vavkamil / Awesome Vulnerable Apps
Licence: cc0-1.0
Awesome Vulnerable Applications
Stars: ✭ 180
Projects that are alternatives of or similar to Awesome Vulnerable Apps
Crithit
Takes a single wordlist item and tests it one by one over a large collection of websites before moving onto the next. Create signatures to cross-check vulnerabilities over multiple hosts.
Stars: ✭ 182 (+1.11%)
Mutual labels: hacking, penetration-testing, bugbounty
Quiver
Quiver is the tool to manage all of your tools for bug bounty hunting and penetration testing.
Stars: ✭ 140 (-22.22%)
Mutual labels: hacking, penetration-testing, bugbounty
Awesome Bbht
A bash script that will automatically install a list of bug hunting tools that I find interesting for recon, exploitation, etc. (minus burp) For Ubuntu/Debain.
Stars: ✭ 190 (+5.56%)
Mutual labels: hacking, penetration-testing, bugbounty
Nosqlmap
Automated NoSQL database enumeration and web application exploitation tool.
Stars: ✭ 1,928 (+971.11%)
Mutual labels: hacking, penetration-testing, bugbounty
Vhostscan
A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and dynamic default pages.
Stars: ✭ 767 (+326.11%)
Mutual labels: hacking, penetration-testing, bugbounty
Osmedeus
Fully automated offensive security framework for reconnaissance and vulnerability scanning
Stars: ✭ 3,391 (+1783.89%)
Mutual labels: hacking, penetration-testing, bugbounty
Hosthunter
HostHunter a recon tool for discovering hostnames using OSINT techniques.
Stars: ✭ 427 (+137.22%)
Mutual labels: hacking, penetration-testing, bugbounty
Payloadsallthethings
A list of useful payloads and bypass for Web Application Security and Pentest/CTF
Stars: ✭ 32,909 (+18182.78%)
Mutual labels: hacking, penetration-testing, bugbounty
Interlace
Easily turn single threaded command line applications into a fast, multi-threaded application with CIDR and glob support.
Stars: ✭ 760 (+322.22%)
Mutual labels: hacking, penetration-testing, bugbounty
Dirsearch
Web path scanner
Stars: ✭ 7,246 (+3925.56%)
Mutual labels: hacking, penetration-testing, bugbounty
Resources
A Storehouse of resources related to Bug Bounty Hunting collected from different sources. Latest guides, tools, methodology, platforms tips, and tricks curated by us.
Stars: ✭ 62 (-65.56%)
Mutual labels: hacking, penetration-testing, bugbounty
Ezxss
ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.
Stars: ✭ 1,022 (+467.78%)
Mutual labels: penetration-testing, bugbounty, bug
Minesweeper
A Burpsuite plugin (BApp) to aid in the detection of scripts being loaded from over 23000 malicious cryptocurrency mining domains (cryptojacking).
Stars: ✭ 162 (-10%)
Mutual labels: hacking, penetration-testing, bugbounty
Learn Web Hacking
Study Notes For Web Hacking / Web安全学习笔记
Stars: ✭ 2,326 (+1192.22%)
Mutual labels: hacking, penetration-testing
Awesome Mobile Security
An effort to build a single place for all useful android and iOS security related stuff. All references and tools belong to their respective owners. I'm just maintaining it.
Stars: ✭ 1,837 (+920.56%)
Mutual labels: hacking, bugbounty
Jwt Hack
🔩 jwt-hack is tool for hacking / security testing to JWT. Supported for En/decoding JWT, Generate payload for JWT attack and very fast cracking(dict/brutefoce)
Stars: ✭ 172 (-4.44%)
Mutual labels: hacking, bugbounty
Pidrila
Python Interactive Deepweb-oriented Rapid Intelligent Link Analyzer
Stars: ✭ 125 (-30.56%)
Mutual labels: hacking, penetration-testing
Buffer overflow
Don't let buffer overflows overflow your mind
Stars: ✭ 131 (-27.22%)
Mutual labels: hacking, penetration-testing
Reconnoitre
A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.
Stars: ✭ 1,824 (+913.33%)
Mutual labels: hacking, penetration-testing
Awesome Hacking Resources
A collection of hacking / penetration testing resources to make you better!
