Awesome GitHub RepositoriesVulnerable Web Applications

Ce projet sert de dépôt centralisé de connaissances techniques et de ressources administratives piloté par la communauté. Il fournit une taxonomie structurée qui agrège des informations disparates dans un cadre consultable, soutenant l'apprentissage continu et la résolution rapide de problèmes pour les administrateurs système et les praticiens de la cybersécurité. En cartographiant les ressources à travers la sécurité offensive, la gestion de l'infrastructure et le développement logiciel, il offre un chemin unifié pour l'acquisition de compétences et la référence professionnelle. Le projet est défini par une philosophie de conception axée sur la ligne de commande, privilégiant les utilitaires basés sur le terminal et les interfaces scriptables pour faciliter une administration système efficace et des flux de travail de sécurité répétables. Il se distingue par une approche agnostique de la plateforme, maintenant une documentation et des guides opérationnels qui restent applicables à travers divers environnements de type Unix et basés sur le cloud. Cette intégration modulaire de la chaîne d'outils permet aux utilisateurs de composer des environnements personnalisés adaptés à des tâches administratives ou de sécurité spécifiques. Le dépôt couvre une large surface de capacités, notamment des boîtes à outils complètes pour l'audit système, la gestion réseau et le durcissement de l'infrastructure. Il fournit des parcours d'apprentissage structurés pour le développement des compétences en cybersécurité, allant des laboratoires de piratage éthique et des normes de test d'intrusion à l'évaluation des vulnérabilités et aux meilleures pratiques de configuration système. La collection englobe également un large éventail d'outils de productivité, d'utilitaires de diagnostic et de supports pédagogiques conçus pour rationaliser la maintenance de routine et améliorer la posture de sécurité globale.

DVWA is a vulnerable web application sandbox and PHP security training environment. It serves as a deployable penetration testing target and an OWASP Top 10 lab designed for practicing exploits and simulating common web security vulnerabilities. The application allows users to adjust security difficulty levels to match their skill level and toggle between different SQL database engines to test how various systems handle injection attacks. It includes a mechanism to disable authentication, enabling automated security tools to interact directly with the environment. The project provides capabi

DVWA is a vulnerable web application lab and penetration testing sandbox designed to simulate common security flaws. It serves as a training platform for the OWASP Top 10 security risks and functions as a PHP and MySQL security lab for practicing the identification and exploitation of web vulnerabilities. The project provides a graduated learning experience through configurable security levels that adjust the difficulty of the vulnerabilities. It also supports switching between different database engines to research how various storage systems respond to injection attacks. The application is

This project serves as a comprehensive cybersecurity training platform and resource repository focused on web application security. It functions as a centralized hub for security practitioners, providing both a curated collection of technical documentation and research, and a system for deploying isolated, containerized environments to practice security analysis and exploitation techniques. The platform distinguishes itself by integrating automated data aggregation with hands-on, container-based orchestration. It maintains a current knowledge base of industry research and digital threats whil

Juice Shop is a self-contained web application designed as a platform for cybersecurity education and security training. It functions as a controlled environment containing intentional security flaws, allowing users to practice offensive security techniques and defensive coding practices while tracking their progress through a live scoreboard. The platform serves as an industry-standard benchmark for evaluating the effectiveness and detection accuracy of automated security scanning tools. By hosting a standardized set of known vulnerabilities and common attack patterns, it provides a reliable

Xray is a security assessment tool focused on web vulnerability scanning, attack surface mapping, and technology fingerprinting. It identifies common security flaws through automated scanning and semantic analysis, while verifying findings via a custom proof-of-concept execution engine. The system distinguishes itself with a containerized vulnerability testbed used to deploy pre-configured vulnerable applications. This environment allows for the simulation of specific vulnerabilities and edge-case scenarios to validate scanner accuracy and eliminate false positives. The platform covers a bro

WebGoat is a deliberately insecure web application designed as an interactive security lab for learning how to identify and exploit common web vulnerabilities. It serves as a containerized sandbox that allows for the simulation and experimentation of web-based attacks and penetration testing techniques without risking production systems. The project functions as a learning lab that maps specific insecure coding patterns to structured lessons. It implements simulated server-side flaws to provide a hands-on environment for studying common security vulnerabilities and defensive coding practices.

w3af is a web penetration testing suite and security audit framework designed to identify and exploit vulnerabilities in web applications. It functions as a vulnerability scanner that crawls targets to find injection points and a fuzzer used to discover hidden endpoints and test input validation. The project distinguishes itself by providing an intercepting HTTP proxy for capturing and modifying traffic, combined with a knowledge-base driven exploitation system. It enables the execution of security exploits to gain remote shell access and supports post-exploitation activities, such as routing

Pikachu is a web security training platform and vulnerable web application sandbox. It provides a containerized lab environment designed for practicing penetration testing and identifying common security flaws. The project serves as an OWASP Top 10 practice lab, offering a simulation suite for critical risks. It includes specific scenarios for practicing the exploitation of SQL injection, cross-site scripting, remote code execution, and broken access control. The environment covers a broad range of security testing simulations, including directory traversal, server-side request forgery, unsa

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe