awesome-vulnerable - A curated list of VULNERABLE APPS and SYSTEMS whic

项目说明

<di="right">
<details>
<summary >🌐 Language</summary>
<div>
<di="right">
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href="
<p><a href=" Việt</a></p>
<p><a href=" Indonesia</a></p>
</div>
</div>
</details>
</div>

Awesome

![Awesome]()
![]()
!Git Actions
<a href=' style='margin-left: auto; margin-right: auto;' alt='We practice Ethical Design' src='
![GitHub stars]()
![GitHub issues]()
![GitHub pull-requests]()
![GitHub contributors]()
!Last Commit on GitHub

<img src=" alt="Octocat" width="210" height="225">

*A curated list of APPS and SYSTEMS which can be used as PENETRATION TESTING PRACTICE LAB. This list aims to help starters as well as pros to test out and enhance their penetration skills.*

Contents

Web Applications

Sites by of Security Testing Software

Sites for Downloading Older of Software

Sites for Improving Your Hacking Skills

Labs

Mobile Apps

Web Applications

BadStore - Badstore.net is dedicated to helping you understand how hackers prey on Web application , and to showing you how to reduce your exposure. Our Badstore demonstration software is designed to show you common hacking techniques.

BodgeIt Store - The BodgeIt Store is a web application which is currently aimed at people who are new to pen testing.

Bug Bounty Hunter - BugBountyHunter is a training platform created by bug bounty hunter zseano designed to help you learn all about web application and how to get started.

Butterfly Security Project - The ButterFly project is an educational en intended to give an insight into common web application and PHP . The en also includes examples demonstrating how such are mitigated.

bWAPP - bee-box is a custom Linux with bWAPP.

- secures software by detecting in open-source dependencies—without accessing your code. It supports Js, PHP, Ja, and more.

CloudGoat - CloudGoat is Rhino Security Labs' " by Design" AWS deployment tool

Commix - A collection of web pages, to command injection flaws.

CryptOMG - CryptOMG is a configurable CTF style test bed that highlights common flaws in cryptographic implementations.

CTFchallenge - CTFchallenge s a collection of 12 web applications, each one has its own realistic infrastructure built o subdomains containing based on bug reports, real world experiences or found in the OWASP Top 10.

Damn Cloud Application - Damn Cloud Application

DVAP (Damn AI Platform) - Open-source AI security training platform featuring AI agents, prompt injection labs, MCP attacks, RAG exploitation, agent security, tool poisoning, and AI red-team exercises.

Damn Node Application(DVNA) - Damn NodeJS Application

Damn Web App (DVWA) - Damn Web Application

Damn Web Services (DVWS) -

Damn Web Services is an insecure web application with multiple web service components that can be used to learn real world web service .

Firing Range - a test bed created by Google for automated web application security scanners.

Foundstone Hackme Bank - Free McAfee tools to aid in your security protection.

Foundstone Hackme Books - Free McAfee tools to aid in your security protection.

Foundstone Hackme Casino- Free McAfee tools to aid in your security protection.

Foundstone Hackme Shipping - Free McAfee tools to aid in your security protection.

Foundstone Hackme Travel - Free McAfee tools to aid in your security protection.

GameOver - Project GameOver was started with the objective of training and educating newbies about the basics of web security and educate them about the common web attacks and help them understand how they work.

hackxor - Hackxor is a realistic web application hacking game, designed to help players of all abilities develop their skills. All the missions are based on real I' found while doing pentests, bug bounty hunting, and research.

Hackazon - A modern web app

LAMPSecurity - LAMPSecurity training is designed to be a series of machine images along with complementary documentation designed to teach linux,apache,php,mysql security.

OWASP Mantra - Free and Open Source Browser based Security Framework, is a collection of free and open source tools integrated into a web browser, which can become handy for penetration testers, web application de, security professionals etc.

NOWASP / Mutillidae 2 - OWASP Mutillidae II is a free, open source, deliberately web-application pro a target for web-security enthusiast.

OSS – OopsSec Store - An open-source, intentionally e-commerce application built with Next.js and React. Provides a realistic CTF platform for learning web application security testing. Can be quickly set up using npx create-oss-store.

OWASP BWA - A collection of web applications that is distributed on a Machine in format compatible with their no-cost Player and Hypervisor (ESXi) products (along with their older and commercial products).

OWASP Hackademic - Project helps you test your knowledge on web application security. You can use it to actually attack web applications in a realistic but also controllable and safe en.

OWASP SiteGenerator - OWASP SiteGenerator allows the creating of dynamic websites based on XML files and predefined (some simple, some complex) co .Net languages and web de architectures (for example, na: Html, Ja, Flash, Java, etc).

