OWASP WebGoat
Run a deliberately insecure web app and work through its hacking lessons
WebGoat is a deliberately insecure Java web application from OWASP, built to teach web security. You run it on your own machine and work through lessons that explain a flaw and then ask you to exploit it. Topics include SQL injection, XSS, XXE, CSRF, path traversal, JWT, insecure deserialization, SSRF and access control. A companion app, WebWolf, plays the attacker's server.
Free · No login · Terminal · Beginner
About OWASP WebGoat
It trains the habits of a web penetration tester, usually alongside a proxy such as ZAP or Burp. The lessons start gently, which makes it a common first step after learning how web apps work.
It is free and open source. You start it locally with Docker or a Java jar, so there is no online account. The project warns your machine is vulnerable while it runs.
Made this game? Claim it →
Tips and discussion
No tips yet.
Sign in to share a tip.