BLE CTF — deliberately-broken Bluetooth Low Energy GATT server (ESP32 + Arduino) used as a hands-on capture-the-flag for BLE attack and defence. Exercises BLE-specific patterns: Just Works pairing, hardcoded passkeys, GATT characteristics without encryption/authentication, and discovery / enumeration flows.

BLE Just Works pairing, hardcoded passkey, GATT without encryption/authentication, characteristic enumeration, weak BLE access control

Damn Vulnerable Router Firmware — a deliberately-vulnerable consumer-grade router firmware image curated by Praetorian. Ships with Wi-Fi auth flaws, command-injection in web admin, hardcoded backdoor accounts and binary exploitation challenges; hits Wi-Fi config audits, hardcoded credentials and SAST patterns.

Wi-Fi misconfig, command injection, hardcoded backdoor accounts, weak SSH, MIPS binary exploitation

Damn Vulnerable Web Application — a classic PHP/MySQL target used for AppSec training across configurable difficulty levels.

SQLi, Blind SQLi, XSS, CSRF, File Inclusion, File Upload, Command Injection, Brute Force

OWASP IoTGoat — deliberately-insecure embedded firmware based on OpenWrt that demonstrates the OWASP IoT Top 10 (weak credentials, hardcoded keys, insecure network services, lack of secure update, weak crypto). Ideal for exercising the Wireless Security + Secrets engines against firmware-style code.

Hardcoded creds, weak Wi-Fi defaults, plaintext network services, insecure firmware update, weak crypto, OWASP IoT Top 10

OWASP Juice Shop is a modern Node.js / Angular vulnerable web application covering the OWASP Top 10 plus many other realistic security flaws.

SQLi, NoSQLi, XSS, CSRF, SSRF, XXE, Broken Access Control, Insecure Deserialization, Security Misconfiguration

OWASP NodeGoat is a small Node.js / Express application with intentional vulnerabilities focused on the OWASP Top 10 specific to Node.

Injection, Weak Auth, Insecure Direct Object Refs, XSS, CSRF, Regex DoS

OWASP Pygoat is a deliberately-vulnerable Django application that illustrates the OWASP Top 10 specifically for the Python/Django stack.

SQLi, SSRF, XXE, Broken Auth, Sensitive Data Exposure, Deserialization, Components with Known Vulns

OWASP Railsgoat is a Ruby-on-Rails application with intentional vulnerabilities aligned with the OWASP Top 10 and Rails-specific flaws.

SQLi, XSS, Mass Assignment, Session Management, Weak Crypto, IDOR, Logging flaws

OWASP WebGoat is a deliberately insecure Java web application maintained by OWASP to teach and demonstrate application security vulnerabilities in hands-on lessons.

SQLi, XSS, XXE, CSRF, SSRF, Path Traversal, Insecure Deserialization, Broken Auth, JWT flaws, Access Control