BadStore - Badstore.net is dedicated to helping you understand how hackers prey on Web application vulnerabilities, and to showing you how to reduce your exposure. Our Badstore demonstration software is designed to show you common hacking techniques.
BodgeIt Store - The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing.
Butterfly Security Project - The ButterFly project is an educational environment intended to give an insight into common web application and PHP vulnerabilities. The environment also includes examples demonstrating how such vulnerabilities are mitigated.
bWAPP - bee-box is a custom Linux VM pre-installed with bWAPP.
CloudGoat - CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool
Commix - A collection of web pages, vulnerable to command injection flaws.
CryptOMG - CryptOMG is a configurable CTF style test bed that highlights common flaws in cryptographic implementations.
Damn Vulnerable Web Services (DVWS) -
Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities.
GameOver - Project GameOver was started with the objective of training and educating newbies about the basics of web security and educate them about the common web attacks and help them understand how they work.
hackxor - Hackxor is a realistic web application hacking game, designed to help players of all abilities develop their skills. All the missions are based on real vulnerabilities I've personally found while doing pentests, bug bounty hunting, and research.
LAMPSecurity - LAMPSecurity training is designed to be a series of vulnerable virtual machine images along with complementary documentation designed to teach linux,apache,php,mysql security.
OWASP Mantra - Free and Open Source Browser based Security Framework, is a collection of free and open source tools integrated into a web browser, which can become handy for penetration testers, web application developers, security professionals etc.
NOWASP / Mutillidae 2 - OWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiast.
OWASP BWA - A collection of vulnerable web applications that is distributed on a Virtual Machine in VMware format compatible with their no-cost VMware Player and VMware vSphere Hypervisor (ESXi) products (along with their older and commercial products).
OWASP Hackademic - Project helps you test your knowledge on web application security. You can use it to actually attack web applications in a realistic but also controllable and safe environment.
OWASP Bricks - Web application security learning platform built on PHP and MySQL
OWASP Security Shepherd - OWASP Security Shepherd is a web and mobile application security training platform. Security Shepherd has been designed to foster and improve security awareness among a varied skill-set demographic
SecuriBench - Stanford SecuriBench is a set of open source real-life programs to be used as a testing ground for static and dynamic security tools. Release .91a focuses on Web-based applications written in Java.
SocketToMe - It combines chat, a simple number guessing game and a few other hidden features
sqli-labs - SQLI labs to test error based, Blind boolean based, Time based.
MCIR (Magical Code Injection Rainbow) - The Magical Code Injection Rainbow! MCIR is a framework for building configurable vulnerability testbeds. MCIR is also a collection of configurable vulnerability testbeds
Sqlilabs - Lab set-up for learning SQL Injection Techniques
VulnApp - ASP.net application implementing some of the most common applications we come across on our penetration testing engagements
PuzzleMall - A vulnerable web application for practicing session puzzling
WackoPicko - WackoPicko is a vulnerable web application used to test web application vulnerability scanners
WebGoat.NET - This web application is a learning platform that attempts to teach about common web security flaws. It contains generic security flaws that apply to most web applications
WebSecurity Dojo - A free open-source self-contained training environment for Web Application Security penetration testing. Tools + Targets = Dojo
XVWA - XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.
Zap WAVE - An easy to use integrated penetration testing tool for finding vulnerabilities in web applications
Web-Security Academy - A free platform for learining and testing your Web Application security skills with practice labs and learning materials by Portswigger
OWASP Juice Shop - An Open Source platform for testing Web-Application Security skills. The application contains a vast number of hacking challenges of varying difficulty level
Sites for Downloading Older Versions of Various Software¶
Exploit-DB - The Exploit Database is maintained by Offensive Security, an information security training company that provides various Information Security Certifications as well as high end penetration testing services
Old Apps - Provide our users with a wide assortment of current versions of familiar software, and their predecessors for free
Old Version - Pick a software title... to downgrade to the version you love!
HP freebank - The Free Online Bank Web site is published by Micro Focus Fortify for the sole purpose of demonstrating the functionality and effectiveness of Micro Focus Fortify’s WebInspect products in detecting and reporting Web application vulnerabilities.
