awesome-vulnerable-apps

Vulnerability Labs

A curated collection of intentionally vulnerable applications and environments to help developers practice security testing and learning about common web application vulnerabilities.

Awesome Vulnerable Applications

GitHub

1k stars
22 watching
165 forks
last commit: about 2 years ago
Linked from 1 awesome list

awesomeawesome-listbugbugbountyhackingpenetration-testingsecurityvulnerablevulnerable-applications

Awesome Vulnerable Applications / Online

Hacker101 CTF
Web Security Academy
Hack The Box
Try Hack Me
CTFtime
PWNABLE.KR
XSS game
Gin & Juice Shop

Awesome Vulnerable Applications / Paid

PentesterLab

Awesome Vulnerable Applications / Vulnerable VMs

Vulhub18,020almost 2 years ago
Exploit Exercises
Metasploitable34,812about 2 years agoMetasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities
Hackmyvm.eu

Awesome Vulnerable Applications / Cloud Security

Kubernetes Goat4,542almost 2 years agoKubernetes Goat is "Vulnerable by Design" Kubernetes Cluster. Designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security
CloudGoat2,991almost 2 years agoCloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool
CdkGoat - Vulnerable AWS CDK Infra44over 3 years agoCdkGoat is Bridgecrew's "Vulnerable by Design" AWS CDK repository
Cfngoat - Vulnerable Cloudformation Template92about 2 years agoCfngoat is Bridgecrew's "Vulnerable by Design" Cloudformation repository
TerraGoat - Vulnerable Terraform Infra1,159about 2 years agoTerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository
caponeme - Capital One Breach241over 5 years agoRepository demonstrating the Capital One breach on your AWS account
WrongSecrets1,246almost 2 years agoWrongSecrets is "Vulnerable by Design" to show how to not handle secrets in Docker, Kubernetes and in the cloud (AWS/GCP/Azure)
AWSGoat1,760almost 2 years agoA Damn Vulnerable AWS Infrastructure
AzureGoat801almost 2 years agoA Damn Vulnerable Azure Infrastructure
IAM Vulnerable482over 2 years agoUse Terraform to create your own vulnerable by design AWS IAM privilege escalation playground
Sadcloud666almost 3 years agoA tool for standing up (and tearing down!) purposefully insecure cloud infrastructure
CNAPPgoat269about 2 years agoCNAPPgoat is a multi-cloud, vulnerable-by-design environment deployment tool
Unguard48almost 2 years agoAn insecure cloud-native microservices demo application for Kubernetes

Awesome Vulnerable Applications / SSO - Single Sign On

vulnerable-sso148about 2 years agovulnerable single sign on

Awesome Vulnerable Applications / Mobile Security

Allsafe217over 2 years agoAllsafe is an intentionally vulnerable application that contains various vulnerabilities
InsecureBankv21,268over 2 years agoVulnerable Android application for developers and security enthusiasts to learn about Android insecurities
Vulnerable Kext231over 5 years agoA WIP "Vulnerable by Design" kext for iOS/macOS to play & learn *OS kernel exploitation
InjuredAndroid670over 5 years agoA vulnerable Android application that shows simple examples of vulnerabilities in a ctf style
Damn Vulnerable Bank656almost 3 years agoDamn Vulnerable Bank is designed to be an intentionally vulnerable android application
InsecureShop234over 4 years agoAn Intentionally designed Vulnerable Android Application built in Kotlin
AndroGoat217over 4 years agoAndroGoat is purposely developed open source vulnerable/insecure app using Kotlin
DIVA Android974over 3 years agoDamn Insecure and vulnerable App for Android
OVAA662about 2 years agoOversecured Vulnerable Android App
Vuldroid62about 5 years agoAndroid Application covering various static and dynamic vulnerabilities
Android Security Testing95almost 3 years agohpAndro1337 Application made in Kotlin with multiple vulnerabilities and a CTF

Awesome Vulnerable Applications / OWASP Top 10

Owasp Juice shop10,585almost 2 years agoOWASP Juice Shop: Probably the most modern and sophisticated insecure web application
DVWA10,423almost 2 years agoDamn Vulnerable Web Application (DVWA)
DSVW794over 2 years agoDamn Small Vulnerable Web
bWAPP133almost 5 years agoThis is just an instance of the OWASP bWAPP project as a docker container
Xtreme Vulnerable Web Application1,700about 6 years agoXVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security
lazyweb116over 4 years agoThis web application is a demonstration of common server-side application flaws. Each of the vulnerabilities has its own difficulty rating
OWASP Mutillidae II1,282almost 2 years agoOWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiast
Pentest_lab182over 3 years agoLocal penetration testing lab using docker-compose
VulnLab396about 2 years agoA vulnerable web application lab using Docker
WebGoat7,096almost 2 years agoWebGoat is a deliberately insecure application by OWASP for training purpose
VAmPI940almost 2 years agoVulnerable REST API with OWASP top 10 vulnerabilities for security testing

