# Vulnerable Apps, Servers, and Websites

The following is a collection of vulnerable servers (VMs) or websites that you can use to practice your skills (sorted alphabetically).

- bWAPP : <https://sourceforge.net/projects/bwapp/files/bWAPP>
- Damn Vulnerable ARM Router (DVAR): <http://blog.exploitlab.net/2018/01/dvar-damn-vulnerable-arm-router.html>
- Damn Vulnerable iOS Application (DVIA): <http://damnvulnerableiosapp.com>
- Damn Vulnerable Web App (DVWA): <https://github.com/ethicalhack3r/DVWA>
- DOMXSS: <http://www.domxss.com/domxss/>
- Game of Hacks: <http://www.gameofhacks.com>
- Gruyere: <https://google-gruyere.appspot.com>
- Hack This Site: <https://www.hackthissite.org>
- Hack This: <https://www.hackthis.co.uk>
- Hack Yourself first <https://hack-yourself-first.com/>
- Hackazon : <https://github.com/rapid7/hackazon>
- HellBound Hackers: <https://www.hellboundhackers.org>
- Metasploitable2 : <https://community.rapid7.com/docs/DOC-1875>
- Metasploitable3 : <https://blog.rapid7.com/2016/11/15/test-your-might-with-the-shiny-new-metasploitable3/>
- Over The Wire Wargames: <http://overthewire.org/wargames>
- OWASP  Juice Shop : https://www.owasp.org/index.php/OWASP_Juice_Shop_Project
- OWASP Mutillidae II: <https://sourceforge.net/projects/mutillidae>
- Peruggia: <https://sourceforge.net/projects/peruggia>
- RootMe: <https://www.root-me.org>
- Samurai Web Testing Framework: <http://www.samurai-wtf.org/>
- Try2Hack: <http://www.try2hack.nl>
- Vicnum: <http://vicnum.ciphertechs.com>
- VulnHub:https://www.vulnhub.com
- Web Security Dojo: <https://www.mavensecurity.com/resources/web-security-dojo>
- WebSploit Labs (created and maintained by Omar Ωr Santos): https://websploit.h4cker.org
- WebGoat: <https://github.com/WebGoat/WebGoat>
- PortSwigger Web Security Academy: https://portswigger.net/web-security