Open-source alternatives to Sqlilabs

Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities. NOTE: This project is out of date, please use https://github.com/snoopysecurity/dvws-node

A modern vulnerable web app

CryptOMG is a configurable CTF style test bed that highlights common flaws in cryptographic implementations.

WackoPicko is a vulnerable web application used to test web application vulnerability scanners.

OWSAP Damn Vulnerable Web Sockets (DVWS) is a vulnerable web application which works on web sockets for client-server communication.

OWASP WebGoat.NET

Juice Shop is a self-contained web application designed as a platform for cybersecurity education and security training. It functions as a controlled environment containing intentional security flaws, allowing users to practice offensive security techniques and defensive coding practices while tracking their progress through a live scoreboard. The platform serves as an industry-standard benchmark for evaluating the effectiveness and detection accuracy of automated security scanning tools. By hosting a standardized set of known vulnerabilities and common attack patterns, it provides a reliable

Security training for the apps you actually ship. Open your browser and start hacking.

Damn Vulnerable Cloud Application

The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing.

CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

Short and simple vulnerable PHP web application that naïve scanners found to be perfectly safe

A deliberately vulnerable modern day app with lots of DOM related bugs

Damn Small Vulnerable Web

Cross-site scripting labs for web application security enthusiasts

Securibench Micro is a benchmark for static analysis tools for security.

WebGoat is a deliberately insecure web application designed as an interactive security lab for learning how to identify and exploit common web vulnerabilities. It serves as a containerized sandbox that allows for the simulation and experimentation of web-based attacks and penetration testing techniques without risking production systems. The project functions as a learning lab that maps specific insecure coding patterns to structured lessons. It implements simulated server-side flaws to provide a hands-on environment for studying common security vulnerabilities and defensive coding practices.

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.