Labs & practice targets

Vulnerable-LLM CTF challenges aligned to the OWASP Top 10 for LLM Applications, running a local Vicuna model (no cloud fees).

Classic sample banking J2EE web app demonstrating real-world application security issues; also self-hostable.

Selection of authentication and authorization challenges drawn from real-world examples, written in Go.

Self-contained Java/JSP vulnerable app aimed at pentest beginners, covering XSS, SQLi and hidden content.

Modern React/Node application with REST and GraphQL for modern SPA testing.

Intentionally vulnerable application generator (Python/Flask/OpenAI) for creating security-training targets.

Educational PHP/MySQL environment teaching common web/PHP vulnerabilities alongside their mitigations.

Free open-source 'buggy web app' with 100+ vulnerabilities for practicing web security and preparing for pentests.

Rhino Security Labs' 'vulnerable by design' AWS/Azure deployment tool with CTF-style cloud attack scenarios.

Completely Ridiculous API — intentionally vulnerable microservice API (vehicle-owner theme) built around the OWASP API Security Top 10 (BOLA/BFLA/mass assignment).

Configurable CTF-style testbed highlighting flaws in cryptographic implementations: oracles, side channels and ECB weaknesses.

Purposely insecure PHP blog simulating a novice's code, used to teach manual and automated vulnerability detection and remediation.

Ruby on Rails application from the Broken Web Applications (BWA) project for local security testing.

Single-file Python vulnerable web app (<100 lines) supporting most popular web vulnerability classes for education.

Intentionally vulnerable web application scanner target.

Deliberately vulnerable C#/.NET API-only application for learning and practicing API security.

Collection of file-upload bypass techniques for learning and testing.

Intentionally insecure AWS Lambda functions mapped to the OWASP Serverless Top 10 for learning FaaS security.

Fully simulated self-hosted vulnerable infrastructure with routers, subnetworks, SCADA and many vulnerable containers modeling an energy-management system.

Damn Vulnerable Java EE application for security testing, runnable via Docker Compose, Maven Jetty or a Tomcat WAR.

Sample LLM ReAct chatbot (Langchain) for learning prompt injection against Thought/Action/Observation agent loops.

Damn vulnerable Node.js app with varying difficulty levels for practicing common web vulnerabilities.

Node/Express/Sequelize app demonstrating the OWASP Top 10 with a developer security guidebook and a fixes branch.

Python app (inspired by DVWA) with session fixation, SQLi, stored XSS and weak-password vulnerabilities.

Stateful FastAPI game teaching privilege escalation and long-horizon API workflows with attack/fix modes.

Deliberately vulnerable serverless (Node on AWS/Azure) application for learning serverless security.

Short PHP web app whose vulnerabilities naive scanners fail to detect — useful for testing scanner depth.

Vulnerable web application using Web Sockets for client-server communication, with a DVWA-like flow.

PHP/Docker deliberately insecure web application for security practice.

Intentionally vulnerable Django employee-portal app (inspired by RailsGoat) containing OWASP Top 10 flaws.

Intentionally vulnerable Django app with master and broken branches for learning security testing with ZAP.

GraphQL-focused vulnerable app covering introspection, mutations, batching, JWT, SSRF, injections, and traversal.

Classic PHP training app covering injection, CSRF, uploads, and command execution across multiple security levels.

Damn Vulnerable Web Services (Node) — app with a web service and API covering IDOR, mass assignment, NoSQL/SQLi, SSRF, JWT and XXE.

Broken Java web app illustrating bugs and vulnerabilities: memory leaks, deadlocks, JVM crash, injection (SQL/LDAP/code/OS), XSS, CSRF, XXE and traversal.

Node/Express/MongoDB app covering OWASP Top 10 injection, NoSQLi and OS command injection for app-security learning.

Target practice environment for the ffuf web fuzzer.

Vulnerable Laravel API (student-grades theme) aligned to the OWASP API Security Top 10; bugs are visible, not hidden.

