View source for OWASP Vulnerable Web Applications Directory Project

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |

==OWASP Vulnerable Web Applications Directory Project==

The OWASP Vulnerable Web Applications Directory Project (VWAD) is a comprehensive and well maintained registry of all known vulnerable web applications currently available for legal security and vulnerability testing of various kinds.

==Introduction==

Select from the above tabs to view all of the:
* On-Line applications
* Off-Line applications
* Virtual Machines and ISO images

==Description==

The OWASP Vulnerable Web Applications Directory (VWAD) Project is a comprehensive and well maintained registry of all known vulnerable web applications currently available. These vulnerable web applications can be used by web developers, security auditors and penetration testers to put in practice their knowledge and skills during training sessions (and especially afterwards), as well as to test at any time the multiple hacking tools and offensive techniques available, in preparation for their next real-world engagement.

The main goal of VWAD is to provide a list of vulnerable web applications available to security professionals for hacking and offensive activities, so that they can attack realistic web environments... without going to jail :)

The vulnerable web applications have been classified in three categories: On-Line, Off-Line, and VMs/ISOs. Each list has been ordered alphabetically.

An initial list that inspired this project was maintained till October 2013 at: http://blog.taddong.com/2011/10/hacking-vulnerable-web-applications.html.

A brief description of the OWASP VWAD project is available at: http://blog.dinosec.com/2013/11/owasp-vulnerable-web-applications.html.

The associated GitHub repository is available at: https://github.com/OWASP/OWASP-VWAD.

==Licensing==
OWASP Vulnerable Web Applications Directory Projects is free to use. It is licensed under the Apache 2.0 License, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially.

| style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |

== What is VWAD? ==

OWASP VWAD provides:

* A list of all known vulnerable web applications.

== Presentation ==

Interview with [https://soundcloud.com/trustedsoftwarealliance/simon-bennetts-web Simon Bennetts – The OWASP Web Applications Vulnerability Project] .

== Project Leaders ==

*[mailto:raul@raulsiles.com Raul Siles]
*[[User:Simon Bennetts|Simon Bennetts]]

== Related Projects ==

* N/A

== Open Hub ==

*https://www.openhub.net/p/OWASP-VWAD

| style="padding-left:25px;width:200px;" valign="top" | 

== Quick Download ==

* N/A - The project is self contained on the wiki.
* GitHub repository - https://github.com/OWASP/OWASP-VWAD

== News and Events ==
* [16 Oct 2013] Project created.

== In Print ==
N/A

==Classifications==

   {| width="200" cellpadding="2"
   |-
   | rowspan="2" width="50%" valign="top" align="center" | [[File:Owasp-incubator-trans-85.png|link=:Category:OWASP_Project#tab=Terminology]]
   | width="50%" valign="top" align="center" | [[File:Owasp-builders-small.png|link=Builders]]  
   |-
   | width="50%" valign="top" align="center" | [[File:Owasp-breakers-small.png|link=Breakers]]
   |-
   | colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]] 
   |-
   | colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]   
   |}

|}

=On-Line apps=

{{:OWASP_Vulnerable_Web_Applications_Directory_Project/Pages/Online | Online}}

Please note that the [https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project/Pages/Online source page] for this tab is automatically generated via the [https://github.com/OWASP/OWASP-VWAD VWAD github project].

You can either edit that page directly or submit a pull request.

= Off-Line apps =

Vulnerable applications that have to be downloaded and used locally:

{{:OWASP_Vulnerable_Web_Applications_Directory_Project/Pages/Offline | Offline}}

Please note that the [https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project/Pages/Offline source page] for this tab is automatically generated via the [https://github.com/OWASP/OWASP-VWAD VWAD github project].

You can either edit that page directly or submit a pull request.


The following apps are quite old and appear not to be maintained - as such they are probably less useful.

{{:OWASP_Vulnerable_Web_Applications_Directory_Project/Pages/OfflineOld | OfflineOld}}

Please note that the [https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project/Pages/OfflineOld source page] for this tab is automatically generated via the [https://github.com/OWASP/OWASP-VWAD VWAD github project].

You can either edit that page directly or submit a pull request.

= Virtual Machines or ISOs =

VMs which contain multiple vulnerable applications:

{{:OWASP_Vulnerable_Web_Applications_Directory_Project/Pages/VMs | VMs}}

Please note that the [https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project/Pages/VMs source page] for this tab is automatically generated via the [https://github.com/OWASP/OWASP-VWAD VWAD github project].

You can either edit that page directly or submit a pull request.

Please add any new apps in alphabetic order, correct mistakes or just comment on this page if you dont have write access to this wiki.

The following apps are quite old and appear not to be maintained - as such they are probably less useful.

{{:OWASP_Vulnerable_Web_Applications_Directory_Project/Pages/VMsOld | VMsOld}}

Please note that the [https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project/Pages/VMsOld source page] for this tab is automatically generated via the [https://github.com/OWASP/OWASP-VWAD VWAD github project].

You can either edit that page directly or submit a pull request.


= Acknowledgements =
==Volunteers==
VWAD is developed by a worldwide team of volunteers. The primary contributors to date have been:

*[mailto:raul@raulsiles.com Raul Siles]
*[[User:Simon Bennetts|Simon Bennetts]]

==Others==
* [mailto:achim@owasp.org Achim Hoffmann]
* [[User:Zakiakhmad|Zaki Akhmad]]

==On-line resources used==
* [http://blog.taddong.com/2011/10/hacking-vulnerable-web-applications.html Hacking Vulnerable Web Applications Without Going To Jail]
* [http://securitythoughts.wordpress.com/2010/03/22/vulnerable-web-applications-for-learning/ Vulnerable Web Applications for learning]
* [http://code.google.com/p/owaspbwa/wiki/UserGuide OWASP BWA User Guide]

==Other vulnerable web-app compilations==
* [http://www.amanhardikar.com/mindmaps/Practice.html Penetration Testing Practice Labs - Vulnerable Apps/Systems]

= Road Map and Getting Involved =
As of March 5, 2014, all known Vulnerable Web Applications have been included.

Going forward the plan is to:
* Keep publicising
* Keep up to date with any new apps released or updated
* Review every 6 months to see if it could be improved in any way

Involvement in the development and promotion of the OWASP Vulnerable Web Applications Directory Project is actively encouraged!

You do not have to be a security expert in order to contribute.

Some of the ways you can help:
* Update the wiki with any missing apps
* Send pull requests to https://github.com/OWASP/OWASP-VWAD

=Project About=
{{:Projects/OWASP_Vulnerable_Web_Applications_Directory_Project}} 

__NOTOC__ <headertabs /> 

[[Category:OWASP Project]]  
[[Category:OWASP_Builders]] 
[[Category:OWASP_Breakers]]  
[[Category:OWASP_Document]]