vulnerable-web-app 开源项目推荐（113 个）

OWASP /wrongsecrets

易受攻击的应用程序，其中包含展示如何不使用秘密的示例

erev0s /VAmPI

带有OWASP十大安全测试漏洞的易受攻击REST API

OWASP /OWASP-VWAD

⚠️ This repo is no longer in use. Please refer to https://vwad.owasp.org

OWASP /Vulnerable-Web-Application

OWASP Vulnerable Web Application Project https://github.com/hummingbirdscyber

Checkmarx /capital

A built-to-be-vulnerable API application based on the OWASP top 10 API vulnerabilities. Use c{api}tal to learn, train and exploit API Security vulnerabilities within your own API Security CTF.

lucideus-repo /UnSAFE_Bank

Vulnerable Banking Suite

appsecco /sqlinjection-training-app

A simple PHP application to learn SQL Injection detection and exploitation techniques.

GoSecure /template-injection-workshop

Workshop on Template Injection (6 exercises) covering Twig, Jinja2, Tornado, Velocity and Freemaker engines.

lunasec-io /Spring4Shell-POC

This is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965).

OWASP /www-project-vulnerable-web-applications-directory

The OWASP Vulnerable Web Applications Directory Project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available.

Aif4thah /VulnerableLightApp

Vulnerable API for research and education

kOaDT /oss-oopssec-store

Security training for the apps you actually ship. Open your browser and start hacking.

aligorithm /Zero-Health

Zero trust. Zero security. Total exposure. A deliberately vulnerable health tech platform with AI Chatbot for learning about application security and ethical hacking. It contains vulnerabilities from OWASP top 10 Web, API and AI/LLM Security Vulnerabilities. Highly vulnerable, never use in production.

Irench1k /unsafe-code

Hands-on secure code review training: learn to find vulnerabilities in Flask, Django, FastAPI through production-quality examples. Whitebox pentesting for modern web frameworks.

dev-angelist /WebSafeHub---Vulnerable-Web-App

WebSafeHub - 易受攻击的网页应用

TheTwitchy /vulnd_xxe

A server vulnerable to XXE that can be used to test payloads using the xxer tool.

SagarBiswas-MultiHAT /SecurePay_E-Wallet-V1

Local PHP/MySQL e-wallet application combined with a hands-on cybersecurity demo lab. Implements user/admin auth, balances, transfers, CSRF protection, session timeouts, login lockout, and hashing. Includes a toggleable Vulnerable/Secure lab to demonstrate XSS and session hijacking with real code and mitigations.

OSTEsayed /OSTE-Vulnerable-Web-Application

Vulnerable Web application made with PHP/SQL designed to help new web testers gain some experience and test DAST tools for identifying web vulnerabilities. Containing some of the most well-known vulnerabilities such as SQL, cross-site scripting (XSS), OS command injections, our intention to expand more vulnerabilities for learning purposes.

sec4you /VulnLabs

docker-compose bringing up multiple vulnerable applications inside containers.

karimtariqx /HackerStories

This project is a vulnerable web application to practice on. It is designed for educational purposes to help security enthusiasts and developers understand and mitigate common web vulnerabilities.