Lab · websocket
OWASP Damn Vulnerable Web Sockets (DVWS)
PHP/Ratchet deliberately vulnerable WebSocket app for testing WebSocket security skills with ZAP or Burp.
Use responsibly
Test only systems you own or are explicitly authorized to test. Unauthorized testing is illegal.
Tagswebsocket
More labs & practice targets
- Damn Vulnerable Web SocketswebsocketVulnerable web application using Web Sockets for client-server communication, with a DVWA-like flow.
- AI-GoatllmVulnerable-LLM CTF challenges aligned to the OWASP Top 10 for LLM Applications, running a local Vicuna model (no cloud fees).
- Altoro Mutual (AltoroJ)web-appClassic sample banking J2EE web app demonstrating real-world application security issues; also self-hostable.
- AuthLab (digininja)authSelection of authentication and authorization challenges drawn from real-world examples, written in Go.
- BodgeIt Storeweb-appSelf-contained Java/JSP vulnerable app aimed at pentest beginners, covering XSS, SQLi and hidden content.
- Broken CrystalsspaModern React/Node application with REST and GraphQL for modern SPA testing.