OWASP Vulnerable Web Applications Directory
Random App of the Day
| App. URL | Author | Reference(s) | Technology(ies) | Note(s) |
|---|---|---|---|---|
CVWA - Conviso Vulnerable Web Application |
Conviso AppSec |
|
 |
VWAD
The OWASP Vulnerable Web Applications Directory (VWAD) Project is a comprehensive and well maintained registry of known vulnerable web and mobile applications currently available. These vulnerable web applications can be used by web developers, security auditors, and penetration testers to practice their knowledge and skills during training sessions (and especially afterwards), as well as to test at any time the multiple hacking tools and offensive techniques available, in preparation for their next real-world engagement.
The main goal of VWAD is to provide a list of vulnerable applications available to security professionals for hacking, offensive and defensive activities, so that they can manipulate realistic web environments… without going to jail 
The vulnerable web applications have been classified in four categories: Online, Offline, Mobile, and VMs/ISOs. Each list has been ordered alphabetically.
An initial list that inspired this project was maintained till October 2013 here.
A brief description of the OWASP VWAD project is available here.
The associated GitHub repository is available here.
On-line Resources Used
- Hacking Vulnerable Web Applications Without Going To Jail
- Vulnerable Web Applications for learning
- OWASP BWA User Guide
Other Vulnerable Web-app Compilations
Mobile
| App. URL | Author | Reference(s) | Technology(ies) | Note(s) |
|---|---|---|---|---|
AndroGoat |
satishpatnayak |
|
 |
|
Damn Vulnerable Bank |
Rewanth Tammana, Akshansh Jaiswal, Hrushikesh Kakade |
|
 |
|
Goatlin |
Checkmarx |
|
 |
|
MSTG CrackMes |
OWASP |
|
|
 |
MSTG Hacking Playground |
OWASP |
|
 |
Offline
| App. URL | Author | Reference(s) | Technology(ies) | Note(s) |
|---|---|---|---|---|
.NET Goat |
OWASP |
|
|
Original main repo: https://github.com/jerryhoff/WebGoat.NET. Others: https://github.com/rapPayne/WebGoat.Net , https://github.com/jowasp/WebGoat.NET. |
Altoro Mutual (AltoroJ) |
IBM/Watchfire |
|
Log in with jsmith/demo1234 or admin/admin |
|
AuthLab |
digininja (Robin Wood) |
|
 |
|
BodgeIt Store |
Simon Bennetts (psiinon) |
|
 |
|
|
Bricks |
OWASP |
|
|
|
Broken Crystals |
NeuraLegion |
|
 |
|
|
Butterfly Security Project |
|
|
Last updated in 2008 |
|
|
CVWA - Conviso Vulnerable Web Application |
Conviso AppSec |
|
|
|
CloudGoat |
Rhino Security Labs |
|
 |
|
CryptOMG |
SpiderLabs |
|
 |
|
Cyclone Transfers |
 |
|
|
 |
DIWA - Deliberately Insecure Web Application |
Tim Steufmehl |
|
A Deliberately Insecure Web Application |
|
Damn Small Vulnerable Web (DSVW) |
Miroslav Stampar |
|
|
 |
Damn Vulnerable Application Scanner (DVAS) |
Andrea Valenza, Enrico Russo, Gabriele Costa |
|
An intentionally vulnerable web application scanner |
|
Damn Vulnerable Electron App (DVEA) |
Najam Ul Saqib (cybersoldier) |
|
A deliberately insecure ElectronJS application |
|
Damn Vulnerable File Upload - DVFU |
Thin Ba Shane (@art0flunam00n) |
|
|
 |
Damn Vulnerable Functions as a Service (DVFaaS) |
we45 (Abhay Bhargav) |
|
 |
|
Damn Vulnerable GraphQL Application (DVGA) |
Dolev Farhi <[email protected]>, Connor McKinnon |
|
|
