Xtreme Vulnerable Web Application (XVWA)
0
Free
XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security. It’s not advisable to host this application online as it is designed to be “Xtremely Vulnerable”. We recommend hosting this application in a local/controlled environment and sharpening your application security ninja skills with any tools of your own choice. It’s totally legal to break or hack into this. The idea is to evangelize web application security to the community in possibly the easiest and fundamental way. Learn and acquire these skills for a good purpose. How you use these skills and knowledge base is not our responsibility. XVWA is designed to understand the following security issues: SQL Injection, Error-Based SQL Injection, Blind OS Command Injection, XPATH Injection, Formula Injection, PHP Object Injection, Unrestricted File Upload, Reflected Cross-Site Scripting, Stored Cross-Site Scripting, DOM-Based Cross-Site Scripting, Server-Side Request Forgery (Cross-Site Port Attacks), File Inclusion, Session Issues, Insecure Direct Object Reference, Missing Functional Level Access Control, Cross-Site Request Forgery (CSRF), Cryptography.
FEATURES
The author has not provided features for this tool yet. If you are the author, please sign in or claim the tool to add features by clicking the icon above.
ALTERNATIVES
A Windows Kernel driver intentionally vulnerable to help improve skills in kernel-level exploitation.
Akamai Client-Side Protection & Compliance is a security tool that monitors and protects against client-side threats on websites, aiding in PCI DSS v4.0 compliance.
Commercial
A tool for brute-forcing GET and POST parameters to discover potential vulnerabilities in web applications.
A tool for identifying potential security vulnerabilities in web applications
App-Ray offers comprehensive security analysis and compliance solutions for mobile applications.
A web application security testing platform that helps you test your knowledge on web application security through realistic scenarios with known vulnerabilities.
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Commercial
A webshell manager via terminal for controlling web servers running PHP or MySQL.
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Commercial
Resources
Fabric Platform by BlackStork
Fabric Platform is a cybersecurity reporting solution that automates and standardizes report generation, offering a private-cloud platform, open-source tools, and community-supported templates.
Free
Security Operations
Mandos Brief Newsletter
Stay ahead in cybersecurity. Get the week's top cybersecurity news and insights in 8 minutes or less.
Free
Blogs and News
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Commercial
Cloud Security
RoboShadow
A cybersecurity platform that offers vulnerability scanning, Windows Defender and 3rd party AV management, and MFA compliance reporting, among other features.
Commercial
Vulnerability Management
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.
Commercial
AI Security