Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀

Best hands-on lab for learning the fundamentals of cybersecurity and penetration testing workflows also packaged as Docker containers for fast, safe setup.

Sample vulnerable code and its exploit code

Damn Vulnerable Java (EE) Application

Vulnerable Client-Server Application (VuCSA) is made for learning how to perform penetration tests of non-http thick clients. It is written in Java (with JavaFX graphical user interface) and contains multiple challenges including SQL injection, RCE, XML vulnerabilities and more.

VyAPI - A cloud based vulnerable hybrid Android App

Conviso Vulnerable Web Application is the OSS project from the Conviso Application Security for the community. The project represents a vulnerable web application to practice security testing and improve your learning in AppSec..

gRPC Goat is a "Vulnerable by Design" lab created to provide an interactive, hands-on playground for learning and practicing gRPC security.

Examples of different vulnerabilities, in a variety of languages, shapes and sizes.

📧 [Research] E-Mail Injection: Vulnerable applications

Web Application Pentesting Lab with over 40 plus vulnerability, which covers all the owasp top 10 issues.

An intentionally vulnerable AI chatbot to learn and practice AI Security.

OWASP Foundation Web Respository

This is a collection of vulnerable machines that can help you to learn hacking, pentesting and bug hunting. I know there are a lot of lists out there, but most of them are not updated regularly. So I decided to make on myself. Hope this will help you

Several snippets of vulnerable code in different programming languages.

File Content Disclosure on Rails Test Case - CVE-2019-5418

IOTgoat is a vulnerable firmware made by the OWASP project. This is a custom made version of the 'IOTgoat firmware' built for the A5-V11 mini 3G router. This branch brings back the vulnerable IOT firmware back to a real IOT device, for a more realistic experience of IOT device exploitation on a budget.

Sample Spring API for testing

Another vulnerable application for practicing web penetration testing.

Web/API, AI/LLM/MCP, and Web3/Blockchain security labs Android/iOS/Windows/macOS platforms plus PHP/Java/Node.js/Python stacks Cloud/Kubernetes, AD, IoT/ICS, CTF, and other specialized domains Continuously maintained collection of related resources

Intentionally insecure RAG demo for security testing. Test target for LLM Production Safety Scanner. DO NOT deploy publicly.

Deliberately vulnerable REST API for OWASP Top 10 (2023) security testing and learning.

A live simulation environment featuring a deliberately vulnerable web app and an automated traffic generator for testing Web Application Firewalls (WAF).

Intentionally vulnerable JavaScript/Express app for testing security remediation tools - 217+ vulnerabilities

Sistema de notas propositalmente vulnerável para educação em segurança cibernética e testes de penetração - contém 12+ vulnerabilidades web intencionais (SQL Injection, XSS, Path Traversal, Command Injection, etc.)

Intentionally vulnerable TypeScript/Express app for testing security remediation tools - 212+ vulnerabilities

🐐 Explore EntraGoat, a deliberately vulnerable Microsoft Entra ID environment for security training that simulates real-world misconfigurations and attack scenarios.

🚀 Master Kubernetes in 14 days with clear lessons, diagrams, examples, and hands-on exercises designed for beginners.

Intentionally vulnerable Node.js REST API for benchmarking SAST, SCA, and code quality tools. Contains 30 real, functional issues across Critical/High/Medium/Low severities covering SQL injection, command injection, path traversal, IDOR, hardcoded secrets, and more. Not for production use.