English | Русский | 中文 | हिन्दी | ਪੰਜਾਬੀ | 한국어 | Português (Brasil)

OWASP VulnerableApp is a modular deliberately vulnerable application designed primarily for validating and benchmarking security scanners through reproducible test scenarios, while also supporting learning and experimentation.

Unlike traditional vulnerable applications, VulnerableApp is designed as a testable security ecosystem, not a static training app.

• 🔬 Scanner benchmarking for tools like Burp Suite, OWASP ZAP, and custom DAST engines
• 🧩 Modular vulnerability design that allows new scenarios without modifying core services
• 📊 Security regression testing across releases and environments
• 🎯 Realistic attack surface simulation for modern web application patterns
• 🧪 Deterministic vulnerability behavior for repeatable scanning results
• 🧠 Built for security engineers, researchers, and educators

• Validate how security tools behave across known vulnerability patterns
• Build controlled environments for security experimentation
• Extend vulnerability coverage as new attack techniques emerge
• Run consistent, repeatable security testing pipelines

Most vulnerable apps are:

• Static
• Hard to extend
• Designed only for manual learning

automation, reproducibility, and evolution

New to the project? Watch this OWASP Spotlight session for a high-level overview of VulnerableApp:

OWASP Spotlight series: VulnerableApp overview

There are 2 ways to run the project:

1. The simplest way to run the project is using Docker containers which will run the full-fleged VulnerableApplication with all the components. For running as Docker application, follow following steps:

   1. Download and Install Docker Compose
   2. Clone this Github repository
   3. Open the terminal and Navigate to the Project root directory
   4. Run the command docker-compose pull && docker-compose up
   5. Navigate to browser and visit http://localhost and this will give the User Interface for VulnerableApp.
   6. Mailpit is also available at http://localhost/mailpit/ for viewing emails captured by the local SMTP server.

   Note: The above steps will run the latest unreleased VulnerableApp version. If you want to run the latest released version, please use docker latest tag.

2. Another way to run the VulnerableApp is as standalone Vulnerable Application is:

   1. Navigate to Releases Section in github and download the Jar for the latest released version
   2. Open the terminal and navigate to the project root directory
   3. Run the command java -jar VulnerableApp-*
   4. Navigate to browser and visit http://localhost:9090/VulnerableApp. This will give the Legacy User Interface for the VulnerableApp.

There are 2 ways in which this project can be built and used:

1. As a Docker application which will help in running the full-fledged VulnerableApplication. For running as Docker application, follow following steps:
   1. Build the docker image by running ./gradlew jibDockerBuild
   2. Download Docker-Compose and run in the same directory docker-compose up
   3. Navigate to browser and visit http://localhost and this will give the User Interface for VulnerableApp.
2. As a SpringBoot application which will run with the Legacy UI or Rest API but gives the benefit of debugging and solving issues. This is the simple way,
   1. Import the project into your favorite IDE and run it
   2. Navigate to browser and visit: http://localhost:9090/VulnerableApp and this will give the Legacy User Interface for VulnerableApp which you can use to debug and test.

There are multiple ways in which you can contribute to the project:

1. If you are a developer and trying to start on to the project, then the suggestion is to go through the list of issues which contains good first issue which can be a good starter.
2. If you are a developer or a security professional looking to add new Vulnerability type then you can Generate the Sample Vulnerability by running ./gradlew GenerateSampleVulnerability. It will generate the Sample Vulnerability template which has placeholders and comments. Modified files can be seen in the logs of the command or in the github history. You can navigate to those files, fill in the placeholders and then build the project to see the effect of the changes.
3. In case you are looking to contribute to the project by publicising it or working on the growth of the project, please feel free to add your thoughts to discussions section or issues and we can discuss over them.

VulnerableApp-facade provides a modern UI for VulnerableApp. To test your local changes with the Modern UI:

1. Prerequisite: Ensure you have Docker and Docker-Compose installed.
2. Run Testing Script:
   • On Windows: .\scripts\testWithModernUI.bat
   • On Linux/Mac: ./scripts/testWithModernUI.sh

This script will build your local changes into a Docker image (sasanlabs/owasp-vulnerableapp:unreleased) and start the full stack (including facade, jsp, and php services) using docker-compose.local.yml.

3. Access the UI: Navigate to http://localhost to see the modern UI with your changes.

4. Access Mailpit: Navigate to http://localhost/mailpit/ to view emails captured by the local SMTP server.

• Java17
• Spring Boot
• ReactJS
• Javascript/TypeScript

For accessing database from browser, visit: http://localhost:9090/VulnerableApp/h2

Database Connection properties:

JDBC Url: jdbc:h2:mem:testdb
User Name: admin
Password: hacker

1. JWT Vulnerability
2. Command Injection
3. Cryptography Failures
4. File Upload Vulnerability
5. Path Traversal Vulnerability
6. SQL Injection
   1. Error Based SQLi
   2. Union Based SQLi
   3. Blind SQLi
7. XSS
   1. Persistent XSS
   2. Reflected XSS
8. XXE
9. Open Redirect
   1. Http 3xx Status code based
10. SSRF
11. IDOR
12. Clickjacking
13. LDAP Injection
14. Authentication Vulnerability
15. Password Reset Vulnerability

VulnerableApp ships a comparator that grades a scanner's findings against the project's built-in ground truth and writes a coverage / missed / unmatched report. Both DAST and SAST scanners are supported via the same endpoint:

• Endpoint: POST http://<baseurl>/VulnerableApp/scanner/benchmark
• Request body — pick the shape that matches your scanner:
  • DAST: { tool, scanType: "DAST", findings: [ { url, type, cwe, wascId } ] } (scanType is optional and defaults to DAST; type/cwe/wascId are individually optional — any one axis matching is enough)
  • SAST: { tool, scanType: "SAST", findings: [ { filePath, line, cwe, type } ] }
• Response body and benchmarks/<tool>-results.json on disk: coverage report
• Ground truth: GET http://<baseurl>/VulnerableApp/scanner/dast for DAST and GET http://<baseurl>/VulnerableApp/scanner/sast for SAST. The bare /scanner path is deprecated and stays until 30 Sep 2027.

Running the scanner itself is out of scope — you supply the JSON. See benchmarks/README.md for the full input/output schemas, matching rules, canonical vulnerability-type vocabulary, and curl examples.

In case you are stuck with any of the steps or understanding anything related to project and its goals, read Security Policy if then also it is not resolved feel free to shoot a mail at [email protected] or raise an issue, and we will try our best to help you.

1. OWASP Spotlight series overview of project
2. Overview video for OWASP Spotlight series
3. Documentation
4. Design Documentation
5. Owasp VulnerableApp
6. Overview Video

1. Overview of Owasp-VulnerableApp - Medium article
2. Overview of Owasp-VulnerableApp - Blogspot post
3. Introduction to Owasp VulnerableApp by Kenji Nakajima
4. Gen AI based platform Shannon exploiting VulnerableApp
5. I Built the OWASP ZAP File Upload Addon. Here’s Why VulnerableApp-Facade Had to Exist First

1. View Global Academic Interest

1. Reddit exploiting SQL Injection Vulnerability