OWASP WebGoat

Web application security is difficult to learn and practice. Not many people have full blown web applications like online book stores or online banks that can be used to scan for vulnerabilities. In addition, security professionals frequently need to test tools against a platform known to be vulnerable to ensure that they perform as advertised. All of this needs to happen in a safe and legal environment.

View on GitHub

About OWASP WebGoat

1. Run using Docker

Already have a browser and ZAP and/or Burp installed on your machine in this case you can run the WebGoat image directly using Docker. Every release is also published on DockerHub. docker run -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 webgoat/webgoat If you want to reuse the container, give it a name: docker run --name webgoat -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 webgoat/webgoat As long as you don’t remove the container you can use: docker start webgoat This way, you can start where you left off. If you remove the container, you need to use docker run again.

• DockerHub

2. Run using Docker with complete Linux Desktop

Instead of installing tools locally we have a complete Docker image based on running a desktop in your browser. This way you only have to run a Docker image which will give you the best user experience. docker run -p 127.0.0.1:3000:3000 webgoat/webgoat-desktop

3. Standalone

Download the latest WebGoat release from https://github.com/WebGoat/WebGoat/releases java -Dfile.encoding=UTF-8 -Dwebgoat.port=8080 -Dwebwolf.port=9090 -jar webgoat-2023.5.jar Click the link in the log to start WebGoat.

• https://github.com/WebGoat/WebGoat/releases

Project Resources

Project Leaders

Nanne Baars

Project Leader

René Zubčević

Project Leader

Project Information

Lab Project

Classification

Training

Language

JavaScript

Contributors

172

GitHub Stars

9389

Downloads

626952

Corporate Supporters

Become a Corporate Supporter Meet our Corporate Supporters Supporter Job Postings

OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.

OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.