Awesome Vulnerable

A curated list of VULNERABLE APPS and SYSTEMS which can be used as PENETRATION TESTING PRACTICE LAB. This list aims to help both beginners and experts to test and improve their penetration skills.

Contents

• Vulnerable Web Applications
• Sites by Vendors of Security Testing Software
• Sites for Downloading Older Versions of Various Software
• Sites for Improving Your Hacking Skills
• Labs
• Mobile Apps

Vulnerable Web Applications

• BadStore - Badstore.net is dedicated to helping you understand how hackers exploit Web application vulnerabilities, and to showing you how to reduce your exposure. Our Badstore demonstration software is designed to show you common hacking techniques.
• BodgeIt Store - The BodgeIt Store is a vulnerable web application currently aimed at people who are new to pen testing.
• Bug Bounty Hunter - BugBountyHunter is a training platform created by bug bounty hunter zseano designed to help you learn all about web application vulnerabilities and how to get started.
• Butterfly Security Project - The ButterFly project is an educational environment intended to provide insight into common web application and PHP vulnerabilities. The environment also includes examples demonstrating how such vulnerabilities are mitigated.
• bWAPP - bee-box is a custom Linux VM pre-installed with bWAPP.
• Vulert - Vulert secures software by detecting vulnerabilities in open-source dependencies—without accessing your code. It supports JS, PHP, Java, Python, and more.
• CloudGoat - CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool.
• Commix - A collection of web pages vulnerable to command injection flaws.
• CryptOMG - CryptOMG is a configurable CTF-style test bed that highlights common flaws in cryptographic implementations.
• CTFchallenge - CTFchallenge is a collection of 12 vulnerable web applications, each with its own realistic infrastructure built over several subdomains containing vulnerabilities based on bug reports, real-world experiences, or vulnerabilities found in the OWASP Top 10.
• Damn Vulnerable Cloud Application - Damn Vulnerable Cloud Application.
• Damn Vulnerable Node Application(DVNA) - Damn Vulnerable NodeJS Application.
• Damn Vulnerable Web App (DVWA) - Damn Vulnerable Web Application.
• Damn Vulnerable Web Services (DVWS) -

Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real-world web service vulnerabilities.

