OWASP SamuraiWTF
SamuraiWTF is OWASP's open-source training environment for web application penetration testing. It ships as a ready-to-run desktop, pre-loaded with attack tools, vulnerable target applications, and Katana-managed configuration. This is designed so instructors and self-learners can run realistic, hands-on AppSec labs without building an environment from scratch.
Samurai-Dojo is a set of vulnerable web applications created by and for the Samurai security training and testing distributions like SamuraiSTFU and SamuraiWTF. These vulnerable applications include:
For ease of development a Vagrant configuration are available. The Vagrant configuration and deployment are stored in the following files:
The SamuraiWTF project team is currently rewriting dojo-basic. This effort is to
modify the project codebase to be a complete modern application. It is being worked on
in the dojo-basic-2 repo.
Project Resources
Project Information
Production Project
Classification
Code
Language
Shell
License
GNU Lesser General Public License v3.0
Contributors
21
GitHub Stars
571
Downloads
48
Corporate Supporters
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
Quick Links
Legal & Governance
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.