Awesome Vulnerable Applications / OWASP Top 10 / SQL Injection

Yet Another Vulnerability Database15about 5 years agoYet Another Vulnerability Database

Awesome Vulnerable Applications / OWASP Top 10 / XSS Injection

clicker-service - simulate XSSDocker container that intakes post and then "clicks" the link. Intentionally vulnerable. To be used with vulnerable by design web apps to realistically simulate XSS and XSRF (CSRF)
XSSworm.dev6almost 6 years agoSelf-replication contest
xssed37over 13 years agoA set of XSS vulnerable PHP scripts for testing
xssable9almost 3 years agoA vulnerable blogging platform used to demonstrate XSS vulnerabilities

Awesome Vulnerable Applications / OWASP Top 10 / Server Side Request Forgery

SSRF_Vulnerable_Lab679about 3 years agoThis Lab contain the sample codes which are vulnerable to Server-Side Request Forgery attack

Awesome Vulnerable Applications / OWASP Top 10 / CORS Misconfiguration

CORS-vulnerable-Lab189over 5 years agoSample vulnerable code and its exploit code
CORS misconfiguration vulnerable Lab65about 5 years agoThis Repository contains CORS misconfiguration related vulnerable codes

Awesome Vulnerable Applications / OWASP Top 10 / XXE Injection

XXE Lab225almost 5 years agoA simple web app with a XXE vulnerability
docker-java-xxe5almost 8 years agoDocker image to test XXE attacks in java with tomcat

Awesome Vulnerable Applications / OWASP Top 10 / Request Smuggling

Varnish HTTP/2 Request Smuggling55about 5 years agoThis repository a docker-compose file to setup a local environment that is vulnerable to CVE-2021-36740 Varnish HTTP/2 request smuggling

Awesome Vulnerable Applications / Technologies / WordPress

DVWP168almost 3 years agoDamn Vulnerable WordPress

Awesome Vulnerable Applications / Technologies / Node.js

exploit-workshop156over 2 years agoA step by step workshop to exploit various vulnerabilities in Node.js and Java applications
DVNA712over 2 years agoDamn Vulnerable NodeJS Application
Extreme Vulnerable Node Application93almost 8 years agoExtreme Vulnerable Node Application
dvws-node459almost 2 years agoDamn Vulnerable Web Service is a vulnerable web service/API/application that can be used to learn webservices/API vulnerabilities

Awesome Vulnerable Applications / Technologies / Firmware

DVRF675over 5 years agoThe Damn Vulnerable Router Firmware Project
OWASP IoT Goat717almost 2 years agoIoTGoat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices
DVID192over 2 years agoDamn Vulnerable IoT Device

Awesome Vulnerable Applications / Uncategorized

LogSnare31over 2 years agoA playground for testing, preventing, and logging IDOR vulnerabilities
GitHub Actions Goat445almost 2 years agoDeliberately Vulnerable GitHub Actions CI/CD Environment
dvws - Damn Vulnerable Web Services456almost 5 years agoDamn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities
Fuzzgoat191almost 4 years agoA vulnerable C program for testing fuzzers
wavsep232almost 4 years agoThe Web Application Vulnerability Scanner Evaluation Project
leaky-repo228about 2 years agoBenchmarking repo for secrets scanning
OWASP SKF labs440about 2 years agoRepo for all the OWASP-SKF Docker lab examples
Vulnserver1,011almost 6 years agoVulnerable server used for learning software exploitation
Damn-Vulnerable-GraphQL-Application1,518over 2 years agoDamn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security
Vulnerable-nginx231almost 6 years agoAn intentionally vulnerable NGINX setup
Raspwn OS55over 9 years agoThe intentionally vulnerable image for the Raspberry Pi
python_security35over 5 years agoThis repository collects lists of security-relavent Python APIs, along with examples of exploits using those APIs
OWASP-VWAD872almost 2 years agoThe OWASP Vulnerable Web Applications Directory project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available
Vulhub18,020almost 2 years agoVulhub is an open-source collection of pre-built vulnerable docker environments
VulnDogeWeb app for hunters
CI/CD Goat1,967about 2 years agoDeliberately vulnerable CI/CD environment. Hack CI/CD pipelines, catch the flags
Damn Vulnerable Thick Client143about 3 years agoDamn Vulnerable Thick Client App developed in C# .NET
Damn Vulnerable RESTaurant455almost 2 years agoIntentionally vulnerable Web API game for learning and training purposes dedicated to developers, ethical hackers and security engineers
VulnerableLightApp32almost 2 years ago.NET vulnerable REST API

Backlinks from these awesome lists:

More related projects: