> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/vulnerable-labs.md).

# Vulnerable Labs

Vulnerable web applications are essential for learning and practising web security. These labs provide hands-on experience for security professionals, penetration testers, and students to understand web vulnerabilities and exploit them in a controlled environment.

#### 1. DVWA (Damn Vulnerable Web Application)

**Repository:** [DVWA GitHub](https://github.com/digininja/DVWA)\
DVWA is a PHP/MySQL web application designed to be intentionally vulnerable. It covers OWASP's Top 10 vulnerabilities, including SQL Injection, XSS, CSRF, and more.

#### 2. Juice Shop

**Repository:** [Juice Shop GitHub](https://github.com/juice-shop/juice-shop)\
OWASP Juice Shop is a modern web application security training platform that covers a wide range of vulnerabilities in a fun, CTF-style format.

#### 3. WebGoat

**Repository:** [WebGoat GitHub](https://github.com/WebGoat/WebGoat-Legacy)\
WebGoat is a deliberately insecure web application maintained by OWASP. It is designed for users to learn about application security by exploiting vulnerabilities.

#### 4. bWAPP (Buggy Web Application)

**Download:** [bWAPP SourceForge](https://sourceforge.net/projects/bwapp/)\
A PHP-based web application with over 100 security flaws, allowing users to practice real-world web security challenges.

#### 5. PortSwigger Web Security Labs

**Website:** [PortSwigger Labs](https://portswigger.net/web-security/all-labs)\
PortSwigger offers a collection of hands-on web security labs covering OWASP vulnerabilities and beyond, ideal for practical learning.