IBM altoromutual - The AltoroJ website is published by IBM Corporation for the sole purpose of demonstrating the effectiveness of IBM products in detecting web application vulnerabilities and website defects
Mavituna testsparker - This is a test and demonstration site for Netsparker , Next Generation Web Application Security Scanner. Start Netsparker to scan this web site and let it find the vulnerabilities
Embedded Security CTF - Scattered throughout the world in locked warehouses are briefcases filled with Cy Yombinator bearer bonds that could be worth billions comma billions of dollars. You will help steal the briefcases
EnigmaGroup - Enigma Group has been providing its members a legal and safe security resource where they can develop their pen-testing skills on various challenges provided by this site
Escape - The code generates HTML in an unsafe way. Prove it by calling alert(1)
Google Gruyere - This codelab shows how web application vulnerabilities can be exploited and how to defend against these attacks
Forensic Practical - To hone your forensic skills and run malware found on the honeypots by installing it on clean computer systems and watch its behavior
Gh0st Lab - The original idea of this network was to create a security research network where like minded individuals could work together towards the common goal of knowledge
Hack The Box - An online platform allowing you to test your penetration testing skills and exchange ideas and methodologies with thousands of people in the security field
TryHackMe - Cyber Security training made easy. A comfortable experience to learn by designing prebuilt courses which include virtual machines (VM) hosted in the cloud ready to be deployed
Hack This Site - Hack This Site is a free, safe and legal training ground for hackers to test and expand their hacking skills
HackThis - Defend the Web is an Interactive Cyber Security Platform
Hack.me - Hacking-Lab is a service by Security Competence GmbH, a Swiss subsidiary of Compass Security AG.
Compass Security is a well renowned European company specializing in penetration testing, incident response, digital forensics, and security trainings
Hacking-Lab - Hack.me is a FREE, community based project powered by eLearnSecurity. The community can build, host and share vulnerable web application code for educational and research purposes
Halls Of Valhalla - Valhalla is a place for sharing knowledge and ideas. Users can submit code, as well as science, technology, and engineering-oriented news and articles
Hax.Tor - HaX.ToR.Hu is a challenge site putting emphasis on teaching basic security related issues in a fun way
Metasploit Unleashed - The Metasploit Unleashed (MSFU) course is provided free of charge by Offensive Security in order to raise awareness for underprivileged children in East Africa
OverTheWire - The wargames offered by the OverTheWire community can help you to learn and practice security concepts in the form of fun-filled games
PentestIT - Penetration testing laboratories "Test lab" emulate an IT infrastructure of real companies and are created for a legal pen testing and improving penetration testing skills
CSC Play on Demand - The aim of this challenge is to identify the means by which an insider may accidentally or maliciously leak organisational secrets via seemingly innocent files
Root Me - The fast, easy, and affordable way to train your hacking skills
Security Treasure Hunt - A new Packet Capture-based Web Vulnerability Analysis challenge is available through April 30th, 2013, sponsored by Cyber Aces
XSS: ProgPHP - Next-Gen Domain Registration. Progphp.com is coming soon!
Pwnable.tw - A newer set of high quality pwnable challenges)
Pwnable.kr - One of the more popular recent wargamming sets of challenges
PicoCTF - Designed for high school students while the event is usually new every year, it's left online and has a great difficulty progression
CTF Learn - A new CTF based learning platform with user-contributed challenges
Reversing.kr - This site tests your ability to Cracking & Reverse Code Engineering
w3challs - Our challenges address several subsets of hacking, mostly oriented on the offensive. A multitude of technologies and architectures are waiting for you. Show us your mad skillz and pop some shells (or calcs)!
RingZer0 Team - RingZer0 Team's online CTF offers you tons of challenges designed to test and improve your hacking skills through hacking challenges.
HellBound Hackers -The hands-on approach to computer security and simulated security challenges
Komodo Consulting - Application Security Challenge designed to challenge your application hacking skills
PwnAdventure - Pwnie Island is a limited-release, first-person, true open-world MMORPG set on a beautiful island where anything could happen. That's because this game is intentionally vulnerable to all kinds of silly hacks! Flying, endless cash, and more are all one client change or network proxy away