Vulnerable Labs Security Tools

Vulnerable REST API with OWASP top 10 vulnerabilities for security testing

WebGoat is a deliberately insecure application

An MCP server implementation

Local penetration testing lab using docker-compose.

Damn Vulnerable Bank is designed to be an intentionally vulnerable android application. This provides an interface to assess your android application security hacking skills.

Vuldroid is a Vulnerable Android Application made with security issues in order to demonstrate how they can occur in code

Repository for download all version of @hpAndro1337 (Android AppSec) application.

Oversecured Vulnerable Android App

DIVA Android - Damn Insecure and vulnerable App for Android

AndroGoat

A WIP "Vulnerable by Design" kext for iOS/macOS to play & learn *OS kernel exploitation

Vulnerable Android application for developers and security enthusiasts to learn about Android insecurities

Intentionally vulnerable Android application.

A tool for standing up (and tearing down!) purposefully insecure cloud infrastructure

Use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.

AzureGoat : A Damn Vulnerable Azure Infrastructure

AWSGoat : A Damn Vulnerable AWS Infrastructure

Vulnerable app with examples showing how to not use secrets

CdkGoat is Bridgecrew's "Vulnerable by Design" AWS CDK repository. CdkGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.

CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool

Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