A curated list of VULNERABLE APPS and SYSTEMS which can be used as PENETRATION TESTING PRACTICE LAB.

Damn Vulnerable Restaurant is an intentionally vulnerable Web API game for learning and training purposes dedicated to developers, ethical hackers and security engineers.

BChecks collection for Burp Suite Professional and Burp Suite Enterprise Edition

A high performance go implementation of Wappalyzer Technology Detection Library

HTTP Archive fork of Wappalyzer

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

Unicode characters that will translate a single character to multiple characters in domain names or TLD's

Using django to simulate SQL injection and HTTP Parameter Pollution

A python script that finds endpoints in JavaScript files

Awesome Vulnerable Applications

Chapar is a simple and easy to use api testing tools aims to help developers to test their api endpoints. it support http and grpc protocols.

A fast tool to scan CRLF vulnerability written in Go

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving to…

Sasori is a dynamic web crawler powered by Puppeteer, designed for lightning-fast endpoint discovery.

BugBountyTips

CORS Misconfiguration Scanner

A collection of HAR files for developing against the HAR spec

Complex payload encoder

Automagically reverse-engineer REST APIs via capturing traffic

Attack surface detector that identifies endpoints by static analysis

An innovative superfamily of fonts for code

Library for accessing HTTP Archives (HAR) with Java

🌐 Identify the technologies powering any website. This is a fork of the now deleted Wappalyzer project by @AliasIO and community.

Security interview questions with possible explanation for roles in AppSec, Pentesting, Cloud Security, DevSecOps, Network Security and so on

Intel One Mono font repository

Simple websites vulnerable to Server Side Template Injections(SSTI)

Detectify Crowdsource Challenge