Open-source alternatives to DVWS

Vulnerable Java based Web Application

DVWA is a vulnerable web application lab and penetration testing sandbox designed to simulate common security flaws. It serves as a training platform for the OWASP Top 10 security risks and functions as a PHP and MySQL security lab for practicing the identification and exploitation of web vulnerabilities. The project provides a graduated learning experience through configurable security levels that adjust the difficulty of the vulnerabilities. It also supports switching between different database engines to research how various storage systems respond to injection attacks. The application is

Vulnerable web site. Used to test sentinel features.

the main hackademic code repository

Lab set-up for learning SQL Injection Techniques

The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing.

A modern vulnerable web app

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

Short and simple vulnerable PHP web application that naïve scanners found to be perfectly safe

A deliberately vulnerable modern day app with lots of DOM related bugs

Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities. NOTE: This project is out of date, please use https://github.com/snoopysecurity/dvws-node

CryptOMG is a configurable CTF style test bed that highlights common flaws in cryptographic implementations.

The Magical Code Injection Rainbow! MCIR is a framework for building configurable vulnerability testbeds. MCIR is also a collection of configurable vulnerability testbeds.

Damn Small Vulnerable Web

Securibench Micro is a benchmark for static analysis tools for security.