Small Python web app for text snippets/files with intentional XSS, XSRF, information-disclosure, DoS and RCE bugs (Google codelab).

Vulnerable-by-design Go/gRPC lab for learning and practicing gRPC security.

Online platform of hands-on hacking machines and challenges for skill-building (VM/CTF style).

Deliberately insecure Rails app with simulated users and sensitive card data for security testing and training.

Small .NET webserver vulnerable to insecure deserialization.

Small PHP app for practicing attacks against JWT tokens.

Series of vulnerable VM images with documentation teaching Linux/Apache/PHP/MySQL (LAMP) security.

Vulnerable Java/Docker demo application.

OWASP Mutillidae II — free PHP web-security training target with 40+ vulnerabilities and broad coverage.

App with 40+ classic web vulnerabilities, REST/SOAP, hints, and secure/insecure modes for breadth and scanner regression.

OWASP deliberately-vulnerable Node.js app for white-box source analysis and patching.

OWASP Node.js/MongoDB app teaching how the OWASP Top 10 apply to Node apps, with a tutorial and vulnerable target.

Node.js/PostgreSQL app with real (not simulated) vulnerable code for benchmarking source-code analyzers and white-box testing.

MongoDB-backed PHP lab with two NoSQL injection scenarios for practicing the technique.

Java/MongoDB app intentionally vulnerable to NoSQL injection, with secure and insecure code examples and docs.

Vulnerable e-commerce web app (Next.js/React/Node) for security practice.

PHP vulnerable web application for security practice.

PHP/MySQL learning platform where each 'brick' contains a security issue to exploit manually or with tools.

Realistic microservices app for advanced API testing: multi-user authorization, API chaining, and business workflows.

PHP/Ratchet deliberately vulnerable WebSocket app for testing WebSocket security skills with ZAP or Burp.

Modern Angular/Node SPA with REST APIs, access-control, business-logic, Web3, and AI/LLM vulnerabilities for browser navigation and long attack chains.

Modern deliberately-insecure web application (91+ scored challenges spanning injection, XSS, broken auth, IDOR/BOLA, crypto, business logic) used for security training and tool benchmarking.

Deliberately vulnerable Ruby on Rails app with per-version tutorials demonstrating security issues and their fixes.

Multi-user CTF/tournament platform with levels, scoring, and native grading for user isolation and competition.

Web and mobile app security training platform with lessons and challenges based on the OWASP Top Ten.

Docker lab examples for the Security Knowledge Framework, correlated to KB IDs and controls (ASVS, NIST) with write-ups.

Deliberately-vulnerable app covering SQLi, XSS, SSRF, XXE, IDOR, JWT, upload, traversal, and auth, with deterministic ground truth and a scanner-comparison endpoint.

Gateway that routes to a distributed farm of vulnerable apps (tech-stack agnostic), integrating VulnerableApp, -jsp and -php.

Learning platform for common web security flaws with .NET-specific lessons.

Training app for finding secrets in code, Git, containers, Kubernetes, and cloud environments.

Payment-focused vulnerable app covering payment manipulation, BOLA, races, balances, and business-logic failures — especially relevant to real bug bounties.

Image-gallery PHP/MySQL app with controlled vulnerabilities providing a safe, legal environment to practice common web attacks.

OWASP DevSlop MEAN-stack app with deliberately insecure APIs for scanning and API-security demos.

Vulnerable Play (Scala) app demonstrating unvalidated client input trusted and reflected into responses.

Free online training with hundreds of per-technique labs across 31 web-vulnerability topics at Apprentice/Practitioner/Expert tiers, each with a defined success condition.

Java/JSP app for practicing session-puzzling attacks via different session sequences.

Deliberately-vulnerable Python/Django app for white-box source analysis and patching.

OWASP deliberately-vulnerable Ruby on Rails app for white-box source analysis and patching.

Vulnerable client-side JavaScript SPA (no backend) demonstrating XSS, open redirect, prototype pollution, ReDoS and request hijacking.

Globo.com collection of many intentionally vulnerable web apps across multiple stacks, each with attack narratives and Docker options.

