For example, after six months of training we can ask a few fellow hacking buddies to try to exploit our web applications using the types of attacks we have defined; or we can conversely set up a vulnerable system of our own in a virtual lab and try out these attacks ourselves.