WebGoat
A deliberately insecure application that allows developers to test vulnerabilities commonly found in Java-based applications that use common and popular open source components. De facto interactive teaching environment for web application security; lessons cover the OWASP Top 10 and more.
Collections offline
Technology Java
Categories Guided lessons Single-player
Author OWASP
Stars 
Last contribution May 30, 2026 < 1mo
Notes
Default configuration binds to localhost. Disconnect from the Internet while using. For educational use only.