8.8k
Security Development Learning & Career Web

WebGoat

WebGoat is a deliberately insecure web application maintained by OWASP, designed to teach web application security lessons and practices through hands-on experimentation.

WebGoat is built in JavaScript, 8.8k GitHub stars, latest release v2025.3.

When to use WebGoat

WebGoat is listed here as a Security project. The directory calls out Deliberately vulnerable web application for learning security, Hands-on tutorials with real vulnerabilities, Covers common web security risks and mitigations as capabilities associated with it.

Other recorded traits for WebGoat include Role-based user scenarios, Widely used in security training and workshops.

Besides Security, this page also files WebGoat under Development, Learning & Career, Web.

WebGoat compared with

Records in this directory name DVWA, Juice Shop, Mutillidae, bWAPP as products people compare with WebGoat. That list is editorial metadata, not a claim that WebGoat replaces each of them.

What the WebGoat stats reflect

GitHub currently shows 8.8k GitHub stars, 7.0k forks, 49 open issues, latest tracked release v2025.3. Star and activity counts here are a snapshot used as a proxy for community adoption, not a quality score.

Stats refreshed

Language
JavaScript
Latest Release
v2025.3
License
Other

Our Newsletter

Get new Security tools right in your inbox

Get short emails with useful security projects, releases, and repos worth watching.

Key features of WebGoat

  • Deliberately vulnerable web application for learning security
  • Hands-on tutorials with real vulnerabilities
  • Covers common web security risks and mitigations
  • Role-based user scenarios
  • Widely used in security training and workshops

Recorded alternatives to WebGoat

DVWA Juice Shop Mutillidae bWAPP

WebGoat on GitHub

Stars
8.8k
Open Issues
49
Forks
7.0k

Frequently asked questions

What is WebGoat?

WebGoat is a deliberately insecure web application maintained by OWASP, designed to teach web application security lessons and practices through hands-on experimentation. This directory highlights Deliberately vulnerable web application for learning security, Hands-on tutorials with real vulnerabilities, Covers common web security risks and mitigations.

What language is WebGoat written in, and what is the latest release?

WebGoat is written primarily in JavaScript. The latest release tracked on this page is v2025.3.

How widely is WebGoat used on GitHub?

WebGoat has about 8.8k GitHub stars. It also has about 7.0k forks. Those counts are a snapshot of community attention, not a ranking of quality.

What do people compare WebGoat with?

This directory records DVWA, Juice Shop, Mutillidae, bWAPP as comparison points for WebGoat.

More Security tools