwigger learning paths and NIST NICE resources.
Make the authorization and scope visible
Put scope near the top of every project page or report, before the technical walkthrough. A reviewer should be able to tell what you tested, where it ran, and what you deliberately excluded.
- Name the environment: identify Juice Shop, the specific Academy lab, or another system you own or have explicit authorization to assess.
- Draw the boundary: say which application, lab instance, or exercise was in scope. Do not imply that a finding was observed on a real target if it came from a training exercise.
- Keep activity inside that boundary: do not scan, probe, or test unrelated systems, neighboring services, or public sites without explicit permission.
- Label lab data: make clear when screenshots, accounts, requests, logs, or records are synthetic or generated for the exercise.
The Academy’s stated purpose is to help people learn web security “in a safe and legal manner” (PortSwigger). Treat that as a boundary for practice, not as permission to test other systems.
Rank #2
- Toys that Teach: MindWare Detective Lab teaches basic forensics, data collection and critical thinking with science experiments that are safe, easy and fun! You’ll learn about chromatography, pH, and basic analysis.
- Scene of the Crime: Delve into the evidence like a real forensic detective! Learn how to lift and compare fingerprints, write secret messages and identify chemicals using the pH scale.
- User-Friendly Fingerprint Kit: This kids detective game includes a fingerprint kit for kids to learn how to lift and compare fingerprints, adding a realistic touch to their kid detective games
- Guide Book: The colorful, detailed guide booklet includes step-by-step instructions and safety information, plus a mysterious code to crack!
- Comprehensive Forensic for Kids Kit: Great as a girls detective kit and boys detective kit alike, this evidence kit for kids includes all necessary supplies for forensics experiments, plus a full-color guide book (Ages 8 and up)
Use a repeatable report structure
A useful portfolio artifact lets a technical reader reproduce your reasoning while giving a hiring reader a quick, accurate summary. For each project, organize the evidence in a consistent sequence.
- Summary: state the question you investigated, the environment, and the result in a few sentences.
- Scope and setup: name the lab or application, how it was run or accessed, and what was in and out of scope. For a local Juice Shop project, include the relevant setup details so another learner can recreate the environment.
- Method: explain the steps you took, including how you mapped the application or narrowed the attack surface where relevant. Give enough detail to reproduce the observation without encouraging activity outside the lab.
- Evidence: add concise screenshots, sanitized requests and responses, logs, code, or configuration snippets that support the specific claim. Remove credentials, personal information, tokens, and unrelated data.
- Analysis: explain the observed behavior, the security concept involved, and the impact within the stated environment.
- Mitigation: recommend a proportionate defensive fix and explain how it addresses the behavior you demonstrated.
- Learning note: say what the exercise taught you and, if it belongs to a series, what you plan to study next.
Distinguish evidence from interpretation. For example, show the relevant sanitized behavior first, then explain why it indicates an access-control weakness. Avoid presenting a lab result as proof that a different system is vulnerable.
Connect projects to a credible learning direction
Use role descriptions and learning resources to choose a coherent theme, such as web application security, rather than presenting a collection of unrelated exercises as proof of broad expertise. NIST NICE curates training and work-based learning resources, while PortSwigger’s paths can help organize web-security practice. A project series can show progression, but it should claim only the skills its exercises actually demonstrate.
The OWASP Juice Shop companion guide is freely readable online, and its latest officially released edition is also available free in digital formats. Use it to understand the training application and shape a project; cite the exact environment and work you completed rather than presenting guide material as your own testing.
Keep claims proportional to the work
A strong portfolio demonstrates careful scope, clear reasoning, and reproducible communication. It does not guarantee a job or establish a formal hiring standard. Be precise about whether a result came from a local intentionally vulnerable app, a hosted training lab, or an authorized assessment; do not let polished presentation make a lab exercise sound like a real-world engagement.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
