{"id":46207,"url":"https://github.com/vavkamil/awesome-vulnerable-apps","name":"awesome-vulnerable-apps","description":"Awesome Vulnerable Applications","projects_count":105,"last_synced_at":"2026-10-20T11:00:21.806Z","repository":{"id":38417359,"uuid":"210446743","full_name":"vavkamil/awesome-vulnerable-apps","owner":"vavkamil","description":"Awesome Vulnerable Applications","archived":false,"fork":false,"pushed_at":"2026-10-14T11:00:21.000Z","size":116,"stargazers_count":1495,"open_issues_count":1,"forks_count":230,"subscribers_count":27,"default_branch":"master","last_synced_at":"2026-10-19T17:39:17.116Z","etag":null,"topics":["awesome","awesome-list","bug","bugbounty","hacking","penetration-testing","security","vulnerable","vulnerable-applications"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"cc0-1.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/vavkamil.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"contributing.md","funding":null,"license":"LICENSE","code_of_conduct":"code-of-conduct.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"accessibility":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2019-09-23T20:30:57.000Z","updated_at":"2026-10-14T11:00:29.000Z","dependencies_parsed_at":"2026-10-19T13:24:21.768Z","dependency_job_id":null,"html_url":"https://github.com/vavkamil/awesome-vulnerable-apps","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/vavkamil/awesome-vulnerable-apps","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vavkamil%2Fawesome-vulnerable-apps","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vavkamil%2Fawesome-vulnerable-apps/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vavkamil%2Fawesome-vulnerable-apps/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vavkamil%2Fawesome-vulnerable-apps/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/vavkamil","download_url":"https://codeload.github.com/vavkamil/awesome-vulnerable-apps/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/vavkamil%2Fawesome-vulnerable-apps/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344872684,"owners_count":38395786,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-20T02:00:06.669Z","response_time":101,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2024-01-14T08:59:14.533Z","updated_at":"2026-10-20T11:00:21.808Z","primary_language":null,"list_of_lists":false,"displayable":true,"categories":["License","Online","Paid","Vulnerable VMs","Mobile Security","OWASP Top 10","Technologies","Uncategorized","Cloud Security","SSO - Single Sign On"],"sub_categories":["Firmware","Node.js","SQL Injection","XSS Injection","Server Side Request Forgery","CORS Misconfiguration","XXE Injection","Request Smuggling","WordPress",".NET"],"readme":"# Awesome Vulnerable Applications [![Awesome](https://awesome.re/badge.svg)](https://awesome.re)\n\n\u003e A curated list of various vulnerable by design applications\n\n\n## Contents\n\n- [Online](#Online)\n- [Paid](#Paid)\n- [Vulnerable VMs](#Vulnerable-VMs)\n- [Cloud Security](#Cloud-Security)\n- [SSO - Single Sign On](#SSO-Single-Sign-On)\n- [Mobile Security](#Mobile-Security)\n- [OWASP Top 10](#OWASP-Top-10)\n    - [SQL Injection](#SQL-Injection)\n    - [XSS Injection](#XSS-Injection)\n    - [Server Side Request Forgery](#Server-Side-Request-Forgery)\n    - [CORS Misconfiguration](#CORS-Misconfiguration)\n    - [XXE Injection](#XXE-Injection)\n    - [Request Smuggling](#Request-Smuggling)\n- [Technologies](#Technologies)\n    - [WordPress](#WordPress)\n    - [.NET](#.NET)\n    - [Node.js](#Node.js)\n    - [Firmware](#Firmware)\n- [Uncategorized](#Uncategorized)\n\n---\n\n## Online\n\nOnline vulnerable app and CTFs\n\n- [Hacker101 CTF](https://ctf.hacker101.com/)\n- [Web Security Academy](https://portswigger.net/web-security)\n- [Hack The Box](https://www.hackthebox.com/)\n- [Try Hack Me](https://tryhackme.com/)\n- [CTFtime](https://ctftime.org/)\n- [PWNABLE.KR](http://pwnable.kr/)\n- [XSS game](https://xss-game.appspot.com)\n- [Gin \u0026 Juice Shop](https://ginandjuice.shop/)\n- [Duck Store](https://duck-store.escape.tech/)\n- [Pentest-Ground](https://pentest-ground.com/)\n- [DVAIB](https://dvaib.com/) - Damn Vulnerable AI Bank\n- [Jackpot](https://hego.red/jackpot) - Ten vulnerable AI characters, one per OWASP LLM Top 10 category\n- [OverTheWire: Wargames](https://overthewire.org/wargames/)\n- [Agent Breaker](https://play.lakera.ai/agent-breaker)\n\n## Paid\n\nPaid tranining courses\n\n- [PentesterLab](https://pentesterlab.com/)\n- [OOPS!](https://oops.codes) - Hands-on offensive-security labs platform with real vulnerable apps, real terminals, and real exploitation (no scripted answers). 63+ labs covering OWASP Top 10, JWT attacks, GraphQL, SSRF, deserialization, and more, each running in an isolated per-session Fargate sandbox.\n\n## Vulnerable VMs\n\n- [Vulhub](https://github.com/vulhub/vulhub)\n- [Metasploitable3](https://github.com/rapid7/metasploitable3) - Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities.\n- [Hackmyvm.eu](https://hackmyvm.eu/)\n\n## Cloud Security\n\n- [Kubernetes Goat](https://github.com/madhuakula/kubernetes-goat) - Kubernetes Goat is \"Vulnerable by Design\" Kubernetes Cluster. Designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security.\n- [CloudGoat](https://github.com/RhinoSecurityLabs/cloudgoat) - CloudGoat is Rhino Security Labs' \"Vulnerable by Design\" AWS deployment tool\n- [CdkGoat - Vulnerable AWS CDK Infra](https://github.com/bridgecrewio/cdkgoat) - CdkGoat is Bridgecrew's \"Vulnerable by Design\" AWS CDK repository. \n- [Cfngoat - Vulnerable Cloudformation Template](https://github.com/bridgecrewio/cfngoat) - Cfngoat is Bridgecrew's \"Vulnerable by Design\" Cloudformation repository.\n- [TerraGoat - Vulnerable Terraform Infra](https://github.com/bridgecrewio/terragoat) - TerraGoat is Bridgecrew's \"Vulnerable by Design\" Terraform repository.\n- [caponeme - Capital One Breach](https://github.com/avishayil/caponeme) - Repository demonstrating the Capital One breach on your AWS account\n- [WrongSecrets](https://github.com/commjoen/wrongsecrets) - WrongSecrets is \"Vulnerable by Design\" to show how to not handle secrets in Docker, Kubernetes and in the cloud (AWS/GCP/Azure).\n- [AWSGoat](https://github.com/ine-labs/AWSGoat) - A Damn Vulnerable AWS Infrastructure\n- [AzureGoat](https://github.com/ine-labs/AzureGoat) - A Damn Vulnerable Azure Infrastructure\n- [IAM Vulnerable](https://github.com/BishopFox/iam-vulnerable) - Use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.\n- [Sadcloud](https://github.com/nccgroup/sadcloud) - A tool for standing up (and tearing down!) purposefully insecure cloud infrastructure \n- [CNAPPgoat](https://github.com/tenable/cnappgoat) - CNAPPgoat is a multi-cloud, vulnerable-by-design environment deployment tool. \n- [Unguard](https://github.com/dynatrace-oss/unguard) - An insecure cloud-native microservices demo application for Kubernetes\n- [Vulnerable Cloud Lab](https://github.com/anpa1200/vulnerable-cloud-lab) - Intentionally vulnerable GCP and AWS infrastructure deployed with Terraform for authorized cloud security training.\n\n## SSO - Single Sign On\n\n- [vulnerable-sso](https://github.com/dogangcr/vulnerable-sso) - vulnerable single sign on\n\n## Mobile Security\n\n- [Allsafe - Android](https://github.com/t0thkr1s/allsafe-android) - An intentionally vulnerable Android application for learning Android application security.