Stars: ✭ 11,466 (+6270%)
Mutual labels: hacking, penetration-testing
Awesome Vulnerable Applications 
A curated list of various vulnerable by design applications
Contents
- Online
- Paid
- Vulnerable VMs
- Cloud Security
- SSO - Single Sign On
- Mobile Security
- OWASP Top 10
- Technologies
- Uncategorized
Online
Online vulnerable app and CTFs
Paid
Paid tranining courses
Vulnerable VMs
- Vulhub
- Exploit Exercises
- Metasploitable3 - Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities.
Cloud Security
- Kubernetes Goat - Kubernetes Goat is "Vulnerable by Design" Kubernetes Cluster. Designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security.
- CloudGoat - CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool
- CdkGoat - Vulnerable AWS CDK Infra - CdkGoat is Bridgecrew's "Vulnerable by Design" AWS CDK repository.
- Cfngoat - Vulnerable Cloudformation Template - Cfngoat is Bridgecrew's "Vulnerable by Design" Cloudformation repository.
- TerraGoat - Vulnerable Terraform Infra - TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository.
- caponeme - Capital One Breach - Repository demonstrating the Capital One breach on your AWS account
SSO - Single Sign On
- vulnerable-sso - vulnerable single sign on
Mobile Security
- InsecureBankv2 - Vulnerable Android application for developers and security enthusiasts to learn about Android insecurities
- Damn Vulnerable Bank - Vulnerable Banking Application for Android
- Vulnerable Kext - A WIP "Vulnerable by Design" kext for iOS/macOS to play & learn *OS kernel exploitation
OWASP Top 10
- Owasp Juice shop - OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
- DVWA - Damn Vulnerable Web Application (DVWA)
- DSVW - Damn Small Vulnerable Web
- bWAPP - This is just an instance of the OWASP bWAPP project as a docker container.
- Xtreme Vulnerable Web Application - XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.
- lazyweb - This web application is a demonstration of common server-side application flaws. Each of the vulnerabilities has its own difficulty rating.
- OWASP Mutillidae II - OWASP Mutillidae II is a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiast.
- Pentest_lab - Local penetration testing lab using docker-compose.
SQL Injection
- Yet Another Vulnerability Database - Yet Another Vulnerability Database
XSS Injection
- clicker-service - simulate XSS - Docker container that intakes post and then "clicks" the link. Intentionally vulnerable. To be used with vulnerable by design web apps to realistically simulate XSS and XSRF (CSRF).
- XSSworm.dev - Self-replication contest
- xssed - A set of XSS vulnerable PHP scripts for testing
- xssable - A vulnerable blogging platform used to demonstrate XSS vulnerabilities.
Server Side Request Forgery
- SSRF_Vulnerable_Lab - This Lab contain the sample codes which are vulnerable to Server-Side Request Forgery attack
CORS Misconfiguration
- CORS-vulnerable-Lab - Sample vulnerable code and its exploit code
XXE Injection
- XXE Lab - A simple web app with a XXE vulnerability.
- docker-java-xxe - Docker image to test XXE attacks in java with tomcat.
Technologies
WordPress
- DVWP - Damn Vulnerable WordPress
Node.js
- exploit-workshop - A step by step workshop to exploit various vulnerabilities in Node.js and Java applications
- DVNA - Damn Vulnerable NodeJS Application
- Extreme Vulnerable Node Application - Extreme Vulnerable Node Application
- dvws-node - Damn Vulnerable Web Service is a vulnerable web service/API/application that can be used to learn webservices/API vulnerabilities.
Firmware
- DVRF - The Damn Vulnerable Router Firmware Project
- OWASP IoT Goat - IoTGoat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices.
Uncategorized
- dvws - Damn Vulnerable Web Services - Damn Vulnerable Web Services is an insecure web application with multiple vulnerable web service components that can be used to learn real world web service vulnerabilities.
- Fuzzgoat - A vulnerable C program for testing fuzzers.
- wavsep - The Web Application Vulnerability Scanner Evaluation Project
- leaky-repo - Benchmarking repo for secrets scanning
- OWASP SKF labs - Repo for all the OWASP-SKF Docker lab examples
- Vulnserver - Vulnerable server used for learning software exploitation
- Damn-Vulnerable-GraphQL-Application - Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security.
Contribute
Contributions welcome! Read the contribution guidelines first.
License
To the extent possible under law, vavkamil has waived all copyright and related or neighboring rights to this work.
Note that the project description data, including the texts, logos, images, and/or trademarks,
for each open source project belongs to its rightful owner.
If you wish to add or remove any projects, please contact us at [email protected].