Best SecGame #1: Sauron Alternatives & Competitors in 2026

AzureGoat

AzureGoat is a deliberately vulnerable Azure cloud infrastructure that incorporates OWASP Top 10 vulnerabilities and Azure service misconfigurations for security training and penetration testing practice.

Hack The Box Pro Labs

Subscription-based enterprise red team simulation labs with AD focus.

Damn Vulnerable Web Services

An intentionally vulnerable web application containing multiple web service security flaws designed for educational purposes and security testing practice.

AHHHZURE

AHHHZURE is an automated deployment script that creates vulnerable Azure cloud lab environments for offensive security training and cloud penetration testing practice.

OWASP Hackademic Challenges

OWASP Hackademic Challenges is an educational web platform offering 10 realistic vulnerability scenarios for learning information security concepts through hands-on exploitation in a controlled environment.

CloudGoat

CloudGoat is a vulnerable-by-design AWS deployment tool that creates intentionally insecure cloud environments for hands-on cybersecurity training through capture-the-flag scenarios.

WackoPicko Vulnerable Website

WackoPicko is an intentionally vulnerable web application used for security testing, penetration testing practice, and vulnerability scanner evaluation.

Security Scenario Generator (SecGen)

SecGen is an open-source framework that automatically generates vulnerable virtual machines and hacking challenges for cybersecurity education and penetration testing training.

Commix-Testbed

A collection of vulnerable web applications containing command injection flaws designed to test and evaluate detection and exploitation tools like commix.

Damn Vulnerable eXtensive Training Environment (DVXTE)

DVXTE is a Docker-based training platform containing multiple vulnerable applications designed for cybersecurity education and skill development.

Damn Vulnerable Web Application (DVWA)

A deliberately vulnerable PHP/MySQL web application designed for security training, testing, and educational purposes in controlled environments.

InsecureBankv2

InsecureBankv2 is an intentionally vulnerable Android application with a Python back-end server designed for educational purposes in mobile security testing and Android vulnerability research.

SentinelTestbed

A vulnerable web site for testing Sentinel features

Damn Vulnerable GraphQL Application

A deliberately vulnerable GraphQL application designed for security testing and educational purposes, containing multiple intentional flaws for learning GraphQL attack and defense techniques.

HackSys Extreme Vulnerable Driver (HEVD)

A Windows kernel driver intentionally designed with various vulnerabilities to help security researchers practice kernel exploitation techniques.

OWASP Damn Vulnerable Web Sockets (DVWS)

A deliberately vulnerable web application that uses WebSocket communication to provide a training environment for learning about WebSocket-related security vulnerabilities.

InsecureShop

InsecureShop is an intentionally vulnerable Android application built in Kotlin for educating developers and security professionals about mobile app vulnerabilities and penetration testing techniques.

OVAA (Oversecured Vulnerable Android App)

OVAA is an intentionally vulnerable Android application that aggregates common platform security vulnerabilities for educational and security testing purposes.

BodgeIt Store

Vulnerable web application for beginners in penetration testing.

Hackazon

Hackazon is a vulnerable web application storefront designed for security professionals to practice testing modern web technologies and identifying common vulnerabilities.

Xtreme Vulnerable Web Application (XVWA)

XVWA is an intentionally vulnerable PHP/MySQL web application designed for security education, containing multiple common web vulnerabilities for hands-on learning and practice.

Windows / Linux Local Privilege Escalation Workshop

An educational workshop providing hands-on training materials, lab environments, and tools for learning local privilege escalation techniques on Windows and Linux systems.

DVTA - Vulnerable Thick Client Application

DVTA is a Vulnerable Thick Client Application with various security vulnerabilities.

damnvulnerable.me

A deliberately vulnerable web application containing DOM-based XSS, CSRF, and other web vulnerabilities for security testing and educational purposes.

Damn Small Vulnerable Web

A deliberately vulnerable web application written in under 100 lines of Python code for educational purposes and web security testing.

0l4bs Cross-site scripting labs

A collection of 20 cross-site scripting challenges covering various XSS attack vectors and filtering bypass techniques for educational purposes.

OWASP Bricks

Deliberately vulnerable web application for security professionals to practice attack techniques.

LAMPSecurity Training

A series of vulnerable virtual machine images with documentation to teach Linux, Apache, PHP, MySQL security.

Penetration Testing Practice Lab - Vulnerable Apps/Systems

Collection of URLs for vulnerable web applications and systems for cybersecurity practice.

Damn Vulnerable Linux (DVL)

Linux-based operating system intentionally vulnerable for cybersecurity practice.

awesome-vulnerable-apps

A list of vulnerable applications for testing and learning

IronCircle Cybersecurity Training Platform

AI-powered browser-based cybersecurity training platform with labs and certs

SimSpace Cyber Range Platform

Cyber range platform for training, testing, and validating security controls.

ORNA AI Crisis Simulation

AI-driven tabletop exercise platform for cyber crisis simulation training

SimSpace Cyber Range

Cyber range platform for training, testing, and validating security readiness

SimSpace Attack Catalog

Catalog of simulated attack scenarios for cyber defense training and validation

TryHackMe Cyber Security Training

Hands-on cybersecurity training platform with gamified labs and challenges

PentesterLab PRO

Online platform offering 700+ hands-on web security exercises and training

Circadence Security Immersion Workshops

Gamified cyber range workshops for security product demos and training

Cyberbit Platform

Cybersecurity training and simulation platform for SOC teams

Cyberbit Operational Cyber Readiness Platform

Platform for operational cyber readiness training and exercises

Cyberbit Cyber Range

Cyber range platform for hands-on cybersecurity training and simulation

FIFTH DOMAIN Integrated Cyber Operations Platform

Integrated platform for cyber operations talent mgmt, training & assessment

RangeForce Cyber Readiness Platform

Cloud-based cyber range platform for team-based security training and drills

CybExer Cyber Range Technology

NATO-awarded cyber range platform for training, testing, and validation

Cybexer Cyber Ranges for Finance and Banking

Cyber range platform for finance & banking sector security training

Bastazo Agoge

OT cybersecurity training platform with hands-on simulations and digital twins

CyberSecDome

Digital twin-based cyber defense platform with AI tools and VR interface