OWASP Vulnerable Web Applications Directory
Random App of the Day
| App. URL | Author | Reference(s) | Technology(ies) | Note(s) |
|---|---|---|---|---|
|
WAVSEP - Web Application Vulnerability Scanner Evaluation Project |
Shay Chen |
|
|
VWAD
The OWASP Vulnerable Web Applications Directory (VWAD) Project is a comprehensive and well maintained registry of known vulnerable web and mobile applications currently available. These vulnerable web applications can be used by web developers, security auditors, and penetration testers to practice their knowledge and skills during training sessions (and especially afterwards), as well as to test at any time the multiple hacking tools and offensive techniques available, in preparation for their next real-world engagement.
The main goal of VWAD is to provide a list of vulnerable applications available to security professionals for hacking, offensive and defensive activities, so that they can manipulate realistic web environments… without going to jail 
The vulnerable web applications have been classified in four categories: Online, Offline, Mobile, and VMs/ISOs. Each list has been ordered alphabetically.
An initial list that inspired this project was maintained till October 2013 here.
A brief description of the OWASP VWAD project is available here.
On-line Resources Used
- Hacking Vulnerable Web Applications Without Going To Jail
- Vulnerable Web Applications for learning
- OWASP BWA User Guide
Other Vulnerable Web-app Compilations
Mobile
| App. URL | Author | Reference(s) | Technology(ies) | Note(s) |
|---|---|---|---|---|
|
AndroGoat |
satishpatnayak |
|
|
|
|
Damn Vulnerable Bank |
Rewanth Tammana, Akshansh Jaiswal, Hrushikesh Kakade |
|
|
|
|
Goatlin |
Checkmarx |
|
|
|
|
MSTG CrackMes |
OWASP |
|
|
|
|
MSTG Hacking Playground |
OWASP |
|
|
Offline
| App. URL | Author | Reference(s) | Technology(ies) | Note(s) |
|---|---|---|---|---|
|
.NET Goat |
OWASP |
|
|
Original main repo: https://github.com/jerryhoff/WebGoat.NET. Others: https://github.com/rapPayne/WebGoat.Net , https://github.com/jowasp/WebGoat.NET. |
|
AI-Goat |
fhammon, Guanwei Hu |
|
AI Goat uses the Vicuna LLM which derived from Meta's LLaMA and coupled with ChatGPT's response data. When installing AI Goat the LLM binary is downloaded from third party locally on your computer. |
|
|
Altoro Mutual (AltoroJ) |
IBM/Watchfire |
|
Log in with jsmith/demo1234 or admin/admin |
|
|
AuthLab |
digininja (Robin Wood) |
|
|
|
|
BodgeIt Store |
Simon Bennetts (psiinon) |
|
|
|
|
Bricks |
OWASP |
|
|
|
|
Broken Crystals |
NeuraLegion |
|
|
|
|
Butterfly Security Project |
|
|
Last updated in 2008 |
|
|
CVWA - Conviso Vulnerable Web Application |
Conviso AppSec |
|
|
|
|
CloudGoat |
Rhino Security Labs |
|
|
|
|
CryptOMG |
SpiderLabs |
|
|
|
|
Cyclone Transfers |
|
|
|
|
|
DIWA - Deliberately Insecure Web Application |
Tim Steufmehl |
|
A Deliberately Insecure Web Application |
|
|
Damn Small Vulnerable Web (DSVW) |
Miroslav Stampar |
|
|
|
|
Damn Vulnerable Application Scanner (DVAS) |
Andrea Valenza, Enrico Russo, Gabriele Costa |
|
An intentionally vulnerable web application scanner |
|
|
Damn Vulnerable C# Application (API) |
Appsecco |
|
|
|
|
Damn Vulnerable Electron App (DVEA) |
Najam Ul Saqib (cybersoldier) |
|
A deliberately insecure ElectronJS application |
|
|
Damn Vulnerable File Upload - DVFU |