• Firing Range - A test bed created by Google for automated web application security scanners.
• Foundstone Hackme Bank - Free McAfee tools to aid in your security protection.
• Foundstone Hackme Books - Free McAfee tools to aid in your security protection.
• Foundstone Hackme Casino- Free McAfee tools to aid in your security protection.
• Foundstone Hackme Shipping - Free McAfee tools to aid in your security protection.
• Foundstone Hackme Travel - Free McAfee tools to aid in your security protection.
• GameOver - Project GameOver was started with the objective of training and educating newbies about the basics of web security, educating them about common web attacks, and helping them understand how they work.
• hackxor - Hackxor is a realistic web application hacking game, designed to help players of all abilities develop their skills. All the missions are based on real vulnerabilities I've personally found while doing pentests, bug bounty hunting, and research.
• Hackazon - A modern vulnerable web app
• LAMPSecurity - LAMPSecurity training provides a series of vulnerable virtual machine images and accompanying documentation to teach linux, apache, php, mysql security.
• OWASP Mantra - Free and Open Source Browser based Security Framework, a collection of free and open source tools integrated into a web browser, useful for penetration testers, web application developers, security professionals, etc.
• NOWASP / Mutillidae 2 - OWASP Mutillidae II is a free, open source, deliberately vulnerable web application providing a target for web security enthusiasts.
• OSS – OopsSec Store - An open-source, intentionally vulnerable e-commerce application built with Next.js and React. Provides a realistic CTF platform for learning web application security testing. Can be quickly set up using npx create-oss-store.
• OWASP BWA - A collection of vulnerable web applications distributed as a Virtual Machine in VMware format, compatible with their free VMware Player and VMware vSphere Hypervisor (ESXi) products (as well as older and commercial products).
• OWASP Hackademic - The project helps you test your knowledge on web application security. You can use it to actually attack web applications in a realistic but controllable and safe environment.
• OWASP SiteGenerator - OWASP SiteGenerator enables the creation of dynamic websites based on XML files and predefined vulnerabilities (some simple, some complex) covering .Net languages and web development architectures (e.g., navigation: Html, Javascript, Flash, Java, etc).
• OWASP Bricks - Web application security learning platform built on PHP and MySQL
• OWASP Security Shepherd - OWASP Security Shepherd is a web and mobile application security training platform. Security Shepherd is designed to foster and improve security awareness among a diverse range of skill levels.
• PentesterLab - We make learning web hacking easier!
• SecuriBench - Stanford SecuriBench is a set of open source real-life programs used as a testing ground for static and dynamic security tools. Release .91a focuses on Web-based applications written in Java.
• SentinelTestbed - Vulnerable website. Used to test sentinel features.
• SocketToMe - Combines chat, a simple number guessing game, and a few other hidden features.
• sqli-labs - SQLI labs for testing error-based, blind boolean-based, and time-based SQL injection.
• MCIR (Magical Code Injection Rainbow) - The Magical Code Injection Rainbow! MCIR is a framework for building configurable vulnerability testbeds. MCIR is also a collection of configurable vulnerability testbeds.
• Sqlilabs - Lab set-up for learning SQL Injection Techniques.
• VulnApp - ASP.net application implementing some of the most common applications encountered during penetration testing engagements.
• VulnLab - A vulnerable web application lab using Docker.
• PuzzleMall - A vulnerable web application for practicing session puzzling.
• WackoPicko - WackoPicko is a vulnerable web application used to test web application vulnerability scanners.
• WebGoat.NET - This web application is a learning platform that attempts to teach about common web security flaws. It contains generic security flaws that apply to most web applications.
• OWASP WebGoat8 - OWASP WebGoat 8 is a learning platform that attempts to teach about common web security flaws. It contains generic security flaws applicable to most web applications, is written in Java, and is actively maintained.
• OWASP WrongSecrets - OWASP WrongSecrets is a vulnerable app that shows how not to store secrets, and helps you to improve your secrets-hunting skills.
• WebSecurity Dojo - A free open-source self-contained training environment for Web Application Security penetration testing. Tools + Targets = Dojo
• XVWA - XVWA is a poorly coded web application written in PHP/MySQL that helps security enthusiasts learn application security.
• Zap WAVE - An easy to use integrated penetration testing tool for finding vulnerabilities in web applications.
• Web-Security Academy - A free platform for learning and testing your Web Application security skills with practice labs and learning materials by Portswigger.
• OWASP Juice Shop - An Open Source platform for testing Web-Application Security skills. The application contains a wide range of hacking challenges of varying difficulty.
• tegal1337/0l4bs - Cross-site scripting (XSS) labs for web application security enthusiasts.
• tegal1337/br0w - Hack The Br0w. Play your browser and learn more, hack fun!
• Pentest-Ground - Pentest playground with several vulnerable web apps.
• Unguard - An insecure cloud-native microservices demo application for Kubernetes. Unguard includes vulnerable Java, .NET, Node.js, Go, and PHP services, MariaDB and Redis databases, an Envoy proxy, and a load generator.
• Duck Store

Sites for Downloading Older Versions of Various Software

• Exploit-DB - The Exploit Database is maintained by Offensive Security, an information security training company that provides various Information Security Certifications as well as high-end penetration testing services.
• Old Apps - Provides users with a wide assortment of current versions of familiar software, and their predecessors for free.
• Old Version - Pick a software title... to downgrade to the version you love!
• VirtualHacking Repo - Virtual Hacking Lab
• All Version - PortableApps is the world's most popular portable software solution, allowing you to take your favorite software with you

Sites by Vendors of Security Testing Software

• Acunetix acuforum - A forum intentionally vulnerable to SQL Injections, directory traversal, and other web-based attacks
• Acunetix acublog - A test site for Acunetix. It is vulnerable to SQL Injections, Cross-site Scripting (XSS), and more
• Acunetix acuart -This is an example PHP application, intentionally vulnerable to web attacks. It is intended to help you test Acunetix
• Acunetix SecurityTweets - Vulnerable HTML5 test website for Acunetix Web Vulnerability Scanner.
• Cenzic crackmebank - This is a test and demonstration site
• Fortify Zero Bank - The Free Online Bank website is published by Micro Focus Fortify solely to demonstrate the functionality and effectiveness of Micro Focus Fortify’s WebInspect products in detecting and reporting Web application vulnerabilities.
• Fortify IWA.NET (Insecure Web Application) Pharmacy Direct - an example Microsoft.NET Core Web Application for use in DevSecOps scenarios and demonstrations. It includes examples of poor and insecure code - which can be found using static and dynamic application security testing tools such as those provided by OpenText.
• Fortify IWA.JAVA (Insecure Web Application) Pharmacy Direct - an example Java/Spring Web Application for use in DevSecOps scenarios and demonstrations. It includes examples of poor and insecure code - which can be found using static and dynamic application security testing tools such as those provided by OpenText.
• IBM altoromutual - The AltoroJ website is published by IBM Corporation solely to demonstrate the effectiveness of IBM products in detecting web application vulnerabilities and website defects
• Mavituna testsparker - This is a test and demonstration site for Netsparker
• Mavituna testsparker - This is a test and demonstration site for Netsparker, Next Generation Web Application Security Scanner. Start Netsparker to scan this website and let it find the vulnerabilities
• Mavituna testsparker - This is a test and demonstration site for Netsparker
• NTOSpider Test Site - This site is set up to test automated Web Application scanners like AppSpider

Sites for Improving Your Hacking Skills

• Blue Team Labs Online - Cyber Range -A gamified platform for defenders to practice their skills in security investigations and challenges covering: Incident Response, Digital Forensics, Security Operations, Reverse Engineering, and Threat Hunting.
• Embedded Security CTF - Scattered throughout the world in locked warehouses are briefcases filled with Cy Yombinator bearer bonds that could be worth billions upon billions of dollars. You will help steal the briefcases
• EnigmaGroup - Enigma Group has been providing its members a legal and safe security resource where they can develop their pen-testing skills on various challenges provided by this site
• Escape - The code generates HTML in an unsafe way. Prove it by calling alert(1)
• Google Gruyere - This codelab shows how web application vulnerabilities can be exploited and how to defend against these attacks
• Forensic Practical - To hone your forensic skills and run malware found on the honeypots by installing it on clean computer systems and observing its behavior
• Gh0st Lab - The original idea of this network was to create a security research network where like-minded individuals could work together towards the common goal of knowledge
• Hack The Box - An online platform allowing you to test your penetration testing skills and exchange ideas and methodologies with thousands of people in the security field
• TryHackMe - Cyber Security training made easy. A comfortable experience to learn through prebuilt courses which include virtual machines (VM) hosted in the cloud ready to be deployed
• Hack This Site - Hack This Site is a free, safe, and legal training ground for hackers to test and expand their hacking skills
• HackThis - Defend the Web is an Interactive Cyber Security Platform
• HackQuest - Anonymous Webhosting, Virtual Servers, Secure Email
• Hack.me - Hacking-Lab is a service by Security Competence GmbH, a Swiss subsidiary of Compass Security AG.

Compass Security is a well-renowned European company specializing in penetration testing, incident response, digital forensics, and security trainings

• Hacking-Lab - Hack.me is a FREE, community-based project powered by eLearnSecurity. The community can build, host, and share vulnerable web application code for educational and research purposes
• Hacker Test - HackerTest.net is your own online hacker simulation. This new real-life imitation will help you advance your security knowledge of JavaScript, PHP, HTML, and graphic thinking
• Halls Of Valhalla - Valhalla is a place for sharing knowledge and ideas. Users can submit code, as well as science, technology, and engineering-oriented news and articles
• Hax.Tor - HaX.ToR.Hu is a challenge site emphasizing teaching basic security-related issues in a fun way
• Metasploit Unleashed - The Metasploit Unleashed (MSFU) course is provided free of charge by Offensive Security to raise awareness for underprivileged children in East Africa
• OverTheWire - The wargames provided by the OverTheWire community help you learn and practice security concepts through fun games
• PentestIT - Penetration testing laboratories "Test lab" simulate the IT infrastructure of real companies and are created for legal pen testing and improving penetration testing skills
• CSC Play on Demand - The purpose of this challenge is to discover how an insider can accidentally or maliciously leak organizational secrets via seemingly innocent files
• Root Me - The fast, easy, and affordable way to train your hacking skills
• Security Treasure Hunt - A new Packet Capture-based Web Vulnerability Analysis challenge is available until April 30th, 2013, sponsored by Cyber Aces
• Smash The Stack - Wargaming Network
• SQLZoo - Exploiting an SQL Injection attack involves solving a puzzle that is a mix between Hangman and 20 Questions. It requires some understanding of SQL and a lot of cunning
• TheBlackSheep and Erik - Offers hundreds of challenges in programming, JavaScript, PHP, Java, steganography, cryptography, and more
• ThisIsLegal - A hacker wargames site with much more, including forums and tutorials
• Try2Hack - This site provides several security-oriented challenges for your entertainment. It is actually one of the oldest challenge sites still running
• VulnHub - A collection of vulnerable hosts and related challenges to gain 'hands-on' experience in cyber security.
• XSS: Can You XSS This? - Use HTMLSanitizer to protect your Web Apps
• XSS Game - Learn to find and exploit XSS bugs
• XSS: ProgPHP - Next-Gen Domain Registration. Progphp.com is coming soon!
• Pwnable.tw - A newer set of high-quality pwnable challenges
• Pwnable.kr - One of the more popular recent wargaming sets of challenges
• PicoCTF - Designed for high school students; while the event is usually new each year, it's left online and has great difficulty progression
• CTF Learn - A new CTF-based learning platform with user-contributed challenges
• Reversing.kr - This site tests your skills in Cracking & Reverse Code Engineering
• w3challs - Our challenges cover several hacking subsets, mostly offensive. Many technologies and architectures await you. Show us your mad skills and pop some shells (or calcs)!
• RingZer0 Team - RingZer0 Team's online CTF offers tons of challenges designed to test and improve your hacking skills through hacking challenges.
• HellBound Hackers - The hands-on approach to computer security and simulated security challenges
• Komodo Consulting - Application Security Challenge designed to test your application hacking skills
• Maxkersten Binary Analysis - A practical binary analysis course
• PwnAdventure - Pwnie Island is a limited-release, first-person, true open-world MMORPG set on a beautiful island where anything can happen. This game is intentionally vulnerable to all kinds of hacks! Flying, endless cash, and more are just a client change or network proxy away
• INE - Practical Hands-on Online IT Training and Certifications

