juice-shop
juice-shop/juice-shopIntentionally vulnerable web application covering OWASP Top 10 vulnerabilities for security training, CTF competitions, and penetration testing…
ctfeducationlabs-practice+3
14.3k
juice-shop/juice-shopIntentionally vulnerable web application covering OWASP Top 10 vulnerabilities for security training, CTF competitions, and penetration testing…
webgoat/webgoatDeliberately vulnerable web application with interactive lessons and challenges for learning web application security and penetration testing…
b4sith-sec/gu3ssweakDeliberately vulnerable Android app for mobile security research and bug bounty practice - OWASP Mobile Top 10
sarthak4126/web-app-pentestingWeb application penetration testing lab — vulnerable Flask app, automated scanner, and professional pentest report. Covers OWASP Top 10, SQLi, XSS,…
pannagkumaar/pentest-labModern cyber range with 50 hands-on challenges across web, API, cloud, AI, and blue-team security tracks. Features guided attack chains, transparent…
rufflabs/crushftp_cve-2025-31161Pre-built vulnerable CrushFTP 10.8.0 binary for authorized penetration testing of CVE-2025-31161, an unauthenticated authentication bypass…
amirmuhammadmarvi/network-security-labControlled virtual attack & defense lab — CVE-2011-2523 exploitation, Nmap recon, Nikto scanning, UFW hardening on Metasploitable 2
sobri3195/pegasus-pentest-arsenalA comprehensive web application security testing toolkit that combines 10 powerful penetration testing features into one tool.
dockersecurityplayground/dspA Microservices-based framework for the study of Network Security and Penetration Test techniques
enochgitgamefied/nextjs-cve-2025-29927Intentionally vulnerable Next.js application demonstrating CVE-2025-29927 authentication bypass via middleware WAF evasion. Designed for security…
theronielanddaronpodcastshow/svjaThe Super Vulnerable Java Application (SVJA), as demonstrated in the Roniel and DaRon Podcast Show, is an Apache Struts application designed to…
commando-x/vuln-bank-mobileA deliberately vulnerable mobile banking application designed for practicing mobile security testing. Features common vulnerabilities found in…
dolevf/damn-vulnerable-graphql-applicationDamn Vulnerable GraphQL Application is an intentionally vulnerable GraphQL service implementation designed for learning about and practising GraphQL…
mindpatch/simple-mavenDeliberately vulnerable C# API application for practicing web application exploitation and security testing. Includes Docker setup and documentation…
effortlessdevsec/ninjasworkoutDeliberately vulnerable Node.js web application containing 19+ security bugs (XSS, SSRF, Prototype Pollution, RCE) for hands-on penetration testing…
prateek147/dvia-v2Damn Vulnerable iOS App (DVIA) is an iOS application that is damn vulnerable. Its main goal is to provide a platform to mobile security…
tombstoneghost/tiwapDeliberately vulnerable Flask web application with 22 security flaws across 3 difficulty levels for hands-on penetration testing and web security…
rewanthtammana/damn-vulnerable-bankIntentionally vulnerable Android banking app for practicing mobile security testing, featuring root detection, anti-debugging, SSL pinning, and…