awesome-vulnerable-apps

Allsafe is an intentionally vulnerable application that contains various vulnerabilities.

AndroGoat is purposely developed open source vulnerable/insecure app using Kotlin.

hpAndro1337 Application made in Kotlin with multiple vulnerabilities and a CTF.

Damn Vulnerable Bank is designed to be an intentionally vulnerable android application.

Damn Insecure and vulnerable App for Android.

A vulnerable Android application that shows simple examples of vulnerabilities in a ctf style.

A Damn Vulnerable AWS Infrastructure

A Damn Vulnerable Azure Infrastructure

Repository demonstrating the Capital One breach on your AWS account

CdkGoat is Bridgecrew's "Vulnerable by Design" AWS CDK repository.

Cfngoat is Bridgecrew's "Vulnerable by Design" Cloudformation repository.

CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

This is just an instance of the OWASP bWAPP project as a docker container.

Docker container that intakes post and then "clicks" the link. Intentionally vulnerable. To be used with vulnerable by design web apps to realistically simulate XSS and XSRF (CSRF).

This Repository contains CORS misconfiguration related vulnerable codes.

Sample vulnerable code and its exploit code

completely ridiculous API: crAPI will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself.

Docker image to test XXE attacks in java with tomcat.

Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, catch the flags.

Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security.

Intentionally vulnerable Web API game for learning and training purposes dedicated to developers, ethical hackers and security engineers.

Damn Vulnerable Thick Client App developed in C# .NET

Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities.

A vulnerable C program for testing fuzzers.

Damn Vulnerable AI Bank

Damn Vulnerable IoT Device

Damn Vulnerable NodeJS Application

The Damn Vulnerable Router Firmware Project

Damn Vulnerable WordPress

Damn Vulnerable Web Service is a vulnerable web service/API/application that can be used to learn webservices/API vulnerabilities.

A step by step workshop to exploit various vulnerabilities in Node.js and Java applications

Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities.