Awesome Vulnerable

A curated list of VULNERABLE APPS and SYSTEMS which can be used as PENETRATION TESTING PRACTICE LAB. This list aims to help starters as well as pros to test out and enhance their penetration skills.

Vulnerable Web Applications

BadStore - Badstore.net is dedicated to helping you understand how hackers prey on Web application vulnerabilities, and to showing you how to reduce your exposure. Our Badstore demonstration software is designed to show you common hacking techniques.
BodgeIt Store - The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing.
Butterfly Security Project - The ButterFly project is an educational environment intended to give an insight into common web application and PHP vulnerabilities. The environment also includes examples demonstrating how such vulnerabilities are mitigated.
bWAPP - bee-box is a custom Linux VM pre-installed with bWAPP.
CloudGoat - CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool
Commix - A collection of web pages, vulnerable to command injection flaws.
CryptOMG - CryptOMG is a configurable CTF style test bed that highlights common flaws in cryptographic implementations.
Damn Vulnerable Cloud Application - Damn Vulnerable Cloud Application
Damn Vulnerable Node Application(DVNA) - Damn Vulnerable NodeJS Application
Damn Vulnerable Web App (DVWA) - Damn Vulnerablbe Web Application
Damn Vulnerable Web Services (DVWS) - Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities.
Foundstone Hackme Bank - Free McAfee tools to aid in your security protection.
Foundstone Hackme Books - Free McAfee tools to aid in your security protection.
Foundstone Hackme Casino - Free McAfee tools to aid in your security protection.
Foundstone Hackme Shipping - Free McAfee tools to aid in your security protection.
Foundstone Hackme Travel - Free McAfee tools to aid in your security protection.
GameOver - Project GameOver was started with the objective of training and educating newbies about the basics of web security and educate them about the common web attacks and help them understand how they work.
hackxor - Hackxor is a realistic web application hacking game, designed to help players of all abilities develop their skills. All the missions are based on real vulnerabilities I've personally found while doing pentests, bug bounty hunting, and research.
Hackazon - A modern vulnerable web app
LAMPSecurity - LAMPSecurity training is designed to be a series of vulnerable virtual machine images along with complementary documentation designed to teach linux,apache,php,mysql security.
OWASP Mantra - Free and Open Source Browser based Security Framework, is a collection of free and open source tools integrated into a web browser, which can become handy for penetration testers, web application developers, security professionals etc.
NOWASP / Mutillidae 2 - OWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiast.
OWASP BWA - A collection of vulnerable web applications that is distributed on a Virtual Machine in VMware format compatible with their no-cost VMware Player and VMware vSphere Hypervisor (ESXi) products (along with their older and commercial products).
OWASP Hackademic - Project helps you test your knowledge on web application security. You can use it to actually attack web applications in a realistic but also controllable and safe environment.
OWASP SiteGenerator - OWASP SiteGenerator allows the creating of dynamic websites based on XML files and predefined vulnerabilities (some simple, some complex) covering .Net languages and web development architectures (for example, navigation: Html, Javascript, Flash, Java, etc).
OWASP Bricks - Web application security learning platform built on PHP and MySQL
OWASP Security Shepherd - OWASP Security Shepherd is a web and mobile application security training platform. Security Shepherd has been designed to foster and improve security awareness among a varied skill-set demographic
PentesterLab - We make learning web hacking easier!
SecuriBench - Stanford SecuriBench is a set of open source real-life programs to be used as a testing ground for static and dynamic security tools. Release .91a focuses on Web-based applications written in Java.
SentinelTestbed - Vulnerable web site. Used to test sentinel features.
SocketToMe
sqli-labs
MCIR (Magical Code Injection Rainbow)
sqlilabs
VulnApp
PuzzleMall
WackoPicko
WAED
WebGoat.NET
WebSecurity Dojo
XVWA
Zap WAVE

Sites for Downloading Older Versions of Various Software

Sites by Vendors of Security Testing Software

Sites for Improving Your Hacking Skills

Labs

CTFd - CTFs as you need them
Mellivora - Mellivora is a CTF engine written in PHP
Metasploitable2 - Metasploitable is an intentionally vulnerable Linux virtual machine
NightShade - A simple capture the flag framework.
MCIR - The Magical Code Injection Rainbow! MCIR is a framework for building configurable vulnerability testbeds. MCIR is also a collection of configurable vulnerability testbeds.
Vagrant - Development Environments Made Easy
NETinVM - A tool for teaching and learning about systems, networks and security
SmartOS - Converged Container and Virtual Machine Hypervisor
SmartDataCenter - Joyent Triton DataCenter: a cloud management platform with first class support for containers.
vSphere Hypervisor - vSphere Hypervisor is a bare-metal hypervisor that virtualizes servers; allowing you to consolidate your applications while saving time and money managing your IT infrastructure.
GNS3 - Build, Design and Test your network in a risk-free virtual environment and access the largest networking community to help.
OCCP - A free, configurable, open-source virtualization platform for cyber security educators and challenge event coordinators.
XAMPP - XAMPP is a completely free, easy to install Apache distribution containing MariaDB, PHP, and Perl. The XAMPP open source package has been set up to be incredibly easy to install and to use.

Mobile Apps

Here are some of the ways to contribute to this project:

Add your name to the CONTRIBUTORS.md file
Add any new useful links to resources with respect to pentesting and vulnerable testintg environments

Make a pull request and wait for it to be merged!

Getting started

Fork this repository (Click the Fork button in the top right of this page, click your Profile Image)
Clone your fork down to your local machine

git clone https://github.com/your-username/awesome-vulnerable.git

Create a branch

git checkout -b branch-name

Make your changes (choose from any task below)
Commit and push

git add .

git commit -m 'Commit message'

git push origin branch-name

Create a new pull request from your forked repository (Click the New Pull Request button located at the top of your repo)
Wait for your PR review and merge approval!
Star this repository if you had fun!

Contributions are always appreciated

14 KiB Raw Blame History