 |
Damn Vulnerable Node Application - DVNA |
Claudio Lacayo |
|
|
 |
Damn Vulnerable NodeJS Application - DVNA |
@appsecco |
|
|
Different project from the old DVNA |
Damn Vulnerable OAuth 2.0 Applications |
Koen Buyens |
|
|
A set of vulnerable applications which show Oauth2.0 vulnerabilities. |
Damn Vulnerable Python Web Application - DVPWA |
Oleksandr Kovalchuk |
|
|
 |
Damn Vulnerable Restaurant |
theowni |
|
Damn Vulnerable Restaurant is an intentionally vulnerable Web API game for learning and training purposes dedicated to developers, ethical hackers and security engineers. |
|
Damn Vulnerable Serverless App (DVSA) |
Protego Labs |
|
 |
|
Damn Vulnerable Stateful WebApp |
dnet |
|
 |
|
Damn Vulnerable Web Application - DVWA |
RandomStorm |
|
 |
|
Damn Vulnerable Web Services |
snoopysecurity |
|
|
 |
Damn Vulnerable Web Sockets |
@appsecco |
|
|
 |
DjangoGoat |
Red and Black |
|
|
 |
EasyBuggy |
Kohei Tamura |
|
 |
|
Extreme Vulnerable Node Application |
vegabird |
|
 |
|
FFUF.me |
adamtlangley |
|
Target practice for ffuf |
|
Generic-University |
Katie Paxton-Fear  |
|
|
 |
Goof |
Snyk |
|
online - via Heroku deploy |
|
|
Gruyere |
Google |
|
|
|
Hackademic Challenges Project |
OWASP |
|
 |
|
Hackazon |
Rapid7 (NTObjectives) |
|
 |
|
|
Hackxor |
albinowax |
|
First 2 levels online, rest offline. Web application hacking game via missions, based on real vulnerabilities. |
|
|
Hacme Bank |
McAfee / Foundstone |
|
|
|
|
Hacme Bank - Android |
McAfee / Foundstone |
|
|
|
|
Hacme Books |
McAfee / Foundstone |
|
|
|
|
Hacme Casino |
McAfee / Foundstone |
|
|
|
|
Hacme Shipping |
McAfee / Foundstone |
|
|
|
|
Hacme Travel |
McAfee / Foundstone |
|
|
|
Hammer |
iknowjason |
|
Includes manual build and docker options. |
|
|
LAMPSecurity |
|
|
|
|
Magical Code Injection Rainbow - MCIR |
SpiderLabs |
|
|
 |
Marathon |
Christian Schneider |
|
|
Vulnerable demo application |
Mutillidae |
 |
|
 |
|
NoSQL Injection Lab |
@digininja |
|
 |
|
NoSQL Injection Vulnerable App (NIVA) |
Anton Abashkin |
|
 |
|
NodeGoat |
OWASP |
|
 |
|
NodeVulnerable |
cr0hn |
|
|
 |
OSTE-Vulnerable-Web-Application |
(OSTE)Oudjani seyyid taqi eddine |
|
|
Vulnerable web application |
|
OWASP Damn Vulnerable Web Sockets (DVWS) |
Abhineet Jayaraj (@xploresec) |
|
|
|
OWASP Juice Shop |
OWASP |
|
 |
|
OWASP SKF Labs |
[email protected] and [email protected] |
|
You can go to the demo website and login(admin / test-skf) or skip login, go to Labs menu and start a Lab you want to do. Please limit the usage of scanning tools on the Labs. |
|
OWASP VulnerableApp |
Karan Preet Singh Sasan |
|
 |
|
OWASP VulnerableApp-facade |
Karan Preet Singh Sasan |
|
 |
|
|
Peruggia |
|
|
|
|
Pixi |
OWASP |
|
 |
|
|
Puzzlemall |
|
|
|
|
PyGoat |
Ade Yoseman |
|
 |
|
Race The Web |
insp3ctre |
|
 |
|
Rails Goat |
OWASP |
|
 |
|
SQL injection test environment |
 |
|
|
SQLmap Project |
SQLI-labs |
 |
|
 |
|
SQLol |
 |
|
 |
|
SSRF Vuln Lab |
incredibleindishell, Mohammed Farhan |
|
 |
|
SecDevLabs |
Globo |
|
Repository with many intentionally vulnerable web applications. Includes attack narratives and docker options for each app. |
|
Security Shepherd |
OWASP |
|
 |
|
TicketMagpie |
 |
|
 |
|
Tiredful API |
@payatu |
|
 |
|
UnSAFE Bank |
lucideus |
|
|
Web, Android and iOS application |
