Alternatives to Damn Vulnerable Web Application

A deliberately insecure PHP and MariaDB web application for practising common web vulnerabilities legally. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as Damn Vulnerable Web Application.

  • OWASP Juice Shop

    An intentionally insecure web shop covering the OWASP Top Ten, used for security training and CTFs.

    FreeOpen sourceSelf-hosted

    OWASP Juice Shop is an MIT-licensed insecure web shop built on Node.js that covers the full OWASP Top Ten, suits CTF events, and installs via Docker, Vagrant or packaged distributions.

Similar software

Related functionality, not a direct replacement.

  • Killercoda

    A browser-based platform with interactive Linux and Kubernetes environments for practice and guided scenarios.

    FreeProprietaryWeb