WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. This program is a demonstration of common server-side application flaws. The exercises are intended to be used by people to learn about application security and penetration testing techniques.
from the project README
Formats
app
License
license: see source
Added
2026-09-10
Get it
From the project’s own instructions where it documents any; otherwise a plain clone.
shell
$ docker run -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 webgoat/webgoat
Then browse to http://127.0.0.1:8080/WebGoat. Bound to localhost on purpose; never expose it.
Contents
1,241 files105.8 MB repository
.java411
.adoc274
.properties138
.png97
.js93
.html70
.css31
.jpg28
Use it with
Commands are curated, not yet run by us.
nuclei — Scan the target once it is running locally (adjust the port to the one you exposed).
sample.app
$ nuclei -u http://127.0.0.1:3000
OWASP ZAP — Run ZAP's passive baseline scan against the locally running target.
sample.app
$ docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t http://host.docker.internal:3000