Awesome GitHub RepositoriesVulnerable Web Applications

DVWA is a vulnerable web application lab and penetration testing sandbox designed to simulate common security flaws. It serves as a training platform for the OWASP Top 10 security risks and functions as a PHP and MySQL security lab for practicing the identification and exploitation of web vulnerabilities. The project provides a graduated learning experience through configurable security levels that adjust the difficulty of the vulnerabilities. It also supports switching between different database engines to research how various storage systems respond to injection attacks. The application is

sqli-labs est une collection d'applications web intentionnellement vulnérables et d'environnements sandbox conçus pour s'entraîner à l'identification et à l'exploitation de vulnérabilités par injection SQL. Il sert de laboratoire d'éducation en cybersécurité où les utilisateurs peuvent expérimenter des exploits de base de données dans un cadre contrôlé. L'environnement fournit des modules spécialisés pour tester un large éventail de vecteurs d'attaque, y compris les injections basées sur les erreurs, les injections aveugles booléennes et les injections basées sur le temps. Il couvre spécifiquement des techniques avancées telles que les injections de second ordre, les requêtes empilées et les attaques ciblant les en-têtes HTTP. Le projet inclut également des exercices axés sur l'évasion des filtres de sécurité et le contournement des pare-feu d'applications web via des techniques comme le retrait de commentaires et l'inadéquation d'impédance. Ces scénarios permettent la simulation de tests d'intrusion réels et d'audits de sécurité de bases de données.

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

A modern vulnerable web app

Damn Small Vulnerable Web

A very vulnerable web site written in NodeJS with the purpose of have a project with identified vulnerabilities to test the quality of security analyzers tools tools

Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities. NOTE: This project is out of date, please use https://github.com/snoopysecurity/dvws-node

The Magical Code Injection Rainbow! MCIR is a framework for building configurable vulnerability testbeds. MCIR is also a collection of configurable vulnerability testbeds.

OWSAP Damn Vulnerable Web Sockets (DVWS) is a vulnerable web application which works on web sockets for client-server communication.

WackoPicko is a vulnerable web application used to test web application vulnerability scanners.

the main hackademic code repository

The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing.

Vulnerable Java based Web Application

CryptOMG is a configurable CTF style test bed that highlights common flaws in cryptographic implementations.

A collection of web pages, vulnerable to command injection flaws

Lab set-up for learning SQL Injection Techniques

A deliberately vulnerable modern day app with lots of DOM related bugs

Securibench Micro is a benchmark for static analysis tools for security.

Vulnerable web site. Used to test sentinel features.

Short and simple vulnerable PHP web application that naïve scanners found to be perfectly safe