Vulnerable Virtual Machines
Downloadable vulnerable VMs to practice exploitation techniques locally. Perfect for offline learning and building foundational skills.
Getting Started
Web Application Practice
DVWA
BeginnerDamn Vulnerable Web Application - PHP/MySQL app with multiple security levels.
- ✓ SQL Injection
- ✓ XSS (Reflected, Stored, DOM)
- ✓ Command Injection
- ✓ File Upload
- ✓ CSRF
- ✓ Brute Force
docker run --rm -it -p 80:80 vulnerables/web-dvwadocker run --rm -it -p 80:80 vulnerables/web-dvwabWAPP
BeginnerBuggy Web Application - Over 100 web vulnerabilities to exploit.
- ✓ OWASP Top 10 coverage
- ✓ 100+ vulnerabilities
- ✓ API Security issues
- ✓ XML/XXE attacks
docker run -d -p 80:80 raesene/bwappdocker run -d -p 80:80 raesene/bwappOWASP WebGoat
IntermediateJava-based vulnerable app with guided lessons for each vulnerability type.
- ✓ Guided lessons
- ✓ Modern vulnerabilities
- ✓ JWT attacks
- ✓ Client-side security
docker run -p 8080:8080 -p 9090:9090 webgoat/webgoatdocker run -p 8080:8080 -p 9090:9090 webgoat/webgoatOWASP Juice Shop
IntermediateModern Node.js app with 100+ challenges covering OWASP Top 10 and beyond.
- ✓ CTF-style challenges
- ✓ Score tracking
- ✓ Modern tech stack
- ✓ API + SPA vulnerabilities
docker run --rm -p 3000:3000 bkimminich/juice-shopdocker run --rm -p 3000:3000 bkimminich/juice-shopNetwork & System Exploitation
Metasploitable 2
BeginnerClassic vulnerable Linux VM for learning Metasploit and basic exploitation.
- ✓ Vulnerable services
- ✓ Weak configurations
- ✓ Metasploit modules
- ✓ Privilege escalation
Metasploitable 3
IntermediateWindows & Linux VMs with more modern vulnerabilities and flags to find.
- ✓ Windows Server 2008
- ✓ Ubuntu 14.04
- ✓ CTF-style flags
- ✓ Vagrant provisioning
VulnHub VMs
VariousHundreds of community-created vulnerable VMs, many with walkthroughs available.
- ✓ Kioptrix series (beginner)
- ✓ Mr. Robot (intermediate)
- ✓ Stapler (intermediate)
- ✓ Brainpan series (advanced)
HackTheBox Retired
VariousDownload retired HTB machines for offline practice (VIP subscription).
- ✓ Real-world scenarios
- ✓ Official walkthroughs
- ✓ Windows & Linux
- ✓ Various difficulties
HackMyVM
VariousFree community-driven platform with actively maintained VMs, flag submission, and leaderboards. The modern alternative to VulnHub.
- ✓ Actively maintained (new VMs weekly)
- ✓ Flag submission & scoring
- ✓ Difficulty ratings
- ✓ Walkthroughs available
Proving Grounds
VariousOffSec's official practice platform. PG Play is free with community VMs. PG Practice for OSCP prep.
- ✓ PG Play (free tier)
- ✓ PG Practice (paid, OSCP-like)
- ✓ Community & OffSec-made machines
- ✓ Windows & Linux targets
Quick Setup Script
Launch multiple vulnerable apps using Docker Compose:
# docker-compose.yml for vulnerable lab
services:
dvwa:
image: vulnerables/web-dvwa
ports:
- "8081:80"
juice-shop:
image: bkimminich/juice-shop
ports:
- "3000:3000"
webgoat:
image: webgoat/webgoat
ports:
- "8080:8080"
- "9090:9090"
bwapp:
image: raesene/bwapp
ports:
- "8082:80"
# Run with: docker compose up -d
# Verify: curl -s http://localhost:3000 | head -5# docker-compose.yml for vulnerable lab
services:
dvwa:
image: vulnerables/web-dvwa
ports:
- "8081:80"
juice-shop:
image: bkimminich/juice-shop
ports:
- "3000:3000"
webgoat:
image: webgoat/webgoat
ports:
- "8080:8080"
- "9090:9090"
bwapp:
image: raesene/bwapp
ports:
- "8082:80"
# Run with: docker compose up -d
# Verify: curl -s http://localhost:3000 | head -5Troubleshooting FAQ
Can't reach vulnerable VM from Kali
- Both VMs must be on the same network (host-only or NAT network)
- Check IPs:
ip addron both machines - Try pinging from each direction to isolate the issue
- VirtualBox: use "NAT Network" (not just "NAT") for VM-to-VM communication
VulnHub OVA import failing
- Try importing with "Import Appliance" not drag-and-drop
- If checksums fail, re-download the OVA
- Some OVAs are VMware-only — convert with
qemu-img convert - VirtualBox: uncheck "Import hard drives as VDI" if import fails
Docker container crashes immediately
- Check logs:
docker logs container_name - Port already in use: change host port (
-p 9080:80) - Out of disk:
docker system dfanddocker system prune - Architecture mismatch on Apple Silicon: add
--platform linux/amd64