Thin Ba Shane (@art0flunam00n) |
|
|
|
|
Damn Vulnerable Functions as a Service (DVFaaS) |
we45 (Abhay Bhargav) |
|
|
|
|
Damn Vulnerable GraphQL Application (DVGA) |
Dolev Farhi <[email protected]>, Connor McKinnon |
|
|
|
|
Damn Vulnerable Node Application - DVNA |
Claudio Lacayo |
|
|
|
|
Damn Vulnerable NodeJS Application - DVNA |
@appsecco |
|
|
Different project from the old DVNA |
|
Damn Vulnerable OAuth 2.0 Applications |
Koen Buyens |
|
|
A set of vulnerable applications which show Oauth2.0 vulnerabilities. |
|
Damn Vulnerable Python Web Application - DVPWA |
Oleksandr Kovalchuk |
|
|
|
|
Damn Vulnerable Restaurant |
theowni |
|
Damn Vulnerable Restaurant is an intentionally vulnerable Web API game for learning and training purposes dedicated to developers, ethical hackers and security engineers. |
|
|
Damn Vulnerable Serverless App (DVSA) |
Protego Labs |
|
|
|
|
Damn Vulnerable Stateful WebApp |
dnet |
|
|
|
|
Damn Vulnerable Web Application - DVWA |
RandomStorm |
|
|
|
|
Damn Vulnerable Web Services |
snoopysecurity |
|
|
|
|
Damn Vulnerable Web Sockets |
@appsecco |
|
|
|
|
DjangoGoat |
Red and Black |
|
|
|
|
EasyBuggy |
Kohei Tamura |
|
|
|
|
Extreme Vulnerable Node Application |
vegabird |
|
|
|
|
FFUF.me |
adamtlangley |
|
Target practice for ffuf |
|
|
Generic-University |
Katie Paxton-Fear |
|
|
|
|
Goof |
Snyk |
|
online - via Heroku deploy |
|
|
Gruyere |
Google |
|
|
|
|
Hackademic Challenges Project |
OWASP |
|
|
|
|
Hackazon |
Rapid7 (NTObjectives) |
|
|
|
|
Hackxor |
albinowax |
|
First 2 levels online, rest offline. Web application hacking game via missions, based on real vulnerabilities. |
|
|
Hacme Bank |
McAfee / Foundstone |
|
|
|
|
Hacme Bank - Android |
McAfee / Foundstone |
|
|
|
|
Hacme Books |
McAfee / Foundstone |
|
|
|
|
Hacme Casino |
McAfee / Foundstone |
|
|
|
|
Hacme Shipping |
McAfee / Foundstone |
|
|
|
|
Hacme Travel |
McAfee / Foundstone |
|
|
|
|
Hammer |
iknowjason |
|
Includes manual build and docker options. |
|
|
LAMPSecurity |
|
|
|
|
|
Magical Code Injection Rainbow - MCIR |
SpiderLabs |
|
|
|
|
Marathon |
Christian Schneider |
|
|
Vulnerable demo application |
|
Mutillidae |
|
|
|
|
|
NoSQL Injection Lab |
@digininja |
|
|
|
|
NoSQL Injection Vulnerable App (NIVA) |
Anton Abashkin |
|
|
|
|
NodeGoat |
OWASP |
|
|
|
|
NodeVulnerable |
cr0hn |
|
|
|
|
OSTE-Vulnerable-Web-Application |
(OSTE)Oudjani seyyid taqi eddine |
|
|
Vulnerable web application |
|
OWASP Damn Vulnerable Web Sockets (DVWS) |
Abhineet Jayaraj (@xploresec) |
|
|
|
|
OWASP Juice Shop |
OWASP |
|
|
|
|
OWASP SKF Labs |
[email protected] and [email protected] |
|
You can go to the demo website and login(admin / test-skf) or skip login, go to Labs menu and start a Lab you want to do. Please limit the usage of scanning tools on the Labs. |
|
|
OWASP VulnerableApp |
Karan Preet Singh Sasan |
|
|
|
|
OWASP VulnerableApp-facade |
Karan Preet Singh Sasan |
|
|
|
|
Peruggia |
|
|
|
|
|
Pixi |
OWASP |
|
|
|
|
Puzzlemall |
|
|
|
|
|
PyGoat |
Ade Yoseman |
|
|
|
|
Race The Web |
insp3ctre |
|
|
|
|
Rails Goat |
OWASP |
|
|
|
|
SQL injection test environment |
|
|
|
SQLmap Project |
|
SQLI-labs |
|
|
|
|
|
SQLol |
|
|
|
|
|
SSRF Vuln Lab |
incredibleindishell, Mohammed Farhan |
|
|
|
|
SecDevLabs |
Globo |
|
Repository with many intentionally vulnerable web applications. Includes attack narratives and docker options for each app. |
