Running a local Docker environment for every security lab is a barrier — especially if you’re on a work machine, a shared computer, or just want to practice quickly without setup time. The good news: the best browser-based vulnerable web applications now cover the same vulnerability categories as locally-hosted apps, with no installation, no Docker, and no firewall exceptions required.
This guide covers every major online vulnerable web application you can access immediately in a browser — what each covers, who it’s for, and what you can and can’t do with it.
Why Browser-Based Vulnerable Apps?
Local applications like DVWA, OWASP Juice Shop, and WebGoat remain the gold standard for SAST/DAST benchmarking because you can point local scanners at them. But online labs have distinct advantages:
- Zero setup — open a URL and start
- No local resource overhead — no Docker daemon, no RAM impact on your development machine
- No network exposure — nothing running locally that could be accidentally exposed
- Accessible from restricted machines — works on locked-down corporate machines where Docker is blocked
- Guided content — most online labs include explanations, hints, and structured learning paths
The tradeoff: browser-based labs are generally not useful for SAST/DAST scanner benchmarking (you need local source code or a locally reachable URL for that). For learning and practice, they’re often better than local setups.
1. PortSwigger Web Security Academy
URL: portswigger.net/web-security
Cost: Completely free
Best for: Structured learning from beginner to advanced, every major vulnerability class
PortSwigger Web Security Academy is the most comprehensive free browser-based security training platform available. Every topic includes interactive labs that run entirely in the browser — no Burp Suite required for most labs, though it’s recommended for the more complex ones.
Coverage (200+ labs):
- SQL injection — 15+ labs including blind, time-based, UNION-based, and out-of-band
- Cross-site scripting (XSS) — 30+ labs covering reflected, stored, DOM-based, and filter bypass
- CSRF — labs covering standard CSRF, CORS-based CSRF, and SameSite cookie bypasses
- SSRF — internal service access, blind SSRF with out-of-band detection
- XXE (XML External Entities)
- HTTP request smuggling — CL.TE, TE.CL, and desync attacks
- Authentication vulnerabilities — brute force, password reset flaws, MFA bypass
- Business logic vulnerabilities
- Access control and IDOR
- Web cache poisoning
- Clickjacking
- DOM-based vulnerabilities
- WebSockets security
- GraphQL injection
- Prototype pollution (JavaScript)
- Server-side template injection (SSTI)
- Path traversal
How it works: Each lab presents a realistic but deliberately vulnerable web application running on PortSwigger’s infrastructure. You attack the lab directly from your browser (or through Burp Suite, which you configure to proxy your browser traffic). Each lab has a defined objective — for example, “steal the administrator’s session cookie using stored XSS” — and marks you as complete when you achieve it.
Who should use it: Anyone from beginner to advanced. The Academy’s difficulty labeling (Apprentice → Practitioner → Expert) provides a clear progression. Even experienced security engineers find Expert-level labs challenging.
2. HackTheBox Web Challenges
URL: hackthebox.com
Cost: Free tier available; Pro subscription for older machines (~$14/month)
Best for: Advanced practitioners, real-world vulnerability patterns, competitive environment
HackTheBox (HTB) hosts both full-machine challenges (Linux and Windows) and standalone web application challenges. The web challenges are purpose-built vulnerable applications representing real CVE-style vulnerabilities in real frameworks.
Coverage:
- Server-side template injection (SSTI) in Jinja2, Smarty, Twig, Pebble, Freemarker
- Insecure deserialization in PHP, Java, Python, and Node.js
- JWT manipulation and algorithm confusion attacks
- SQL injection in modern ORMs with unusual syntax
- Server-side prototype pollution
- SSRF chained with internal service exploitation
- Race conditions
- OAuth and OIDC implementation flaws
- GraphQL introspection and injection
- NoSQL injection (MongoDB)
- File inclusion and path traversal in modern frameworks
How it works: Each web challenge is a containerized application that HackTheBox spins up for you on their infrastructure. You access it via a browser or VPN connection. The goal is to find the flag (typically a string in a protected location) by exploiting the vulnerability.
Who should use it: Intermediate to advanced practitioners. Many HTB web challenges are significantly harder than PortSwigger Academy labs — they require chaining multiple vulnerability classes or exploiting subtle logic flaws.
3. TryHackMe
URL: tryhackme.com
Cost: Free tier with limited rooms; Premium ~$14/month for full access
Best for: Beginners and intermediate learners, guided step-by-step learning
TryHackMe offers guided “rooms” for web security topics — each room walks you through a specific topic with explanations, interactive questions, and a vulnerable application running on TryHackMe’s infrastructure.