\n- [InsecureBankv2](https://github.com/dineshshetty/Android-InsecureBankv2) - Vulnerable Android application for developers and security enthusiasts to learn about Android insecurities.\n- [Vulnerable Kext](https://github.com/ant4g0nist/Vulnerable-Kext) - A WIP \"Vulnerable by Design\" kext for iOS/macOS to play \u0026 learn *OS kernel exploitation.\n- [InjuredAndroid](https://github.com/B3nac/InjuredAndroid) - A vulnerable Android application that shows simple examples of vulnerabilities in a ctf style. \n- [Damn Vulnerable Bank](https://github.com/rewanthtammana/Damn-Vulnerable-Bank) -  Damn Vulnerable Bank is designed to be an intentionally vulnerable android application.\n- [InsecureShop](https://github.com/optiv/InsecureShop) - An Intentionally designed Vulnerable Android Application built in Kotlin. \n- [AndroGoat](https://github.com/satishpatnayak/AndroGoat) - AndroGoat is purposely developed open source vulnerable/insecure app using Kotlin.\n- [DIVA Android](https://github.com/payatu/diva-android) - Damn Insecure and vulnerable App for Android.\n- [DVMA](https://github.com/cpeoples/dvma) - Damn Vulnerable Mobile App, an intentionally vulnerable Flutter app for Android and iOS.\n- [OVAA](https://github.com/oversecured/ovaa) - Oversecured Vulnerable Android App.\n- [Vuldroid](https://github.com/jaiswalakshansh/Vuldroid) - Android Application covering various static and dynamic vulnerabilities.\n- [Android Security Testing](https://github.com/RavikumarRamesh/hpAndro1337) - hpAndro1337 Application made in Kotlin with multiple vulnerabilities and a CTF.\n- [VulnLab APK](https://github.com/anpa1200/Vulnerable-APK) - Intentionally vulnerable Android app covering OWASP Mobile Top 10 classes with exploit commands and screenshots.\n\n## OWASP Top 10\n\n- [Owasp Juice shop](https://github.com/juice-shop/juice-shop) - OWASP Juice Shop: Probably the most modern and sophisticated insecure web application\n- [crApi](https://github.com/OWASP/crAPI) - completely ridiculous API: crAPI will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself.\n- [DVWA](https://github.com/digininja/DVWA) - Damn Vulnerable Web Application (DVWA)\n- [DSVW](https://github.com/stamparm/DSVW) - Damn Small Vulnerable Web\n- [bWAPP](https://github.com/raesene/bWAPP) - This is just an instance of the OWASP bWAPP project as a docker container.\n- [Xtreme Vulnerable Web Application](https://github.com/s4n7h0/xvwa) - XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.\n- [lazyweb](https://github.com/RamadhanAmizudin/lazyweb) - This web application is a demonstration of common server-side application flaws. Each of the vulnerabilities has its own difficulty rating.\n- [OWASP Mutillidae II](https://github.com/webpwnized/mutillidae) - OWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiast.\n- [Pentest_lab](https://github.com/oliverwiegers/pentest_lab) - Local penetration testing lab using docker-compose.\n- [VulnLab](https://github.com/Yavuzlar/VulnLab) - A vulnerable web application lab using Docker\n- [WebGoat](https://github.com/WebGoat/WebGoat) - WebGoat is a deliberately insecure application by OWASP for training purpose\n- [OWASP Security Shepherd](https://github.com/OWASP/SecurityShepherd) - A web and mobile application security training platform for learning and practicing penetration testing skills.