|
|
Security Shepherd |
OWASP |
|
|
|
|
TicketMagpie |
|
|
|
|
|
Tiredful API |
@payatu |
|
|
|
|
UnSAFE Bank |
lucideus |
|
|
Web, Android and iOS application |
|
Varnish HTTP/2 Request Smuggling |
Detectify |
|
A docker-compose file to setup a local environment that is vulnerable to CVE-2021-36740 Varnish HTTP/2 request smuggling, presented by Albinowax at Blackhat/Defcon 2021. |
|
|
VulnLab |
Yavuzlar (siberyavuzlar.com) |
|
|
A web vulnerability lab project developed by Yavuzlar. |
|
Vulnerable Java Web Application |
Cyber Security and Privacy Foundation |
|
|
|
|
Vulnerable Node Express |
Zachary Conger |
|
|
SQLi and XSS |
|
Vulnerable OTP App |
mddanish |
|
|
|
|
Vulnerable SAML App |
yogisec |
|
|
|
|
VulnerableLightApp |
Michael Vacarella |
|
Vulnerable API for educational purposes |
|
|
VulnerableXsltConsoleApplication |
Context Information Security |
|
|
This is a console app, however it relates to an issues that is relevant to web apps: use of XSLT transforms for XML files. |
|
WAVSEP - Web Application Vulnerability Scanner Evaluation Project |
Shay Chen |
|
|
|
|
WIVET- Web Input Vector Extractor Teaser |
|
|
|
|
|
WackoPicko |
|
|
|
|
|
WebGoat |
OWASP |
|
|
|
|
WebGoatPHP |
OWASP |
|
|
|
|
WrongSecrets |
Jeroen Willemsen (@commjoen), Ben de Haan (@bendehaan), Nanne Baars (@nbaars) |
|
OWASP WrongSecrets is a vulnerable app used to show how to not use secrets. |
|
|
XXE Lab |
Joshua Barone |
|
|
|
|
Xtreme Vulnerable Web Application (XVWA) |
@s4n7h0, @samanL33T |
|
|
|
|
Yrprey |
Fernando Mengali, Vagner Mengali |
|
Framework created in NextJs (TypeScript) and PHP/MySQL with OWASP TOP 10 API vulnerabilities of 2019 and 2023. Yrprey can was created for educational purposes, contributing to the teaching and learning of those interested in Pentest (intrusion testing) and Application Security (Appsec). |
|
|
YrpreyBlog |
Fernando Mengali |
|
A framework created in PHP/MySQL with OWASP TOP 10 Web Application vulnerabilities. |
|
|
YrpreyC |
Fernando Mengali |
|
YrpreyC is a framework written in the C language that contains vulnerabilities related to memory issues, categorized as overflows |
|
|
YrpreyC++ |
Fernando Mengali |
|
YrpreyC++ is a framework written in the C++ language that contains vulnerabilities related to memory issues, categorized as overflows |
|
|
YrpreyPHP |
Fernando Mengali |
|
A framework created in PHP/MySQL with OWASP TOP 10 Web Application vulnerabilities. YrpreyPHP was created for educational purposes, contributing to the teaching and learning of those interested in Pentest (intrusion testing) and Application Security (AppSec). |
|
|
YrpreyPathTraversal |
Fernando Mengali |
|
YrpreyPathTraversal is a framework written in PHP, with examples of exploiting Path Traversal and Local File Inclusion vulnerabilities in different ways. |
|
|
bWAPP |
|
|
|
|
|
crAPI |
OWASP |
|
|
|
|
dvws-node |
@snoopysecurity |
|
|
|
|
insecure-deserialisation-net-poc |
Omer Levi Hevroni |
|
|
A small webserver vulnerable to insecure deserialization |
|
jwtdemo |
Sjoerd Langkemper (Sjord) |
|
Practice hacking JWT tokens. |
|
|
play-webgoat |
|
|
|
|
|
twitterlike |
Sakti Dwi Cahyono |
|
|
|
|
vAPI |
Tushar Kulkarni |
|
vAPI is a Vulnerable Interface that demonstrates the OWASP API Top 10 vulnerabilities in the means of exercises |