OWASP Bricks - Web application security learning platform built on PHP and MySQL

OWASP Security Shepherd - OWASP Security Shepherd is a web and mobile application security training platform. Security Shepherd has been designed to foster and impro awareness among a skill-set demographic

PentesterLab - We make learning web hacking easier!

SecuriBench - Stanford SecuriBench is a set of open source real-life programs to be used as a testing ground for static and dynamic security tools. Release .91a focuses on Web-based applications written in Java.

SentinelTestbed - web site. Used to test sentinel features.

SocketToMe - It combines chat, a simple number guessing game and a few other hidden features

sqli-labs - SQLI labs to test error based, Blind boolean based, Time based.

MCIR (Magical Code Injection Rainbow) - The Magical Code Injection Rainbow! MCIR is a framework for building configurable testbeds. MCIR is also a collection of configurable testbeds

Sqlilabs - Lab set-up for learning SQL Injection Techniques

- ASP.net application implementing some of the most common applications we come across on our penetration testing engagements

- A web application lab using Docker

PuzzleMall - A web application for practicing session puzzling

WackoPicko - WackoPicko is a web application used to test web application scanners

WebGoat.NET - This web application is a learning platform that attempts to teach about common web security flaws. It contains generic security flaws that apply to most web applications

OWASP WebGoat8 - OWASP Webgoat 8 is a learning platform that attempts to teach about common web security flaws. It contains generic security flaws that apply to most web applications, is written in Java and is actively maintained.

OWASP WrongSecrets - OWASP WrongSecrets is a app which shows how to not store secrets, and helps you to improve your secrets-hunting skills.

WebSecurity Dojo - A free open-source self-contained training en for Web Application Security penetration testing. Tools + Targets = Dojo

XVWA - XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

Zap WAVE - An easy to use integrated penetration testing tool for finding in web applications

Web-Security Academy - A free platform for learining and testing your Web Application security skills with practice labs and learning materials by Portswigger

OWASP Juice Shop - An Open Source platform for testing Web-Application Security skills. The application contains a vast number of hacking challenges of difficulty level

tegal1337/0l4bs - Cross-site scripting (XSS) labs for web application security enthusiasts

tegal1337/br0w - Hack The Br0w. Play your browser and learn more, hack fun!

Pentest-Ground - Pentest playground with several web apps.

Unguard - An insecure cloud-nati demo application for Kubernetes. Unguard includes Java, .NET, Node.js, Go, and PHP services, MariaDB and Redis databases, an En, and a load generator.

Duck Store

Swiss Cheese Software - Intentionally multi-language app (Node.js, Python, Rust) with hardcoded secrets and outdated dependencies. Designed to test supply chain security scanners, dependency auditors, and SBOM generators.

Sites for Downloading Older of Software

Exploit-DB - The Exploit Database is maintained by Offensi, an information security training company that provides Information Security Certifications as well as high end penetration testing services

Old Apps - Provide our users with a wide assortment of current of familiar software, and their predecessors for free

Old - Pick a software title... to downgrade to the you love!

Repo - Hacking Lab

All - PortableApps is the world's most popular portable software solution allowing you to take your fa software with you

Sites by of Security Testing Software

Acunetix acuforum - A forum deliberately to SQL Injections, directory tra, and other web-based attacks

Acunetix acublog - A test site for Acunetix. It is to SQL Injections, Cross-site Scripting (XSS), and more

Acunetix acuart -This is an example PHP application, which is intentionally to web attacks. It is intended to help you test Acunetix

Acunetix SecurityTweets - HTML5 test website for Acunetix Web Scanner.

Cenzic crackmebank - This is a test and demonstration site

Fortify Zero Bank - The Free Online Bank Web site is published by Micro Focus Fortify for the sole purpose of demonstrating the functionality and effecti of Micro Focus Fortify’s WebInspect products in detecting and reporting Web application .

Fortify IWA.NET (Insecure Web Application) Pharmacy Direct - an example Microsoft.NET Core Web Application for use in De scenarios and demonstrations. It includes some examples of bad and insecure code - which can be found using static and dynamic application security testing tools such as those provided by OpenText.

Fortify IWA.JA Web Application) Pharmacy Direct - an example Ja Web Application for use in De scenarios and demonstrations. It includes some examples of bad and insecure code - which can be found using static and dynamic application security testing tools such as those provided by OpenText.

IBM altoromutual - The AltoroJ website is published by IBM Corporation for the sole purpose of demonstrating the effecti of IBM products in detecting web application and website defects

Ma testsparker - This is a test and demonstration site for Netsparker

Ma testsparker - This is a test and demonstration site for Netsparker , Next Generation Web Application Security Scanner. Start Netsparker to scan this web site and let it find the

Ma testsparker - This is a test and demonstration site for Netsparker

NTOSpider Test Site - This site is setup to test automated Web Application scanners like AppSpider

Sites for Improving Your Hacking Skills

Blue Team Labs Online - Cyber Range -A gamified platform for defenders to practice their skills in security in and challenges co; Incident Response, Digital Forensics, Security Operations, Reverse Engineering, and Threat Hunting.

