Name: BadStore
Homepage: http://www.badstore.net/
Brief description: Badstore.net is dedicated to helping you understand how hackers prey on Web application vulnerabilities, and to showing you how to reduce your exposure. Our Badstore demonstration software is designed to show you common hacking techniques.
Version/Levels: 1 (v1.2)


Name: BodgeIT
Homepage: https://code.google.com/p/bodgeit/
Brief description: The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing.
Version/Levels: 1 (v1.1.0)


Name: Damn Vulnerable Web App
Homepage: http://www.dvwa.co.uk/
Brief description: Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.
Version/Levels: 1 (v1.0.7)



Name: Hacking-Lab
Homepage: http://www.hacking-lab.com/
Brief description: This ist the LiveCD project of Hacking-Lab (www.hacking-lab.com). It gives you OpenVPN access into Hacking-Labs Remote Security Lab. The LiveCD iso image runs very good natively on a host OS, or within a virtual environment (VMware, VirtualBox).
The LiveCD gives you OpenVPN access into Hacking-Lab Remote.You will gain VPN access if both of the two pre-requirements are fulfilled.
Version/Levels: 1 (v5.30)


Name: HackUS HackFest Web CTF
Homepage: http://hackus.org/en/media/training/
Brief description: The Hackfest is an annual event held in Quebec city. For each event, a competition is held where participants competed at solving challenges related to security. For the 2010 edition, I got involved in the competition by creating the web portion of the competition.
Version/Levels: 1 (2010)



Name: Hacme
Homepage: http://www.mcafee.com/us/downloads/free-tools/index.aspx
Brief description: Foundstone Hacme Casino™ is a learning platform for secure software development and is targeted at software developers, application penetration testers, software architects, and anyone with an interest in application security.
Version/Levels: 5 (2006)



Name: Hackxor
Homepage: http://hackxor.sourceforge.net/cgi-bin/index.pl
Brief description: Hackxor is a webapp hacking game where players must locate and exploit vulnerabilities to progress through the story. Think WebGoat but with a plot and a focus on realism&difficulty. Contains XSS, CSRF, SQLi, ReDoS, DOR, command injection, etc
Version/Levels: 1



Name: LAMPSecurity
Homepage: http://sourceforge.net/projects/lampsecurity/
Brief description: Foundstone Hacme Casino™ is a learning platform for secure software development and is targeted at software developers, application penetration testers, software architects, and anyone with an interest in application security.
Version/Levels: v6 (4x)



Name: Moth
Homepage: http://www.bonsai-sec.com/en/research/moth.php
Brief description: Moth is a VMware image with a set of vulnerable Web Applications and scripts.
Version/Levels: v6



Name: Mutillidae
Homepage: http://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-owasp-top-10
Brief description: Mutillidae: A Deliberately Vulnerable Set Of PHP Scripts That Implement The OWASP Top 10
Version/Levels: v1.5



Name: Open Web Application Security Project (OWASP) Broken Web Applications Project
Homepage: https://code.google.com/p/owaspbwa/ or https://www.owasp.org/index.php/OWASP_Broken_Web_Applications_Project
Brief description: This project includes applications from various sources (listed in no particular order).



Name: SecuriBench
Homepage: http://suif.stanford.edu/~livshits/securibench/
Brief description: Stanford SecuriBench is a set of open source real-life programs to be used as a testing ground for static and dynamic security tools. Release .91a focuses on Web-based applications written in Java
Version/Levels: v0.91a



Name: UltimateLAMP
Homepage: http://ronaldbradford.com/blog/ultimatelamp-2006-05-19/
Brief description: UltimateLAMP is a fully functional environment allowing you to easily try and evaluate a number of LAMP stack software products without requiring any specific setup or configuration of these products. UltimateLAMP runs as a Virtual Machine with VMware Player (FREE). This demonstration package also enables the recording of all user entered information for later reference, indeed you will find a wealth of information already available within a number of the Product Recommendations starting with the supplied Documentation.
Version/Levels: v0.2



Name: Vicnum
Homepage: http://vicnum.ciphertechs.com/
Brief description: A mirror of deliberately insecure applications and old softwares with known vulnerabilities. Used for proof-of-concept /security training/learning purposes. Available in either virtual images or live iso or standalone formats
Version/Levels: 1.4 (2009)


Name: Virtual Hacking Lab
Homepage: http://virtualhacking.sourceforge.net/
Brief description: A mirror of deliberately insecure applications and old softwares with known vulnerabilities. Used for proof-of-concept /security training/learning purposes. Available in either virtual images or live iso or standalone formats
Version/Levels: 1



Name: WackoPicko
Homepage: https://github.com/adamdoupe/WackoPicko
Brief description: WackoPicko is a vulnerable web application used to test web application vulnerability scanners.
Version/Levels: 1


Name: WebGoat
Homepage: http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
Brief description: WebGoat is a deliberately insecure J2EE web application maintained by OWASP designed to teach web application security lessons. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat application.
Version/Levels: 1



Name: WebMaven
Homepage: http://www.mavensecurity.com/WebMaven/
Brief description: WebMaven (better known as Buggy Bank) was an interactive learning environment for web application security. It emulated various security flaws for the user to find. This enabled users to safely & legally practice web application vulnerability assessment techniques. In addition, users could benchmark their security audit tools to ensure they perform as advertised.
Version/Levels: 1.0.1


Name: Web Security Dojo
Homepage: http://www.mavensecurity.com/web_security_dojo/
Brief description: A free open-source self-contained training environment for Web Application Security penetration testing. Tools + Targets = Dojo
Various web application security testing tools and vulnerable web applications were added to a clean install of Ubuntu v10.04.1, which is patched with the appropriate updates and VM additions for easy use.
Version 1.1 includes an exclusive speed-enhanced version of Burp Suite Free. Special thanks to PortSwigger .
Version/Levels: 1