Varnish HTTP/2 Request Smuggling |
Detectify |
|
A docker-compose file to setup a local environment that is vulnerable to CVE-2021-36740 Varnish HTTP/2 request smuggling, presented by Albinowax at Blackhat/Defcon 2021. |
|
VulnLab |
Yavuzlar (siberyavuzlar.com) |
|
|
A web vulnerability lab project developed by Yavuzlar. |
Vulnerable Java Web Application |
Cyber Security and Privacy Foundation |
|
|
 |
Vulnerable Node Express |
Zachary Conger |
|
|
SQLi and XSS |
Vulnerable OTP App |
mddanish |
|
|
 |
Vulnerable SAML App |
yogisec |
|
|
 |
VulnerableLightApp |
Michael Vacarella |
|
Vulnerable API for educational purposes |
|
VulnerableXsltConsoleApplication |
Context Information Security |
|
|
This is a console app, however it relates to an issues that is relevant to web apps: use of XSLT transforms for XML files. |
WAVSEP - Web Application Vulnerability Scanner Evaluation Project |
Shay Chen |
|
 |
|
|
WIVET- Web Input Vector Extractor Teaser |
|
|
|
|
WackoPicko |
 |
|
 |
|
WebGoat |
OWASP |
|
 |
|
WebGoatPHP |
OWASP |
|
 |
|
WrongSecrets |
Jeroen Willemsen (@commjoen), Ben de Haan (@bendehaan), Nanne Baars (@nbaars) |
|
OWASP WrongSecrets is a vulnerable app used to show how to not use secrets. |
|
XXE Lab |
Joshua Barone |
|
|
 |
Xtreme Vulnerable Web Application (XVWA) |
@s4n7h0, @samanL33T |
|
 |
|
|
Yrprey |
Fernando Mengali, Vagner Mengali |
|
Framework created in NextJs (TypeScript) and PHP/MySQL with OWASP TOP 10 API vulnerabilities of 2019 and 2023. Yrprey can was created for educational purposes, contributing to the teaching and learning of those interested in Pentest (intrusion testing) and Application Security (Appsec). |
|
|
YrpreyPHP |
Fernando Mengali |
|
A framework created in PHP/MySQL with OWASP TOP 10 Web Application vulnerabilities. YrpreyPHP was created for educational purposes, contributing to the teaching and learning of those interested in Pentest (intrusion testing) and Application Security (AppSec). |
|
|
bWAPP |
|
|
|
|
crAPI |
OWASP |
|
 |
|
dvws-node |
@snoopysecurity |
|
 |
|
insecure-deserialisation-net-poc |
Omer Levi Hevroni |
|
|
A small webserver vulnerable to insecure deserialization |
jwtdemo |
Sjoerd Langkemper (Sjord) |
|
Practice hacking JWT tokens. |
|
play-webgoat |
 |
|
|
 |
twitterlike |
Sakti Dwi Cahyono |
|
 |
|
vAPI |
Tushar Kulkarni |
|
vAPI is a Vulnerable Interface that demonstrates the OWASP API Top 10 vulnerabilities in the means of exercises |
|
vulnerable-api |
Matthew Valdes |
|
 |
|
websheep |
Younes Jaaidi (yjaaidi) |
|
Websheep is an app based on a willingly vulnerable ReSTful APIs. |
Online
| App. URL | Author | Reference(s) | Technology(ies) | Note(s) |
|---|---|---|---|---|
|
Acuart |
Acunetix |
|
Art shopping |
|
|
Altoro Mutual (AltoroJ) |
IBM/Watchfire |
|
Log in with jsmith/demo1234 or admin/admin |
|
|
AuthLab |
digininja (Robin Wood) |
|
|
|
|
BGA Vulnerable BANK App |
BGA Security |
|
|
|
|
Broken Crystals |
NeuraLegion |
|
|
|
|
CTFLearn |
@ctflearn |
|
|
|
Cyber Scavenger Hunt |
Arthur Kay |
|
A simple scavenger hunt to learn about pentesting a website or web application. |
|
|
Defend the Web |
Luke [flabbyrabbit] |
|
Formerly HackThis |
|
|
FFUF.me |
adamtlangley |
|
Target practice for ffuf |
|
Firing Range |
Google |
|
 |
|
|
Game of Hacks |
Checkmarx |
|
|
|
|
