Deliberately insecure web application for training
Intentionally vulnerable web shop by OWASP, covering the OWASP Top Ten and more, used for security training, CTFs and testing scanners.
OWASP Juice Shop is a modern single-page web application that is insecure on purpose. It contains a large set of hacking challenges of varying difficulty, mapped to vulnerability categories such as those in the OWASP Top Ten, with a score board that tracks progress.
It is used in awareness training, university courses, capture-the-flag events and to benchmark security tools. Run it only in an isolated environment: its vulnerabilities are real by design.
MIT · MIT License · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: MIT.
This application is vulnerable on purpose, so its own advisories are not tracked here.
Interactive TLS-capable intercepting HTTP proxy
Interactive HTTPS proxy with a terminal UI (mitmproxy), a web UI (mitmweb) and a scriptable command-line tool (mitmdump) driven by Python add-ons.
Automated SQL injection detection and testing
Command-line tool that automates the detection and confirmation of SQL injection flaws in web applications, with support for many database engines.
Template-based vulnerability scanner
Fast vulnerability scanner driven by YAML templates, with thousands of community templates for CVEs, misconfigurations and exposures across many protocols.
Fast web fuzzer for content and parameter discovery
Fast web fuzzer written in Go, used to discover hidden files, directories, virtual hosts and parameters by replacing a FUZZ keyword with wordlist entries.
Intercepting proxy and DAST scanner for web apps
Web application security scanner and intercepting proxy, formerly OWASP ZAP, with automated scans, a desktop UI, an API and a large add-on marketplace.
Web server scanner for dangerous files and misconfigurations
Long-running open-source web server scanner that checks for dangerous files, outdated server software and common misconfigurations.
