awesome-vulnerable-apps

Damn Vulnerable AI Bank

An intentionally vulnerable Android application for learning Android application security.

AndroGoat is purposely developed open source vulnerable/insecure app using Kotlin.

hpAndro1337 Application made in Kotlin with multiple vulnerabilities and a CTF.

Damn Vulnerable Bank is designed to be an intentionally vulnerable android application.

Damn Insecure and vulnerable App for Android.

Damn Vulnerable Mobile App, an intentionally vulnerable Flutter app for Android and iOS.

A Damn Vulnerable AWS Infrastructure

A Damn Vulnerable Azure Infrastructure

Repository demonstrating the Capital One breach on your AWS account

CdkGoat is Bridgecrew's "Vulnerable by Design" AWS CDK repository.

Cfngoat is Bridgecrew's "Vulnerable by Design" Cloudformation repository.

CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

This is just an instance of the OWASP bWAPP project as a docker container.

Docker container that intakes post and then "clicks" the link. Intentionally vulnerable. To be used with vulnerable by design web apps to realistically simulate XSS and XSRF (CSRF).

This Repository contains CORS misconfiguration related vulnerable codes.

Sample vulnerable code and its exploit code

completely ridiculous API: crAPI will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself.

Docker image to test XXE attacks in java with tomcat.

Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, catch the flags.

Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security.

An intentionally vulnerable MCP implementation with 10 challenges for learning MCP security, including prompt injection, tool poisoning, and token theft.

Intentionally vulnerable Web API game for learning and training purposes dedicated to developers, ethical hackers and security engineers.

Damn Vulnerable Thick Client App developed in C# .NET

Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities.

Damn Vulnerable IoT Device

Damn Vulnerable NodeJS Application

The Damn Vulnerable Router Firmware Project

Damn Vulnerable WordPress

Damn Vulnerable Web Service is a vulnerable web service/API/application that can be used to learn webservices/API vulnerabilities.

A step by step workshop to exploit various vulnerabilities in Node.js and Java applications

Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities.

Hands-on offensive-security labs platform with real vulnerable apps, real terminals, and real exploitation (no scripted answers). 63+ labs covering OWASP Top 10, JWT attacks, GraphQL, SSRF, deserialization, and more, each running in an isolated per-session Fargate sandbox.