Gin & Juice Shop |
PortSwigger |
|
A hosted always-online demo app with realistic technologies. |
|
|
Gruyere |
Google |
|
|
|
|
Hack.me |
eLearnSecurity |
|
|
Beta |
HackThis |
Luke Ward (0x6C77) |
|
 |
|
|
HackThisSite |
HackThisSite Staff |
|
Always-on CTF challenges including Basic, Realistic, Application, Steganography, and many others. |
|
|
HackXpert |
theXSSrat |
|
|
|
|
HackYourselfFirst |
Troy Hunt |
|
|
|
|
Hacking Lab |
Hacking Lab |
|
|
|
|
Hackxor |
albinowax |
|
First 2 levels online, rest offline. Web application hacking game via missions, based on real vulnerabilities. |
|
|
Netsparker Test App .NET |
Netsparker |
|
|
|
|
Netsparker Test App PHP |
Netsparker |
|
|
|
|
OWASP Juice Shop |
OWASP |
|
|
|
|
OWASP SKF Labs |
[email protected] and [email protected] |
|
You can go to the demo website and login(admin / test-skf) or skip login, go to Labs menu and start a Lab you want to do. Please limit the usage of scanning tools on the Labs. |
|
|
Pentest-Ground |
Pentest-Tools.com |
|
|
Suite of vulnerable web apps to practice |
|
Pentester Academy |
|
|
|
|
|
PyGoat |
Ade Yoseman |
|
|
|
|
Security Tweets |
Acunetix |
|
HTML5 |
|
|
Solyd - Introdução ao Hacking e Pentest |
Solyd |
|
|
In Portuguese (Português) - Free online trainning with free online lab |
|
Zero Bank |
Micro Focus Fortify (was HP/SpiDynamics) |
|
(username/password) |
VM-ISO
| App. URL | Author | Reference(s) | Technology(ies) | Note(s) |
|---|---|---|---|---|
|
Bee-Box |
|
|
|
|
|
BodgeIt Store |
Simon Bennetts (psiinon) |
|
|
|
|
Broken Web Applications Project (BWA) - OWASP |
OWASP - Chuck Willis |
|
|
|
CI/CD Goat |
Cider |
|
|
Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, capture the flags. |
|
CloudGoat |
Rhino Security Labs |
|
|
|
|
DIWA - Deliberately Insecure Web Application |
Tim Steufmehl |
|
A Deliberately Insecure Web Application |
|
|
Damn Vulnerable GraphQL Application (DVGA) |
Dolev Farhi <[email protected]>, Connor McKinnon |
|
|
|
|
Damn Vulnerable Web Application - DVWA |
RandomStorm |
|
|
|
|
Exploit.co.il Vuln Web App |
|
|
|
|
|
FFUF.me |
adamtlangley |
|
Target practice for ffuf |
|
Game of Active Directory |
Orange-Cyberdefense |
|
Requires a considerably powerful system |
|
|
GameOver |
|
|
|
|
|
Generic-University |
Katie Paxton-Fear |
|
|
|
|
Goof |
Snyk |
|
online - via Heroku deploy |
|
|
Hackxor |
albinowax |
|
First 2 levels online, rest offline. Web application hacking game via missions, based on real vulnerabilities. |
|
|
LAMPSecurity |
|
|
|
|
Log4Shell sample vulnerable application |
Christophe Tafani-Dereeper, Gerard Arall, rayhan0x01 Rayhan Ahmed |
|
|
CVE-2021-44228 |
|
Metasploitable 2 |
|
|
|
|
Metasploitable 3 |
 |
|
 |
|
|
Moth |
|
|
|
|
|
NoSQL Injection Vulnerable App (NIVA) |
Anton Abashkin |
|
|
|
|
OWASP Juice Shop |
OWASP |
|
|
|
|
PentesterLab - The Exercises |
|
|
|
|
|
Pixi |
OWASP |
|
|
|
|
PyGoat |
Ade Yoseman |
|
|
|
|
Samurai WTF |
|
|
|
|
|
Sauron |
|
|
|
|
Security Labs & POCs |
DataDog |
|
|
 |
VAmPI |
erev0s |
|
 |
|
|
Virtual Hacking Lab |
|
|
|
|
Vulnado |
ScaleSec |
|
|
Purposely vulnerable Java application to help lead secure coding workshops |
|
Web Security Dojo |
|
|
|
|
|
XXE |
|
|
|
|
|
XXE Lab |
Joshua Barone |
|
|
|
|
crAPI |
OWASP |
|
|
|
|
dvws-node |
@snoopysecurity |
|
|