Open-source alternatives to Hackazon

Vulnerable web site. Used to test sentinel features.

OWASP WebGoat.NET

Cross-site scripting labs for web application security enthusiasts

Lab set-up for learning SQL Injection Techniques

CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

the main hackademic code repository

Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities. NOTE: This project is out of date, please use https://github.com/snoopysecurity/dvws-node

Fuzzing101 is an educational resource providing a structured curriculum and containerized security labs for learning software fuzzing and vulnerability research. It functions as a training course that guides users through the process of identifying security flaws using systematic input manipulation and memory corruption analysis. The project distinguishes itself by providing isolated environments that ensure consistent build dependencies for practicing software instrumentation and crash triaging. It includes a practical tutorial on using evolutionary fuzzing engines and instrumentation tools

The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups

small set of PHP scripts to practice exploiting LFI, RFI and CMD injection vulns

The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing.

Short and simple vulnerable PHP web application that naïve scanners found to be perfectly safe

A deliberately vulnerable modern day app with lots of DOM related bugs

Damn Small Vulnerable Web

Securibench Micro is a benchmark for static analysis tools for security.

WebGoat is a deliberately insecure web application designed as an interactive security lab for learning how to identify and exploit common web vulnerabilities. It serves as a containerized sandbox that allows for the simulation and experimentation of web-based attacks and penetration testing techniques without risking production systems. The project functions as a learning lab that maps specific insecure coding patterns to structured lessons. It implements simulated server-side flaws to provide a hands-on environment for studying common security vulnerabilities and defensive coding practices.

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.

A collection of web pages, vulnerable to command injection flaws