|
|
vulnerable-api |
Matthew Valdes |
|
|
|
|
websheep |
Younes Jaaidi (yjaaidi) |
|
Websheep is an app based on a willingly vulnerable ReSTful APIs. |
|
|
ypreyAPINodeJS |
Fernando Mengali |
|
yrpreyAPINodeJS is a vulnerable framework written in NodeJS and based on the OWASP TOP 10 API. |
|
|
ypreyAPIPython |
Fernando Mengali |
|
ypreyAPIPython is a vulnerable framework written in Python and based on the OWASP TOP 10 API. |
|
|
ypreyPollsPHP |
Fernando Mengali |
|
ypreyPollsPHP is a vulnerable framework written in PHP with a polls management scenario, based on the OWASP TOP 10 |
|
|
yrpreyASPC |
Fernando Mengali |
|
yrpreyASPC is a vulnerable framework written in ASP and C with vulnerabilities based on Buffer Overflow, Command Injection, and web application vulnerabilities. |
|
|
yrpreyASPCPlus |
Fernando Mengali |
|
yrpreyASPCPlus is a vulnerable framework written in ASP and C++ with vulnerabilities based on Buffer Overflow, Command Injection, and web application vulnerabilities. |
|
|
yrpreyFinance |
Fernando Mengali |
|
yrpreyFinance is a vulnerable framework written in PHP with a financial management scenario, based on the OWASP TOP 10 |
|
|
yrpreyLibrary |
Fernando Mengali |
|
yrpreyLibrary is a vulnerable framework written in PHP, based on the OWASP TOP 10 |
|
|
yrpreyPollsNodeJS |
Fernando Mengali |
|
yrpreyPollsNodeJS is a vulnerable framework written in NodeJS with a polls management scenario, based on the OWASP TOP 10 |
|
|
yrpreyPollsPerl |
Fernando Mengali |
|
yrpreyPollsPerl is a vulnerable framework written in Perl with a polls management scenario, based on the OWASP TOP 10 |
|
|
yrpreyPollsPython |
Fernando Mengali |
|
yrpreyPollsPython is a vulnerable framework written in Python with a polls management scenario, based on the OWASP TOP 10 |
|
|
yrpreyTasks |
Fernando Mengali |
|
yrpreyTasks is a vulnerable framework written in PHP with a task management scenario, based on the OWASP TOP 10 |
|
|
yrpreyTasksNodeJS |
Fernando Mengali |
|
yrpreyTasksNodeJS is a vulnerable framework written in NodeJS with a task management scenario, based on the OWASP TOP 10 |
|
|
yrpreyTasksPython |
Fernando Mengali |
|
yrpreyTasksPython is a vulnerable framework written in Python with a task management scenario, based on the OWASP TOP 10 |
Online
| App. URL | Author | Reference(s) | Technology(ies) | Note(s) |
|---|---|---|---|---|
|
Acuart |
Acunetix |
|
Art shopping |
|
|
Altoro Mutual (AltoroJ) |
IBM/Watchfire |
|
Log in with jsmith/demo1234 or admin/admin |
|
|
AuthLab |
digininja (Robin Wood) |
|
|
|
|
BGA Vulnerable BANK App |
BGA Security |
|
|
|
|
Broken Crystals |
NeuraLegion |
|
|
|
|
BugBait - Vulnerable Web Application |
Blacklock Security |
|
bugbait.io is a vulnerable web application for students, developers, cyber enthusiasts and pen testers to identify and exploit the vulnerabilities. |
|
|
CTFLearn |
@ctflearn |
|
|
|
|
Cyber Scavenger Hunt |
Arthur Kay |
|
A simple scavenger hunt to learn about pentesting a website or web application. |
|
|
Defend the Web |
Luke [flabbyrabbit] |
|
Formerly HackThis |
|
|
FFUF.me |
adamtlangley |
|
Target practice for ffuf |
|
|
Firing Range |
Google |
|
|
|
|
Game of Hacks |
Checkmarx |
|
|
|
|
Gin & Juice Shop |
PortSwigger |
|
A hosted always-online demo app with realistic technologies. |
|
|
Gruyere |
Google |
|
|
|
|
Hack.me |
eLearnSecurity |
|
|
Beta |
|
HackThis |
Luke Ward (0x6C77) |
|
|
|
|
HackThisSite |
HackThisSite Staff |
|
Always-on CTF challenges including Basic, Realistic, Application, Steganography, and many others. |
|
|
HackXpert |
theXSSrat |
|
|
|
|
HackYourselfFirst |
Troy Hunt |
|
|
|
|
Hacking Lab |
Hacking Lab |
|
|
|
|
Hackxor |
albinowax |
|
First 2 levels online, rest offline. Web application hacking game via missions, based on real vulnerabilities. |
|
|
Netsparker Test App .NET |
Netsparker |
|
|
|
|
Netsparker Test App PHP |
Netsparker |
|
|
|
|
OWASP Juice Shop |
OWASP |
|
|
|
|
OWASP SKF Labs |
[email protected] and [email protected] |
|
You can go to the demo website and login(admin / test-skf) or skip login, go to Labs menu and start a Lab you want to do. Please limit the usage of scanning tools on the Labs. |
|
|
Pentest-Ground |
Pentest-Tools.com |
|
|
Suite of vulnerable web apps to practice |
|
Pentester Academy |
|
|
|
|
|
PyGoat |
Ade Yoseman |
|
|
|
|
Security Tweets |
Acunetix |
|
HTML5 |
|
|
Solyd - Introdução ao Hacking e Pentest |
Solyd |
|
|
In Portuguese (Português) - Free online trainning with free online lab |
|
Zero Bank |
Micro Focus Fortify (was HP/SpiDynamics) |
|
(username/password) |
VM-ISO
| App. URL | Author | Reference(s) | Technology(ies) | Note(s) |
|---|---|---|---|---|
|
Bee-Box |
|
|
|
|
|
BodgeIt Store |
Simon Bennetts (psiinon) |
|
|
|
|
Broken Web Applications Project (BWA) - OWASP |
OWASP - Chuck Willis |
|
|
|
|
CI/CD Goat |
Cider |
|
|
Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, capture the flags. |
|
CloudGoat |
Rhino Security Labs |
|
|
|
|
DIWA - Deliberately Insecure Web Application |
Tim Steufmehl |
|
A Deliberately Insecure Web Application |
|
|
Damn Vulnerable C# Application (API) |
Appsecco |
|
|
|
|
Damn Vulnerable GraphQL Application (DVGA) |
Dolev Farhi <[email protected]>, Connor McKinnon |
|
|
|
|
Damn Vulnerable Web Application - DVWA |
RandomStorm |
|
|
|
|
Exploit.co.il Vuln Web App |
|
|
|
|
|
FFUF.me |
adamtlangley |
|
Target practice for ffuf |
|
|
Game of Active Directory |
Orange-Cyberdefense |
|
Requires a considerably powerful system |
|
|
GameOver |
|
|
|
|
|
Generic-University |
Katie Paxton-Fear |
|
|
|
|
Goof |
Snyk |
|
online - via Heroku deploy |
|
|
Hackxor |
albinowax |
|
First 2 levels online, rest offline. Web application hacking game via missions, based on real vulnerabilities. |
|
|
LAMPSecurity |
|
|
|
|
|
Log4Shell sample vulnerable application |
Christophe Tafani-Dereeper, Gerard Arall, rayhan0x01 Rayhan Ahmed |
|
|
CVE-2021-44228 |
|
Metasploitable 2 |
|
|
|
|
|
Metasploitable 3 |
|
|
|
|
|
Moth |
|
|
|
|
|
NoSQL Injection Vulnerable App (NIVA) |
Anton Abashkin |
|
|
|
|
OWASP Juice Shop |
OWASP |
|
|
|
|
PentesterLab - The Exercises |
|
|
|
|
|
Pixi |
OWASP |
|
|
|
|
PyGoat |
Ade Yoseman |
|
|
|
|
Samurai WTF |
|
|
|
|
|
Sauron |
|
|
|
|
|
Security Labs & POCs |
DataDog |
|
|
|
|
Template Injection Playground |
Hackmanit and Maximilian Hildebrand |
|
|
|
|
VAmPI |
erev0s |
|
|
|
|
Virtual Hacking Lab |
|
|
|
|
|
Vulnado |
ScaleSec |
|
|
Purposely vulnerable Java application to help lead secure coding workshops |
|
Wayfarer |
SamuraiWTF |
|
|
|
|
Web Security Dojo |
|
|
|
|
|
XXE |
|
|
|
|
|
XXE Lab |
Joshua Barone |
|
|
|
|
crAPI |
OWASP |
|
|
|
|
c{api}tal |
Checkmarx |
|
|
|
|
dvws-node |
@snoopysecurity |
|
|