CyberKiller - A free li hacking arena with rotating scenarios: a Game of Thrones Acti forest (GOAD) and a corporate Linux breach chain, with capture-and-hold flags and a li.

Embedded Security CTF - Scattered throughout the world in locked warehouses are briefcases filled with Cy Yombinator bearer bonds that could be worth billions comma billions of dollars. You will help steal the briefcases

EnigmaGroup - Enigma Group has been pro its members a legal and safe security resource where they can develop their pen-testing skills on challenges provided by this site

Escape - The code generates HTML in an unsafe way. Prove it by calling alert(1)

Google Gruyere - This codelab shows how web application can be exploited and how to defend against these attacks

Forensic Practical - To hone your forensic skills and run malware found on the honeypots by installing it on clean computer systems and watch its behavior

Gh0st Lab - The original idea of this network was to create a security research network where like minded indi could work together towards the common goal of knowledge

<b>Hack The Box</b> - An online platform allowing you to test your penetration testing skills and exchange ideas and methodologies with thousands of people in the security field

<b>TryHackMe</b> - Cyber Security training made easy. A comfortable experience to learn by designing prebuilt courses which include machines ( in the cloud ready to be deployed

Hack This Site - Hack This Site is a free, safe and legal training ground for hackers to test and expand their hacking skills

HackThis - Defend the Web is an Interacti Security Platform

HackQuest - Anonymous Webhosting, Servers, Secure Email

Hack.me - Hacking-Lab is a service by Security Competence GmbH, a Swiss subsidiary of Compass Security AG.

Compass Security is a well renowned European company specializing in penetration testing, incident response, digital forensics, and security trainings

Hacking-Lab - Hack.me is a FREE, community based project powered by eLearnSecurity. The community can build, host and share web application code for educational and research purposes

Hacker Test - HackerTest.net is your own online hacker simulation. This new real-life imitation will help you advance your security knowledge of Ja, PHP, HTML and graphic thinking

Halls Of - is a place for sharing knowledge and ideas. Users can submit code, as well as science, technology, and engineering-oriented news and articles

Hax.Tor - HaX.ToR.Hu is a challenge site putting emphasis on teaching basic security related issues in a fun way

Metasploit Unleashed - The Metasploit Unleashed (MSFU) course is provided free of charge by Offensi in order to raise awareness for underpri children in East Africa

O - The wargames offered by the O community can help you to learn and practice security concepts in the form of fun-filled games

PentestIT - Penetration testing laboratories "Test lab" emulate an IT infrastructure of real companies and are created for a legal pen testing and improving penetration testing skills

CSC Play on Demand - The aim of this challenge is to identify the means by which an insider may accidentally or maliciously leak organisational secrets innocent files

Root Me - The fast, easy, and affordable way to train your hacking skills

Security Treasure Hunt - A new Packet Capture-based Web Analysis challenge is a through April 30th, 2013, sponsored by Cyber Aces

Smash The Stack - Wargaming Network

SQLZoo - Exploiting an SQL Inject attack in solving a puzzle that is a cross between Hangman and 20 Questions. It needs a little understanding of SQL and a great deal of cunning

TheBlackSheep and Erik - Offers you hundreds of challenges in the fields of programming, Ja, PHP, Ja, cryptography and others

ThisIsLegal - A hacker wargames site with much more such as forums and tutorials

Try2Hack - This site provides several security-oriented challenges for your entertainment. It is actually one of the oldest challenge sites still around

- A collection of hosts and associated challenges to gain 'hands-on' experience in cyber security.

XSS: Can You XSS This? - Use HTMLSanitizer to protect your Web Apps

XSS Game - Learn to find and exploit XSS bugs

XSS: ProgPHP - Next-Gen Domain Registration. Progphp.com is coming soon!

Pwnable.tw - A newer set of high quality pwnable challenges)

Pwnable.kr - One of the more popular recent wargamming sets of challenges

PicoCTF - Designed for high school students while the event is usually new every year, it's left online and has a great difficulty progression

CTF Learn - A new CTF based learning platform with user-contributed challenges

Re.kr - This site tests your ability to Cracking & Reverse Code Engineering

w3challs - Our challenges address several subsets of hacking, mostly oriented on the offensive. A multitude of technologies and architectures are waiting for you. Show us your mad skillz and pop some shells (or calcs)!

RingZer0 Team - RingZer0 Team's online CTF offers you tons of challenges designed to test and improve your hacking skills through hacking challenges.

HellBound Hackers -The hands-on approach to computer security and simulated security challenges

Komodo Consulting - Application Security Challenge designed to challenge your application hacking skills

Maxkersten Binary Analysis - A practical binary analysis course

PwnAd - Pwnie Island is a limited-release, first-person, true open-world MMORPG set on a beautiful island where anything could happen. That's because this game is intentionally to all kinds of silly hacks! Flying, endless cash, and more are all one client change or network proxy away

INE - Practical Hands-on Online IT Training and Certifications

Labs

CTFd - CTFs as you need them

Mellivora - Mellivora is a CTF engine written in PHP

Metasploitable2 - Metasploitable is an intentionally Linux machine

NightShade - A simple capture the flag framework.

MCIR - The Magical Code Injection Rainbow! MCIR is a framework for building configurable testbeds. MCIR is also a collection of configurable testbeds.

- De En Made Easy

NETinVM - A tool for teaching and learning about systems, networks and security

SmartOS - SmartOS is a free and open-source SVR4 hypervisor based on the UNIX operating system that combines OpenSolaris technology with Linux's K.

SmartDataCenter - Joyent Triton DataCenter: a cloud management platform with first class support for containers.

Hypervisor - Hypervisor is a bare-metal hypervisor that servers; allowing you to consolidate your applications while saving time and money managing your IT infrastructure.

GNS3 - Build, Design and Test your network in a risk-free en and access the largest networking community to help.

OCCP - A free, configurable, open-source platform for cyber security educators and challenge event coordinators.

XAMPP - XAMPP is a completely free, easy to install Apache distribution containing MariaDB, PHP, and Perl. The XAMPP open source package has been set up to be incredibly easy to install and to use.

Kubernetes Goat - The Kubernetes Goat designed to be intentionally cluster en to learn and practice Kubernetes security.

Offensi - Practice your pentesting skills in a standalone, private lab --en with the additions of PG Play and PG Practice to Offensi’s Proving Grounds training labs.

Game of Hacks - Alright, this one isn’t exactly a web app – but it’s another engaging way of learning to spot application security , so we thought we’d throw it in

Google Gruyere - This ‘cheesy’ site is full of holes and aimed for those just starting to learn application security.

Hellbound Hackers - Hellbound Hackers, the hands-on approach to computer security, offers a wide array of challenges with the aim to teach how to identify exploits and suggest the code to patch it

Peruggia - Peruggia is a safe en for security professionals and de to learn and test common attacks on web applications.

oli/pentest_lab - Local pentest lab le Docker Compose.

Hacksplaining - Interacti for several well-known web .

LabEx - An online platform for enhancing your Linux, DevOps, and Cybersecurity skills through hands-on labs

gRPC Goat - gRPC Goat is a " by Design" lab created to provide an interacti playground for learning and practicing gRPC security.

SocengLab - SocEng Lab is an open-source adapti engineering simulation platform that brings academic rigor to security awareness training.

Mobile Apps

Allsafe - Allsafe is an intentionally application that contains .

Damn Android App (DVAA) - Damn Android App (DVAA) is an Android application which contains intentional

Damn FirefoxOS Application (DVFA) - Damn FirefoxOS Application - a purposefully application for demontrastion

Damn iOS App (DVIA) - Damn iOS App (DVIA) is an iOS application that is damn

ExploitMe Mobile Android Labs - The insecure Android app for your hacking pleasure

ExploitMe Mobile iPhone Labs - A defecti App for your hacking pleasure

Hacme Bank Android - Free McAfee tools to aid in your security protection.

InsecureBank - Cyber Tales by Paladion

NcN Wargame - No cON Name 2012 Challenges

OWASP iGoat - The OWASP iGoat project is a security learning tool for iOS de to learn about security weaknesses in iOS -- by breaking things as well as fixing them.

OWASP Goatdroid - OWASP GoatDroid is a fully functional and self-contained training en for educating de and testers on Android security

OWASP MSTG Hacking Playground - A set of mobile apps of which you can exploit the using techniques of the OWASP MSTG.

OWASP MSTG Crackmes - A set of mobile apps that help you to improve your reverse engineering skills base don the OWASP MSTG.

API

OWASP crAPI - crAPI stands for “Completely Ridiculous API”. It simulates an API-driven, microser web application that is a platform for owners. crAPI specializes in the common that happen in modern API-based applications, including all those in the OWASP Top 10 for APIs.

VAmPI - VAmPI is a API made with Flask and it includes from the OWASP top 10 for APIs.

capital - A built-to-be- API application based on the OWASP top 10 API . Use c{api}tal to learn, train and exploit API Security within your own API Security CTF.

d - Damn Web Services is a application with a web service and an API that can be used to learn about webservices/API related .

- API for educational purposes

Contributions are always appreciated

项目信息

开发语言：未知

Star 数：1400

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A curated list of VULNERABLE APPS and SYSTEMS which can be used as PENETRATION TESTING PRACTICE LAB.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。