Vulnerable Virtual Machines
Downloadable vulnerable VMs to practice exploitation techniques locally. Perfect for offline learning and building foundational skills.
Getting Started
Web Application Practice
DVWA
BeginnerDamn Vulnerable Web Application - PHP/MySQL app with multiple security levels.
- ✓ SQL Injection
- ✓ XSS (Reflected, Stored, DOM)
- ✓ Command Injection
- ✓ File Upload
- ✓ CSRF
- ✓ Brute Force
docker run --rm -it -p 80:80 vulnerables/web-dvwabWAPP
BeginnerBuggy Web Application - Over 100 web vulnerabilities to exploit.
- ✓ OWASP Top 10 coverage
- ✓ 100+ vulnerabilities
- ✓ API Security issues
- ✓ XML/XXE attacks
docker run -d -p 80:80 raesene/bwappOWASP WebGoat
IntermediateJava-based vulnerable app with guided lessons for each vulnerability type.
- ✓ Guided lessons
- ✓ Modern vulnerabilities
- ✓ JWT attacks
- ✓ Client-side security
docker run -p 8080:8080 -p 9090:9090 webgoat/webgoatOWASP Juice Shop
IntermediateModern Node.js app with 100+ challenges covering OWASP Top 10 and beyond.
- ✓ CTF-style challenges
- ✓ Score tracking
- ✓ Modern tech stack
- ✓ API + SPA vulnerabilities
docker run --rm -p 3000:3000 bkimminich/juice-shopNetwork & System Exploitation
Metasploitable 2
BeginnerClassic vulnerable Linux VM for learning Metasploit and basic exploitation.
- ✓ Vulnerable services
- ✓ Weak configurations
- ✓ Metasploit modules
- ✓ Privilege escalation
Metasploitable 3
IntermediateWindows & Linux VMs with more modern vulnerabilities and flags to find.
- ✓ Windows Server 2008
- ✓ Ubuntu 14.04
- ✓ CTF-style flags
- ✓ Vagrant provisioning
VulnHub VMs
VariousHundreds of community-created vulnerable VMs, many with walkthroughs available.
- ✓ Kioptrix series (beginner)
- ✓ Mr. Robot (intermediate)
- ✓ Stapler (intermediate)
- ✓ Brainpan series (advanced)
HackTheBox Retired
VariousDownload retired HTB machines for offline practice (VIP subscription).
- ✓ Real-world scenarios
- ✓ Official walkthroughs
- ✓ Windows & Linux
- ✓ Various difficulties
Quick Setup Script
Launch multiple vulnerable apps using Docker Compose:
# docker-compose.yml for vulnerable lab
version: '3'
services:
dvwa:
image: vulnerables/web-dvwa
ports:
- "8081:80"
juice-shop:
image: bkimminich/juice-shop
ports:
- "3000:3000"
webgoat:
image: webgoat/webgoat
ports:
- "8080:8080"
- "9090:9090"
bwapp:
image: raesene/bwapp
ports:
- "8082:80"
# Run with: docker-compose up -d