WebGoat
webgoat/webgoatDeliberately vulnerable web application with interactive lessons and challenges for learning web application security and penetration testing…
ctfeducationlabs-practice+4
webgoat/webgoatDeliberately vulnerable web application with interactive lessons and challenges for learning web application security and penetration testing…
duriantaco/ravageEvidence first autonomous web security testing for controlled, authorized targets. With reproducible labs, audit trails, reports, and XBEN…
pnwcomputers/ultimate-cybersecurity-master-guideThis repository provides a centralized resource for operational cyber defense and offense, compiling Theory, Tools, Operating Procedures, and…
owasp/railsgoatA vulnerable version of Rails that follows the OWASP Top 10
infoslack/awesome-web-hackingCurated list of web application security resources including books, tools, cheat sheets, labs, and courses for learning penetration testing and…
owasp/securityshepherdWeb and mobile application security training platform
swisskyrepo/payloadsallthethingsA list of useful payloads and bypass for Web Application Security and Pentest/CTF
juice-shop/juice-shopIntentionally vulnerable web application covering OWASP Top 10 vulnerabilities for security training, CTF competitions, and penetration testing…
pannagkumaar/pentest-labModern cyber range with 50 hands-on challenges across web, API, cloud, AI, and blue-team security tracks. Features guided attack chains, transparent…
rgvillanueva28/vulnbox-easy-cve-2025-29927CTF challenge container with a Next.JS middleware vulnerability (CVE-2025-29927) for practicing man-in-the-middle attacks and API exploitation.
mobetasec/cve-2024-1813-pocPoC exploit for CVE-2024-1813: PHP object injection in Simple Job Board WordPress plugin, achieving unauthenticated RCE via gadget chain. Includes…
webpwnized/mutillidaeOWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an…
xmyronn/cve-2026-11518-xssProof-of-concept for unauthenticated stored XSS in SourceCodester Inventory System, demonstrating admin session hijacking via crafted registration…
yusufdalbudak/cve-2026-42945Dockerized lab for training on NGINX rewrite vulnerability (CVE-2026-42945) with vulnerable and patched instances, benign test scripts, and…
kamal-418/vulnerable-lab-nextjs-cve-2025-29927Deliberately vulnerable Next.js application designed for practicing exploitation of CVE-2025-29927, with a tutorial video for guided learning.
vutiendat323/int14107_cve-2021-35042Django-based CTF blog platform with integrated CVE-2021-35042 exploit tool for learning web application security and vulnerability exploitation.
maradonam18/-cve-2025-59528-pocA simple python script to exploit CVE-2025-59528, this an Authenticated RCE vulnerability in Flowise application, a popular AI tool. That is also…
sobri3195/pegasus-pentest-arsenalA comprehensive web application security testing toolkit that combines 10 powerful penetration testing features into one tool.