Labs

• CTFd - CTFs as you need them
• Mellivora - Mellivora is a CTF engine written in PHP
• Metasploitable2 - Metasploitable is an intentionally vulnerable Linux virtual machine
• NightShade - A simple capture the flag framework.
• MCIR - The Magical Code Injection Rainbow! MCIR is a framework for building configurable vulnerability testbeds. MCIR is also a collection of configurable vulnerability testbeds.
• Vagrant - Development Environments Made Easy
• NETinVM - A tool for teaching and learning about systems, networks, and security
• SmartOS - SmartOS is a free and open-source SVR4 hypervisor based on the UNIX operating system, combining OpenSolaris technology with Linux's KVM virtualization.
• SmartDataCenter - Joyent Triton DataCenter: a cloud management platform with first-class container support.
• vSphere Hypervisor - vSphere Hypervisor is a bare-metal hypervisor that virtualizes servers, allowing you to consolidate your applications and save time and money managing your IT infrastructure.
• GNS3 - Build, Design, and Test your network in a risk-free virtual environment and access the largest networking community for help.
• OCCP - A free, configurable, open-source virtualization platform for cybersecurity educators and challenge event coordinators.
• XAMPP - XAMPP is a completely free, easy to install Apache distribution containing MariaDB, PHP, and Perl. The XAMPP open source package has been set up to be incredibly easy to install and to use.
• Kubernetes Goat - The Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security.
• Offensive Security - Practice your pentesting skills in a standalone, private lab environment with the additions of PG Play and PG Practice to Offensive Security’s Proving Grounds training labs.
• Game of Hacks - Alright, this one isn’t exactly a vulnerable web app – but it’s another engaging way of learning to spot application security vulnerabilities, so we thought we’d throw it in.
• Google Gruyere - This ‘cheesy’ vulnerable site is full of holes and aimed at those just starting to learn application security.
• Hellbound Hackers - Hellbound Hackers, the hands-on approach to computer security, offers a wide array of challenges with the aim to teach how to identify exploits and suggest the code to patch it.
• Peruggia - Peruggia is a safe environment for security professionals and developers to learn and test common attacks on web applications.
• oliverwiegers/pentest_lab - Local pentest lab leveraging Docker Compose.
• Hacksplaining - Interactive lessons for several well-known web vulnerabilities.
• LabEx - An online platform for enhancing your Linux, DevOps, and Cybersecurity skills through hands-on labs.
• gRPC Goat - gRPC Goat is a "Vulnerable by Design" lab created to provide an interactive, hands-on playground for learning and practicing gRPC security.
• SocengLab - SocEng Lab is an open-source adaptive social engineering simulation platform that brings academic rigor to security awareness training.

Mobile Apps

• Allsafe - Allsafe is an intentionally vulnerable application that contains various vulnerabilities.
• Damn Vulnerable Android App (DVAA) - Damn Vulnerable Android App (DVAA) is an Android application which contains intentional vulnerabilities.
• Damn Vulnerable FirefoxOS Application (DVFA) - Damn Vulnerable FirefoxOS Application - a purposefully vulnerable application for demonstration.
• Damn Vulnerable iOS App (DVIA) - Damn Vulnerable iOS App (DVIA) is an iOS application that is damn vulnerable.
• ExploitMe Mobile Android Labs - The insecure Android app for your hacking pleasure.
• ExploitMe Mobile iPhone Labs - A defective iPhone App for your hacking pleasure.
• Hacme Bank Android - Free McAfee tools to aid in your security protection.
• InsecureBank - Cyber Tales by Paladion.
• NcN Wargame - No cON Name 2012 Challenges.
• OWASP iGoat - The OWASP iGoat project is a security learning tool for iOS developers to learn about security weaknesses in iOS -- by breaking things as well as fixing them.
• OWASP Goatdroid - OWASP GoatDroid is a fully functional and self-contained training environment for educating developers and testers on Android security.
• OWASP MSTG Hacking Playground - A set of mobile vulnerable apps which you can exploit using techniques from the OWASP MSTG.
• OWASP MSTG Crackmes - A set of mobile apps that help you to improve your reverse engineering skills based on the OWASP MSTG.

API

• OWASP crAPI - crAPI stands for “Completely Ridiculous API”. It simulates an API-driven, microservice-based web application that is a platform for vehicle owners. crAPI specializes in the common vulnerabilities that happen in modern API-based applications, including all those in the OWASP Top 10 for APIs.
• VAmPI - VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs.
• capital - A built-to-be-vulnerable API application based on the OWASP top 10 API vulnerabilities. Use c{api}tal to learn, train, and exploit API Security vulnerabilities within your own API Security CTF.
• dvws-node - Damn Vulnerable Web Services is a vulnerable application with a web service and an API that can be used to learn about webservices/API related vulnerabilities.
• VulnerableLightApp - Vulnerable API for educational purposes.

Contributions are always appreciated

--- Tranlated By Open Ai Tx | Last indexed: 2026-01-12 ---