Google Gruyere
Find and exploit the bugs in a small, cheesy web app
Google Gruyere is a small web app full of security holes. Users can post text snippets and store files, and your job is to find and exploit the bugs. The codelab walks you through cross-site scripting, cross-site request forgery, path traversal, information disclosure, denial of service and remote code execution.
Free · No login · Browser · Beginner
About Google Gruyere
You can test it black box, by poking at inputs and HTTP traffic, or white box, by reading the Python source. It suits developers who want to learn common web flaws and how to fix them.
It is free and runs in the browser. When you start, you get your own instance with a unique ID after you agree to the terms. Do not upload any personal data to it.
On Breakpoint since 23 Oct 2026.