awesome-vulnerable-apps - Awesome Vulnerable Applications

项目说明

Awesome Applications ![Awesome]()

> A curated list of by design applications

Contents

Online

Paid

VMs

Cloud Security

SSO - Single Sign On

Mobile Security

OWASP Top 10

- SQL Injection
- XSS Injection
- Server Side Request Forgery
- CORS Misconfiguration
- XXE Injection
- Request Smuggling

Technologies

- WordPress
- .NET
- Node.js
- Firmware

Uncategorized

---

Online

Online app and CTFs

Hacker101 CTF

Web Security Academy

Hack The Box

Try Hack Me

CTFtime

PWNABLE.KR

XSS game

Gin & Juice Shop

Duck Store

Pentest-Ground

DVAIB - Damn AI Bank

Jackpot - Ten AI characters, one per OWASP LLM Top 10 category

O: Wargames

Agent Breaker

Paid

Paid tranining courses

PentesterLab

OOPS! - Hands-on offensi labs platform with real apps, real terminals, and real exploitation (no scripted answers). 63+ labs co OWASP Top 10, JWT attacks, GraphQL, SSRF, deserialization, and more, each running in an isolated per-session Fargate sandbox.

VMs

Metasploitable3 - Metasploitable3 is a VM that is built from the ground up with a large amount of security .

Hackmyvm.eu

Cloud Security

Kubernetes Goat - Kubernetes Goat is " by Design" Kubernetes Cluster. Designed to be an intentionally cluster en to learn and practice Kubernetes security.

CloudGoat - CloudGoat is Rhino Security Labs' " by Design" AWS deployment tool

CdkGoat - AWS CDK Infra - CdkGoat is Bridgecrew's " by Design" AWS CDK repository.

Cfngoat - Cloudformation Template - Cfngoat is Bridgecrew's " by Design" Cloudformation repository.

TerraGoat - Terraform Infra - TerraGoat is Bridgecrew's " by Design" Terraform repository.

caponeme - Capital One Breach - Repository demonstrating the Capital One breach on your AWS account

WrongSecrets - WrongSecrets is " by Design" to show how to not handle secrets in Docker, Kubernetes and in the cloud (AWS/GCP/Azure).

AWSGoat - A Damn AWS Infrastructure

AzureGoat - A Damn Azure Infrastructure

IAM - Use Terraform to create your own by design AWS IAM pri escalation playground.

Sadcloud - A tool for standing up (and tearing down!) purposefully insecure cloud infrastructure

CNAPPgoat - CNAPPgoat is a multi-cloud, en deployment tool.

Unguard - An insecure cloud-nati demo application for Kubernetes

Cloud Lab - Intentionally GCP and AWS infrastructure deployed with Terraform for authorized cloud security training.

SSO - Single Sign On

- single sign on

Mobile Security

Allsafe - Android - An intentionally Android application for learning Android application security.

InsecureBankv2 - Android application for de and security enthusiasts to learn about Android insecurities.

Kext - A WIP " by Design" kext for iOS/macOS to play & learn *OS kernel exploitation.

InjuredAndroid - A Android application that shows simple examples of in a ctf style.

Damn Bank - Damn Bank is designed to be an intentionally android application.

InsecureShop - An Intentionally designed Android Application built in Kotlin.

AndroGoat - AndroGoat is purposely de open source /insecure app using Kotlin.

DI - Damn Insecure and App for Android.

DVMA - Damn Mobile App, an intentionally Flutter app for Android and iOS.

OVAA - O Android App.

- Android Application co static and dynamic .

Android Security Testing - hpAndro1337 Application made in Kotlin with multiple and a CTF.

APK - Intentionally Android app co OWASP Mobile Top 10 classes with exploit commands and screenshots.

OWASP Top 10

Owasp Juice shop - OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

crApi - completely ridiculous API: crAPI will help you to understand the ten most critical API security risks. crAPI is by design, but you'll be able to safely run it to educate/train yourself.

DVWA - Damn Web Application (DVWA)

DSVW - Damn Small Web

bWAPP - This is just an instance of the OWASP bWAPP project as a docker container.

Xtreme Web Application - XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

lazyweb - This web application is a demonstration of common ser application flaws. Each of the has its own difficulty rating.