\n- [VAmPI](https://github.com/erev0s/VAmPI) - Vulnerable REST API with OWASP top 10 vulnerabilities for security testing\n- [OSS – OopsSec Store](https://github.com/kOaDT/oss-oopssec-store) - An intentionally vulnerable e-commerce application built with Next.js and React. A self-hosted CTF platform for web security training covering OWASP Top 10 vulnerabilities.\n- [Owasp VulnerableApp](https://github.com/SasanLabs/VulnerableApp) - A modular deliberately vulnerable application designed primarily for validating and benchmarking security scanners through reproducible test scenarios, while also supporting learning and experimentation.\n\n### SQL Injection\n\n- [Yet Another Vulnerability Database](https://github.com/rtfpessoa/yavdb) - Yet Another Vulnerability Database\n\n### XSS Injection\n\n- [clicker-service - simulate XSS](https://gitlab.com/r00k/clicker-service) - Docker container that intakes post and then \"clicks\" the link. Intentionally vulnerable. To be used with vulnerable by design web apps to realistically simulate XSS and XSRF (CSRF).\n- [XSSworm.dev](https://github.com/vavkamil/XSSworm.dev) - Self-replication contest\n- [xssed](https://github.com/aj00200/xssed) - A set of XSS vulnerable PHP scripts for testing\n- [xssable](https://github.com/kiwicom/xssable) - A vulnerable blogging platform used to demonstrate XSS vulnerabilities.\n\n### Server Side Request Forgery\n\n- [SSRF_Vulnerable_Lab](https://github.com/incredibleindishell/SSRF_Vulnerable_Lab) - This Lab contain the sample codes which are vulnerable to Server-Side Request Forgery attack\n\n### CORS Misconfiguration\n\n- [CORS-vulnerable-Lab](https://github.com/incredibleindishell/CORS-vulnerable-Lab) - Sample vulnerable code and its exploit code\n- [CORS misconfiguration vulnerable Lab](https://github.com/incredibleindishell/CORS_vulnerable_Lab-Without_Database) - This Repository contains CORS misconfiguration related vulnerable codes.\n\n### XXE Injection\n\n- [XXE Lab](https://github.com/jbarone/xxelab) - A simple web app with a XXE vulnerability.\n- [docker-java-xxe](https://github.com/pimps/docker-java-xxe) - Docker image to test XXE attacks in java with tomcat.\n\n\n### Request Smuggling\n\n- [Varnish HTTP/2 Request Smuggling](https://github.com/detectify/Varnish-H2-Request-Smuggling) - This repository a docker-compose file to setup a local environment that is vulnerable to CVE-2021-36740 Varnish HTTP/2 request smuggling.\n\n## Technologies\n\n### WordPress\n\n- [DVWP](https://github.com/vavkamil/dvwp) - Damn Vulnerable WordPress\n\n### .NET\n- [The Most Vulnerable .NET App](https://github.com/AlexGoOn/the-most-vulnerable-dotnet-app) - Interactive educational project that demonstrates common security vulnerabilities in .NET applications\n\n### Node.js\n\n- [OWASP NodeGoat](https://github.com/OWASP/NodeGoat) - An intentionally vulnerable Node.js application for learning OWASP Top 10 security risks and how to fix them.\n- [exploit-workshop](https://github.com/snyk-labs/exploit-workshop) - A step by step workshop to exploit various vulnerabilities in Node.js and Java applications\n- [DVNA](https://github.com/appsecco/dvna) - Damn Vulnerable NodeJS Application\n- [Extreme Vulnerable Node Application](https://github.com/vegabird/xvna) - Extreme Vulnerable Node Application\n- [dvws-node](https://github.com/snoopysecurity/dvws-node) - Damn Vulnerable Web Service is a vulnerable web service/API/application that can be used to learn webservices/API vulnerabilities.\n\n### Firmware\n\n- [DVRF](https://github.com/praetorian-code/DVRF) - The Damn Vulnerable Router Firmware Project\n- [OWASP IoT Goat](https://github.com/OWASP/IoTGoat) - IoTGoat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices.\n- [DVID](https://github.com/Vulcainreo/DVID) -  Damn Vulnerable IoT Device\n\n## Uncategorized\n\n- [LogSnare](https://github.com/sea-erkin/log-snare) - A playground for testing, preventing, and logging IDOR vulnerabilities.\n- [GitHub Actions Goat](https://github.com/step-security/github-actions-goat) - Deliberately Vulnerable GitHub Actions CI/CD Environment\n- [dvws - Damn Vulnerable Web Services](https://github.com/snoopysecurity/dvws) - Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities.\n- [Fuzzgoat](https://github.com/fuzzstati0n/fuzzgoat) - A vulnerable C program for testing fuzzers.\n- [wavsep](https://github.com/sectooladdict/wavsep) - The Web Application Vulnerability Scanner Evaluation Project\n- [leaky-repo](https://github.com/Plazmaz/leaky-repo) - Benchmarking repo for secrets scanning\n- [OWASP SKF labs](https://github.com/blabla1337/skf-labs) - Repo for all the OWASP-SKF Docker lab examples\n- [Vulnserver](https://github.com/stephenbradshaw/vulnserver) - Vulnerable server used for learning software exploitation\n- [Damn-Vulnerable-GraphQL-Application](https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application) - Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security.\n- [Vulnerable-nginx](https://github.com/detectify/vulnerable-nginx) - An intentionally vulnerable NGINX setup \n- [Raspwn OS](https://github.com/alphacharlie/raspwn/) - The intentionally vulnerable image for the Raspberry Pi.\n- [python_security](https://github.com/gbleaney/python_security) - This repository collects lists of security-relavent Python APIs, along with examples of exploits using those APIs \n- [OWASP-VWAD](https://github.com/OWASP/OWASP-VWAD) - The OWASP Vulnerable Web Applications Directory project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available. \n- [Vulhub](https://github.com/vulhub/vulhub) - Vulhub is an open-source collection of pre-built vulnerable docker environments. \n- [CI/CD Goat](https://github.com/cider-security-research/cicd-goat) - Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, catch the flags.\n- [Damn Vulnerable Thick Client](https://github.com/srini0x00/dvta) - Damn Vulnerable Thick Client App developed in C# .NET \n- [Damn Vulnerable RESTaurant](https://github.com/theowni/Damn-Vulnerable-RESTaurant-API-Game) - Intentionally vulnerable Web API game for learning and training purposes dedicated to developers, ethical hackers and security engineers.\n- [VulnerableLightApp](https://github.com/Aif4thah/VulnerableLightApp) - .NET vulnerable REST API\n- [OSTE-Vulnerable-Web-Application](https://github.com/OSTEsayed/OSTE-Vulnerable-Web-Application) - Vulnerable Web application made with PHP/SQL designed to help new web testers gain some experience and test DAST tools for identifying web vulnerabilities.\n- [Vulnerable AI Lab](https://github.com/anpa1200/AI-PT-Lab) - Intentionally vulnerable AI agent lab for practicing RAG injection, tool misuse, memory poisoning, supply-chain compromise, and data exfiltration.\n- [Damn Vulnerable Model Context Protocol (DVMCP)](https://github.com/harishsg993010/damn-vulnerable-MCP-server) - An intentionally vulnerable MCP implementation with 10 challenges for learning MCP security, including prompt injection, tool poisoning, and token theft.\n\n## Contribute\n\nContributions welcome! Read the [contribution guidelines](contributing.md) first.\n\n## License\n\n[![CC0](https://mirrors.creativecommons.org/presskit/buttons/88x31/svg/cc-zero.svg)](https://creativecommons.org/publicdomain/zero/1.0)\n\nTo the extent possible under law, vavkamil has waived all copyright and\nrelated or neighboring rights to this work.\n","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/vavkamil%2Fawesome-vulnerable-apps/projects"}