Vulnerable Practice Apps: DVWA, bWAPP, Juice Shop, WebGoat, AI Goat and More

Part of our free Tools & Targets series. Hands-on guides to the vulnerable practice apps and the security tools you will use on the job. Pair it with our Build Your Own Cyber Lab series for the lab to run them in.

1. Vulnerable practice apps: DVWA, bWAPP, Juice Shop, WebGoat, AI Goat and more (you are here)
2. DVWA walkthrough: every module solved at Low, Medium and High
3. OWASP Juice Shop: beginner and intermediate challenges solved
4. WebGoat and bWAPP: key lessons solved
5. Threat modeling your lab with OWASP Threat Dragon
6. Nessus Essentials: vulnerability scanning your lab
7. Snort and Suricata: network IDS and your first rules
8. Splunk in your lab: install, forward Windows logs, search with SPL
9. Wazuh deep dive: file integrity, vulnerability detection and custom rules

Pick the right target

A good path: DVWA to learn each bug in isolation, WebGoat for the theory, Juice Shop to find bugs in a realistic app, then crAPI and AI Goat for APIs and LLMs.

What about OWASP Threat Dragon? It is often listed alongside these, but it is a free threat-modeling tool, not a vulnerable app. You use it to draw your system and work out what could go wrong before you build it - part 5 of this series covers it.

Where to run them

Use the Ubuntu Docker host from part 5 of our Build Your Own Cyber Lab series, on an isolated network, or run them on your own machine bound to 127.0.0.1 so nothing else on your network can reach them. Snapshot the host before you start.

DVWA

DVWA's repository includes a Docker Compose file:

git clone https://github.com/digininja/DVWA.git
cd DVWA
docker compose up -d

Browse to http://localhost:4280 (the port DVWA's README gives for the container), click Create / Reset Database, and log in with the default admin / password. Set the level under DVWA Security. Each module has a View Source button - always compare the Low, Medium, High and Impossible versions after you solve one; that comparison is where the real learning is. Walkthrough: part 2.

bWAPP

bWAPP ("buggy web application") ships as a PHP app and as bee-box, a ready-made Linux VM with extra server-side bugs. The quickest start is a community Docker image:

docker run -d -p 127.0.0.1:8081:80 raesene/bwapp

Open http://localhost:8081/install.php once to create the database, then log in with the default bee / bug. Choose a bug from the drop-down and a security level (low, medium, high). For bee-box, download the VM from the bWAPP site, import it into VirtualBox or VMware, and keep it on an isolated network. Walkthrough: part 4.

OWASP Juice Shop

docker run -d -p 127.0.0.1:3000:3000 bkimminich/juice-shop

Browse to http://localhost:3000. Finding the hidden Score Board is the first challenge. The official companion book, *Pwning OWASP Juice Shop*, has hints and a full solutions appendix. Walkthrough: part 3.

OWASP WebGoat

docker run -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 webgoat/webgoat

Open http://127.0.0.1:8080/WebGoat, register any local user, and work through the lesson menu. Port 9090 is WebWolf, a companion "attacker" server for receiving callbacks and files. If you want to proxy through Burp or ZAP, WebGoat's README explains the hostnames to use, because browsers bypass the proxy for localhost. Walkthrough: part 4.

OWASP Mutillidae II and crAPI

• Mutillidae II has a dedicated Docker project (mutillidae-docker on GitHub) that starts the app and its database together. Use its hints toggle and built-in tutorials.
• crAPI (completely ridiculous API) is a set of microservices for a fictional car-service company. Its repository has Docker Compose instructions; it needs more RAM than the others. Proxy the mobile-style API calls through Burp and work through broken object-level authorisation, excessive data exposure and mass assignment.

AI Goat: two different projects

• AI Goat (local LLM CTF) runs a local language model in Docker - no cloud account, no fees. It needs a lot of memory (its README asks for at least 16 GB of system RAM with 8 GB for the challenge). Install and run it with the project's script:

git clone https://github.com/dhammon/ai-goat.git
cd ai-goat
chmod +x ai-goat.py
./ai-goat.py --install
./ai-goat.py --run 1

An optional CTFd scoreboard (./ai-goat.py --run ctfd) lists the challenges and checks flags.

• AIGoat (Orca Security) deploys a deliberately vulnerable AI shop into your own AWS account with Terraform. It teaches ML supply-chain, data-poisoning and output-integrity risks, but it creates real cloud resources that cost money - destroy them with Terraform when you finish.

Solving the local AI Goat challenges

The flags are deliberately random strings, and the LLM sometimes invents fake ones, so always confirm a flag in CTFd. The techniques are what matter:

• Challenge 1 - Basic prompt injection. The chatbot holds a secret it was told not to reveal. Direct requests fail; reframing works. Try asking it to role-play, to "repeat everything above this line", to translate its instructions into another language, or to spell the secret one character at a time. The lesson: a system prompt is not an access control. Fix: never put secrets in the prompt; keep them server-side and filter outputs.
• Challenge 2 - Title requestor. The bot fetches a web page title, and its output feeds a downstream operation. Get the model to emit input that the downstream code trusts - for example text that the next step interprets as a command or a different URL. The lesson: treat LLM output as untrusted user input (OWASP LLM Top 10: insecure output handling). Fix: strict allow-lists and validation on anything the model's output drives.

Our prompt injection lab and AI security lab cover the same ideas in the browser.

Keep it in the lab

These apps are deliberately vulnerable. Run them only on an isolated lab network or bound to localhost, never on a server reachable from the internet, and only use these techniques against systems you own or are authorised to test.

Next step

Part 2 solves every DVWA module at Low, Medium and High, with the fix for each.