OWASP Mutillidae II - OWASP Mutillidae II is a free, open source, deliberately web-application pro a target for web-security enthusiast.

Pentest_lab - Local penetration testing lab using docker-compose.

- A web application lab using Docker

WebGoat - WebGoat is a deliberately insecure application by OWASP for training purpose

VAmPI - REST API with OWASP top 10 for security testing

OSS – OopsSec Store - An intentionally e-commerce application built with Next.js and React. A self-hosted CTF platform for web security training co OWASP Top 10 .

Owasp - A modular deliberately application designed primarily for and benchmarking security scanners through reproducible test scenarios, while also supporting learning and experimentation.

SQL Injection

Yet Another Database - Yet Another Database

XSS Injection

clicker-service - simulate XSS - Docker container that intakes post and then "clicks" the link. Intentionally . To be used with by design web apps to realistically simulate XSS and XSRF (CSRF).

XSSworm.dev - Self-replication contest

xssed - A set of XSS PHP scripts for testing

xssable - A blogging platform used to demonstrate XSS .

Server Side Request Forgery

SSRF_ - This Lab contain the sample codes which are to Ser Request Forgery attack

CORS Misconfiguration

CORS- - Sample code and its exploit code

CORS misconfiguration Lab - This Repository contains CORS misconfiguration related codes.

XXE Injection

XXE Lab - A simple web app with a XXE .

docker-ja - Docker image to test XXE attacks in java with tomcat.

Request Smuggling

HTTP/2 Request Smuggling - This repository a docker-compose file to setup a local en that is to C HTTP/2 request smuggling.

Technologies

WordPress

DVWP - Damn WordPress

.NET

The Most .NET App - Interacti project that demonstrates common security in .NET applications

Node.js

OWASP NodeGoat - An intentionally Node.js application for learning OWASP Top 10 security risks and how to fix them.

exploit-workshop - A step by step workshop to exploit in Node.js and Ja

DVNA - Damn NodeJS Application

Extreme Node Application - Extreme Node Application

d - Damn Web Service is a web service/API/application that can be used to learn webservices/API .

Firmware

DVRF - The Damn Router Firmware Project

OWASP IoT Goat - IoTGoat is a deliberately insecure firmware created to educate software de and security professionals with testing commonly found in IoT devices.

DVID - Damn IoT Device

Uncategorized

LogSnare - A playground for testing, pre, and logging IDOR .

GitHub Actions Goat - Deliberately GitHub Actions CI/CD En

dvws - Damn Web Services - Damn Web Services is an insecure web application with multiple web service components that can be used to learn real world web service .

Fuzzgoat - A C program for testing fuzzers.

wavsep - The Web Application Scanner E Project

leaky-repo - Benchmarking repo for secrets scanning

OWASP SKF labs - Repo for all the OWASP-SKF Docker lab examples

- server used for learning software exploitation

Damn-cation - Damn GraphQL Application is an intentionally implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security.

- An intentionally NGINX setup

Raspwn OS - The intentionally image for the Raspberry Pi.

python_security - This repository collects lists of security-relavent Python APIs, along with examples of exploits using those APIs

OWASP-VWAD - The OWASP Web Applications Directory project (VWAD) is a comprehensive and well maintained registry of all known web applications currently a.

- is an open-source collection of pre-built docker en.

CI/CD Goat - Deliberately CI/CD en. Hack CI/CD pipelines, catch the flags.

Damn Thick Client - Damn Thick Client App de in C# .NET

Damn RESTaurant - Intentionally Web API game for learning and training purposes dedicated to de, ethical hackers and security engineers.

- .NET REST API

OSTE-on - Web application made with PHP/SQL designed to help new web testers gain some experience and test DAST tools for identifying web .

AI Lab - Intentionally AI agent lab for practicing RAG injection, tool misuse, memory poisoning, supply-chain compromise, and data exfiltration.

Contribute

Contributions welcome! Read the contribution guidelines first.

License

![CC0]()

To the extent possible under law, has waived all copyright and
related or neighboring rights to this work.

项目信息

开发语言：未知

Star 数：1487

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Awesome Vulnerable Applications展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。