GitHub Security Lab in-repo learning experience where you secure intentionally vulnerable code.

Snyk's vulnerable Node.js/Express/MongoDB demo app with exploitable npm packages and code-level flaws (open redirect, NoSQLi, XSS).

Collection of pages vulnerable to SQL injection across multiple DBMSs, with a deployment script for a full test machine.

Progressive PHP labs to learn SQL injection: error-based, blind (boolean/time), update/insert, header and second-order injection, and WAF bypass.

SQL injection test application, now part of the Magical Code Injection Rainbow (MCIR) framework.

PHP lab with six SSRF scenarios including IP blacklist bypass, DNS rebinding, and HTML-to-PDF SSRF.

Focused playground for practicing template injection across many template engines.

Java/Spring Boot app demonstrating OWASP Top 10 and other security vulnerabilities.

Intentionally broken Django REST API teaching information disclosure, IDOR, access control, throttling and injection flaws.

Guided online rooms and labs teaching offensive and defensive security through hands-on exercises.

Vulnerable REST API teaching BOLA, mass assignment, JWT, SQLi, enumeration, and rate limits, with vulnerable and secure modes as positive/negative controls.

Vulnerable Adversely Programmed Interface — self-hostable PHP/Laravel API mirroring the OWASP API Top 10 through exercises.

Containerized historical CVEs in real products for real-CVE training.

Very vulnerable Node/Express web app and API (Swagger/Sqlite/Sequelize) for testing security tools and pentesting.

Java/Tomcat/MySQL vulnerable app from the Cyber Security and Privacy Foundation for learning web vulnerabilities and secure coding.

Minimal Node/Express app demonstrating SQLi and XSS.

PHP app with Google Authenticator TOTP for practicing OTP and two-factor authentication bypass.

IdP and SP Docker images showcasing exploitable SAML configurations such as privilege escalation via modified SAML responses.

Example Python (Bottle) API vulnerable to TLS issues, user enumeration, auth bypass, SQLi and session-management flaws.

Vulnerable .NET/C# API built for educational purposes.

.NET console app illustrating XSLT-transform vulnerabilities relevant to web apps processing XML.

Repository of downloadable deliberately vulnerable VM images to practice exploitation in your own lab.

PHP/Docker web vulnerability lab project by Yavuzlar.

Vulnerable app from the paper 'Why Johnny Can't Pentest', with known XSS, SQLi, traversal, file inclusion and command injection for scanner evaluation.

Web application vulnerability scanner evaluation project providing deterministic scanner test cases for high-volume regression.

Web Application Vulnerability Scanner Evaluation Project — vulnerable app for assessing scanner accuracy and coverage.

Deliberately insecure Java teaching app with lesson-based coverage of common JVM web vulnerabilities.

Guided OWASP Java lessons with callbacks and server/client vulnerabilities for early curriculum and tool-use instruction.

OWASP port of WebGoat to PHP/MySQL — interactive lessons where you exploit each vulnerability to demonstrate understanding.

App based on willingly vulnerable RESTful APIs (Angular/Node).

Learning resource by Omar Santos bundling many intentionally vulnerable applications in Docker containers for training.

Test labs for reverse-proxy and related attacks (Nginx, Apache, HAProxy, Varnish, Traefik, Envoy, Caddy, AWS, Cloudflare), companion to the Weird Proxies cheat sheet.

Focused playground for practicing XSS across many injection contexts.

Simple PHP app containing an XML External Entity (XXE) vulnerability for learning and testing.

A family of deliberately-vulnerable practice apps (Node/Python/PHP APIs and web apps) for hands-on web-security training.

Deliberately vulnerable health-tech platform (React/Node/Postgres) with an AI chatbot for learning app security and ethical hacking.

A deliberately vulnerable bug-adoption e-commerce app (React, FastAPI, MariaDB) with 32 planted vulnerabilities across the OWASP Top 10, three difficulty levels and a scoring dashboard, deployed via Docker as a practice target. Includes RCE; must never be exposed to the internet.