Best Security Scenario Generator (SecGen) Alternatives & Competitors in 2026

CloudGoat

CloudGoat is a vulnerable-by-design AWS deployment tool that creates intentionally insecure cloud environments for hands-on cybersecurity training through capture-the-flag scenarios.

0l4bs Cross-site scripting labs

A collection of 20 cross-site scripting challenges covering various XSS attack vectors and filtering bypass techniques for educational purposes.

SudoCyber

Gamified cybersecurity training platform with hands-on labs and certifications

Damn Vulnerable Web Services

An intentionally vulnerable web application containing multiple web service security flaws designed for educational purposes and security testing practice.

CTFGuide

Social learning platform for CTF challenges, labs, and cybersecurity training.

AHHHZURE

AHHHZURE is an automated deployment script that creates vulnerable Azure cloud lab environments for offensive security training and cloud penetration testing practice.

Exploit-Challenges

A collection of vulnerable ARM binaries designed for educational exploit development and vulnerability research practice across different architectures and exploitation techniques.

OWASP Hackademic Challenges

OWASP Hackademic Challenges is an educational web platform offering 10 realistic vulnerability scenarios for learning information security concepts through hands-on exploitation in a controlled environment.

Mellivora

Mellivora Mellivora is a PHP-based CTF engine that provides comprehensive competition hosting capabilities with challenge management, team scoring, and administrative tools for cybersecurity competitions.

NightShade

NightShade is a Django-based capture the flag framework that enables organizations to create and manage cybersecurity competitions with support for multiple contest formats and multi-tenant architecture.

Haaukins

Haaukins is an automated virtualization platform that provides hands-on cybersecurity education through capture the flag exercises in controlled vulnerable environments.

WackoPicko Vulnerable Website

WackoPicko is an intentionally vulnerable web application used for security testing, penetration testing practice, and vulnerability scanner evaluation.

MotherFucking CTF

A lightweight CTF platform with simple setup and difficulty-based scoring that removes timezone advantages from competitions.

exploit_me

A deliberately vulnerable ARM/ARM64 application with 14 different vulnerability levels designed for CTF-style exploitation training and education.

OWASP Juice Shop CTF Extension

A Node.js CLI tool that automates the setup of CTF events using OWASP Juice Shop challenges across multiple CTF frameworks.

Detection Lab

DetectionLab is a pre-configured Windows domain environment with security tooling and logging designed for cybersecurity training and detection capability development.

Damn Vulnerable eXtensive Training Environment (DVXTE)

DVXTE is a Docker-based training platform containing multiple vulnerable applications designed for cybersecurity education and skill development.

Damn Vulnerable Web Application (DVWA)

A deliberately vulnerable PHP/MySQL web application designed for security training, testing, and educational purposes in controlled environments.

InsecureBankv2

InsecureBankv2 is an intentionally vulnerable Android application with a Python back-end server designed for educational purposes in mobile security testing and Android vulnerability research.

Damn Vulnerable GraphQL Application

A deliberately vulnerable GraphQL application designed for security testing and educational purposes, containing multiple intentional flaws for learning GraphQL attack and defense techniques.

echoCTF

echoCTF is a cybersecurity framework for running Capture the Flag competitions and training exercises on real IT infrastructure.

FBCTF

FBCTF is a platform for hosting Jeopardy and King of the Hill style Capture the Flag competitions with support for various scales and participation models.

HackSys Extreme Vulnerable Driver (HEVD)

A Windows kernel driver intentionally designed with various vulnerabilities to help security researchers practice kernel exploitation techniques.

AzureGoat

AzureGoat is a deliberately vulnerable Azure cloud infrastructure that incorporates OWASP Top 10 vulnerabilities and Azure service misconfigurations for security training and penetration testing practice.

OWASP Damn Vulnerable Web Sockets (DVWS)

A deliberately vulnerable web application that uses WebSocket communication to provide a training environment for learning about WebSocket-related security vulnerabilities.

CTFd

CTFd is a web-based framework for creating and managing Capture The Flag cybersecurity competitions with customizable challenges, scoring systems, and team management capabilities.

HackTheArch

HackTheArch is an open-source Ruby on Rails-based scoring server platform designed for hosting and managing Cyber Capture the Flag competitions with web-based problem management and hint systems.

Labs-Pentest

A comprehensive collection of free online laboratories and platforms for practicing penetration testing, CTF challenges, and cybersecurity skills development.

Root the Box

Root the Box is a real-time CTF scoring engine that provides a configurable platform for cybersecurity training through gamified wargames and competitions.

InsecureShop

InsecureShop is an intentionally vulnerable Android application built in Kotlin for educating developers and security professionals about mobile app vulnerabilities and penetration testing techniques.

OVAA (Oversecured Vulnerable Android App)

OVAA is an intentionally vulnerable Android application that aggregates common platform security vulnerabilities for educational and security testing purposes.

BetterMotherFucking CTF

A lightweight CTF platform inspired by motherfuckingwebsite.com that provides simple hosting capabilities for cybersecurity competitions with equal-point scoring and minimal setup requirements.

Hackazon

Hackazon is a vulnerable web application storefront designed for security professionals to practice testing modern web technologies and identifying common vulnerabilities.

Xtreme Vulnerable Web Application (XVWA)

XVWA is an intentionally vulnerable PHP/MySQL web application designed for security education, containing multiple common web vulnerabilities for hands-on learning and practice.

Windows / Linux Local Privilege Escalation Workshop

An educational workshop providing hands-on training materials, lab environments, and tools for learning local privilege escalation techniques on Windows and Linux systems.

damnvulnerable.me

A deliberately vulnerable web application containing DOM-based XSS, CSRF, and other web vulnerabilities for security testing and educational purposes.

Boss of the SOC (BOTS) Dataset Version 2

A security dataset and CTF platform available in full (16.4GB) and attack-only (3.2GB) versions, pre-indexed for Splunk to help security professionals practice analysis skills.

Boss of the SOC (BOTS) Dataset Version 3

A pre-indexed Splunk security dataset and CTF platform that provides realistic security data for training, research, and educational purposes for cybersecurity professionals and students.

Damn Small Vulnerable Web

A deliberately vulnerable web application written in under 100 lines of Python code for educational purposes and web security testing.

MemLabs

MemLabs provides CTF-styled memory forensics challenges designed to teach students and security researchers how to analyze memory dumps using tools like Volatility.

ROP Wargame Repository

A collection of Return-Oriented Programming (ROP) challenges designed for practicing binary exploitation techniques and developing offensive security skills.

awesome-vulnerable-apps

A list of vulnerable applications for testing and learning

IronCircle Cybersecurity Training Platform

AI-powered browser-based cybersecurity training platform with labs and certs

TryHackMe Cyber Security Training

Hands-on cybersecurity training platform with gamified labs and challenges

PentesterLab PRO

Online platform offering 700+ hands-on web security exercises and training

Cybexer Cyber Ranges for Finance and Banking

Cyber range platform for finance & banking sector security training

Bastazo Agoge

OT cybersecurity training platform with hands-on simulations and digital twins

ACI Learning Skill Labs

Virtual hands-on IT & cybersecurity lab platform for academic programs.