Vulnerable Websites for Testing: 12 Legal Practice Targets

Deliberately vulnerable applications let you practise web security testing legally, because their owners published them for exactly that purpose. The most widely used are OWASP Juice Shop, DVWA, WebGoat, bWAPP, Metasploitable and PortSwigger’s Web Security Academy, with Hack The Box, TryHackMe, VulnHub, HackThisSite, Google Gruyere and PentesterLab covering the rest of the range. Scanning or attacking any other site without written authorisation is a criminal offence in most jurisdictions, regardless of intent.

Learning to find vulnerabilities requires applications that have them, and practising on real websites is illegal in most of the world under computer misuse legislation, whatever your motive. The way around this is not a grey area, it is a well-established set of applications that were built broken on purpose and published with explicit permission to attack them.

This list covers twelve of them, grouped by what they are for. Most run locally in Docker in about a minute. Several are hosted platforms with their own rules, which are worth reading before you start.

Before you start: the legal line

The rule is simple and worth stating plainly. You may test systems you own, systems you have written authorisation to test, and systems whose owner has published an explicit invitation to test them, which is what every application on this list has done.

Everything else is unauthorised access. In the UK that is the Computer Misuse Act, in the US the Computer Fraud and Abuse Act, and most other jurisdictions have an equivalent. Good intentions, a lack of damage and a responsible disclosure email afterwards are not defences. People have been prosecuted for scanning.

A bug bounty programme is authorisation, but only within its published scope. Read the scope, and stay inside it.

Self-hosted applications

These run on your own machine, usually in Docker. Nothing leaves your network, so you can be as aggressive as you like.

OWASP Juice Shop

A modern JavaScript single-page shop with well over a hundred challenges, ranging from trivial to genuinely hard. It is the best starting point for most people because it looks and behaves like an application built this decade, rather than a teaching exercise, and it covers the full OWASP Top 10 plus cryptographic issues, XXE and broken access control. Progress is tracked on a built-in scoreboard.

DVWA (Damn Vulnerable Web Application)

A PHP and MySQL application with adjustable difficulty levels, which is its main strength: you can see the same vulnerability at low, medium, high and impossible security settings and read the source for each. Excellent for understanding why a fix works rather than just that it does. Covers SQL injection, command injection, file upload, CSRF and XSS.

WebGoat

OWASP’s teaching application, structured as guided lessons with explanation rather than as open challenges. Java-based. The right choice if you want to be taught rather than to be tested, and the lesson format makes it a common pick for onboarding developers.

bWAPP

Over a hundred vulnerabilities in a deliberately broad PHP application, including a number of classes the more polished projects skip. Dated in appearance, still one of the widest coverage sets available.

Metasploitable

A whole vulnerable Linux virtual machine rather than a single web application, useful when the thing you want to practise is network and service exploitation rather than web testing. Pairs naturally with Metasploit.

OWASP Mutillidae II

Another broad PHP application with hints and multiple difficulty levels, frequently used in classroom settings because it maps cleanly onto the OWASP Top 10.

Hosted labs and platforms

These are run by someone else. Read the terms, since some platforms restrict tooling or automation.

PortSwigger Web Security Academy

Free, extensive and probably the best structured web security training available anywhere. Written by the team behind Burp Suite, it pairs written material with live labs covering everything from basic SQL injection to HTTP request smuggling and server-side prototype pollution. If you only use one resource from this list, use this one.

Hack The Box

A subscription platform with retired and active machines, plus web-focused challenges. Community solutions for retired machines make it a strong self-study path, and it is widely used as OSCP preparation.

TryHackMe

More guided than Hack The Box, with structured learning paths and a gentler start. The better choice for someone who has not done this before.

VulnHub

A free library of downloadable vulnerable virtual machines contributed by the community, each usually with a write-up available. Enormous variety, uneven quality, entirely free.

Google Gruyere

A small vulnerable web application published by Google with an accompanying codelab. Short and focused, good for a first hour.

HackThisSite / PentesterLab

HackThisSite is a long-running free challenge site covering web basics and more. PentesterLab offers structured exercises with a strong emphasis on reading and understanding vulnerable source code.

Which one should you start with

Practising with tools

A vulnerable application is also the right place to learn what your tools actually do, and what they miss. Running a scanner against Juice Shop and then working through the same application by hand is the fastest way to understand the gap between automated and manual testing, which is usually larger than people expect.

Our comparison of free online vulnerability scanners covers the hosted and open-source options, and open source penetration testing tools goes wider across the toolchain.

One important caveat: hosted scanners are for targets you control. Do not point an online scanner at a hosted lab platform you do not own, since that breaches most platforms’ terms and is exactly the behaviour this page opens by warning about.

From practice to production

Practice applications are built so that vulnerabilities can be found. Real ones are not. A production application has authentication, business logic that took three years to accumulate, and access-control rules nobody has written down, which is why real testing needs both automation and people.

ImmuniWeb® Neuron handles automated web and API security scanning with a zero false-positive SLA. ImmuniWeb® On-Demand adds CREST-accredited human penetration testing for the logic and access-control classes no scanner reaches. And if you just want to see where your own site stands today, the free Website Security Test takes under a minute.