OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
- owasp
- javascript
- vulnerable
- hacking
Repository Index
83,586 visible repositories in the index
1–23 of 23 · Most stars
Damn Vulnerable Web Application (DVWA)
- dvwa
- php
- sql-injection
- security
Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀
- kubernetes
- vulnerable-app
- security
- hacking
scanner detecting the use of JavaScript libraries with known vulnerabilities. Can also generate an SBOM of the libraries it finds.
- vulnerabilities
- scanner
- firefox-extension
- grunt-plugins
CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool
HackSys Extreme Vulnerable Driver (HEVD) - Windows & Linux
A tool that allows you to create vulnerable instrumented local or cloud environments to simulate attacks against and collect the data into Splunk
- attack-range
- attack-simulation
- adversary
- simulation
A fast vulnerability scanner helps pentesters pinpoint possibly vulnerable targets from a large number of web servers
Create a vulnerable active directory that's allowing you to test most of the active directory attacks in a local lab
- active-directory
- powershell
- redteaming
- penetration-testing
A deliberately vulnerable CI/CD environment. Learn CI/CD security through multiple challenges.
AWSGoat : A Damn Vulnerable AWS Infrastructure
finds publicly known security vulnerabilities in a website's frontend JavaScript libraries
- security-vulnerabilities
- security
- vulnerabilities
- lighthouse
Google Dorks | Google helps you to find Vulnerable Websites that Indexed in Google Search Results. Here is the latest collection of Google Dorks. A collection of 13.760 Dorks. Author: Jolanda de Koff
- dorks
The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 350 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.
Damn Vulnerable GraphQL Application is an intentionally vulnerable GraphQL service implementation designed for learning about and practising GraphQL Security.
OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.
- security
- owasp
- owasp-top-10
- cybersecurity
Awesome Vulnerable Applications
- awesome-list
- awesome
- bug
- bugbounty
cwe_checker finds vulnerable patterns in binary executables
- cwe
- binary-analysis
- static-analyzer
- vulnerability-scanner
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
The repository host gives no description.
Vulnerable Web applications Generator
- vulnerabilities
- docker
- python
- generator
Security training for the apps you actually ship. Open your browser and start hacking.
Express honeypot for RFI and LFI bots: 310 fake vulnerable URLs, logs IP, geolocation and payloads. Docker bait server or app.use() middleware.