A curated list of VULNERABLE APPS and SYSTEMS which can be used as PENETRATION TESTING PRACTICE LAB.

Damn Vulnerable NodeJS Application

Intentionally Vulnerable Serverless Functions to understand the specifics of Serverless Security Vulnerabilities

A simple PHP application to learn SQL Injection detection and exploitation techniques.

Capture the flag challenges

AzureGenerat0r, a tool for automated generation and configuration of test environments in Microsoft Azure

An insecure React Native mobile application for use in Micro Focus demonstrations

Insecure Web Application - Java version

Simple Spring/Java web application for Fortify demonstrations

Sample Java source code containing vulnerabilities to illustrate Fortify usage

Java Sample

Insecure Web Application - .NET version

Demo project with open source obstacles

WebGoat is a deliberately insecure application

An insecure NodeJS/Express web application for use in Debricked demonstrations

Repository for code, PoCs and others for "Security development for Muggles"

Web and mobile application security training platform

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

An insecure microservices demo application.