vavkamil/awesome-vulnerable-apps

🐶 A curated list of Web Security materials and resources.

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.

WebGoat is a deliberately insecure application

Damn Vulnerable Web Application (DVWA)

A list of web application security

A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if handed out lulz. Please do not abuse these. I do this so to allure people into the field, and I've always found this is the most efficient way.

A curated list of bugbounty writeups (Bug type wise) , inspired from https://github.com/ngalongc/bug-bounty-reference