Relevant web security rooms (free):
- OWASP Top 10 (dedicated rooms for each vulnerability class)
- SQL Injection — basic to advanced
- XSS — reflected, stored, DOM-based
- CSRF
- Authentication bypass
- File upload vulnerabilities
- JWT attacks
- Web application enumeration
How it works: Each room provides a VM or web application running on TryHackMe’s servers, accessible via browser or OpenVPN. Questions guide you through the exercise, and you answer questions to confirm you’ve found specific information.
Who should use it: Beginners who want more structure than PortSwigger Academy’s open lab format. TryHackMe’s guided format fills the gap between reading about a vulnerability and exploiting one independently.
4. OWASP WebGoat (Hosted Online Demo)
URL: Check github.com/WebGoat/WebGoat for current hosted instances
Cost: Free
Best for: Java-specific vulnerability patterns, structured lesson-based learning
WebGoat is OWASP’s Java-based security training application. While the primary deployment method is local Docker, OWASP and various training providers sometimes host public WebGoat instances.
Security note: Any publicly hosted vulnerable application is a shared environment. Avoid entering real credentials, personally identifiable information, or sensitive data in shared hosted instances.
Coverage:
- SQL injection (including second-order injection)
- XSS
- Insecure deserialization (Java ObjectInputStream)
- JWT attacks
- Access control violations (IDOR, forced browsing)
- XXE
- SSRF
- Path traversal
- Cryptographic failures
- Missing function-level access control
If a hosted instance isn’t available, WebGoat runs in Docker with a single command:
docker run -it -p 8080:8080 -p 9090:9090 webgoat/webgoat
# Open http://localhost:8080/WebGoat5. PentesterLab
URL: pentesterlab.com
Cost: Free exercises available; Pro ~$20/month for full access
Best for: Structured badges, code review exercises, CVE-based exploits
PentesterLab provides vulnerability exercises based on real CVEs and vulnerability classes. Each exercise is a small self-contained application running on PentesterLab’s infrastructure.
Coverage:
- SQL injection (classic, blind, UNION-based)
- Code injection (PHP eval, Python exec)
- File inclusion
- XML injection and XXE
- Insecure CORS
- Session fixation and cookie manipulation
- JWT attacks (algorithm confusion, RS256 → HS256)
- SSRF
- GraphQL injection
- Prototype pollution
- CVE-based exercises (exploiting real vulnerabilities in real software)
Unique feature: PentesterLab’s code review exercises show you vulnerable source code and ask you to identify the vulnerability by reading the code — developing the skill of finding vulnerabilities in code rather than just exploiting a running application.
6. Root Me
URL: root-me.org
Cost: Free (some challenges require credits)
Best for: Breadth of challenge types, European security community
Root Me is a French platform with a large library of web application security challenges. The challenges are scored and ranked by difficulty, and the platform covers an unusual breadth of vulnerability types including:
- Web server misconfigurations (Apache, Nginx)
- Server-side includes (SSI) injection
- HTTP response splitting
- Local and remote file inclusion
- PHP object injection (deserialization)
- Server-side template injection (various engines)
- XML and XPATH injection
- File upload bypass (MIME type, extension, magic bytes)
- JWT manipulation
- Insecure direct object reference (IDOR)
Who should use it: Practitioners who want breadth across unusual vulnerability classes and older attack techniques that most other platforms don’t cover.
7. Hacker101 CTF
URL: ctf.hacker101.com (by HackerOne)
Cost: Free
Best for: Bug bounty preparation, real-world bug patterns
Hacker101 CTF is operated by HackerOne, the largest bug bounty platform. Solving CTF challenges earns points redeemable for invitations to private HackerOne bug bounty programs — making it directly connected to real-world security research.
Coverage:
- Web application vulnerabilities matching real bug bounty patterns
- Flag injection, SQLi, authentication bypass
- File inclusion and SSRF
- Business logic flaws
- JavaScript vulnerabilities
Choosing the Right Online Vulnerable Web Application
| Your Goal | Best Option |
|---|---|
| Complete beginner, structured learning | TryHackMe (OWASP Top 10 rooms) |
| Deep learning of every vulnerability class | PortSwigger Web Security Academy |
| Advanced real-world challenge | HackTheBox Web Challenges |
| Java-specific vulnerabilities | OWASP WebGoat |
| Code review skills | PentesterLab |
| Unusual vulnerability breadth | Root Me |
| Bug bounty preparation | Hacker101 CTF |
What Online Labs Can’t Do: SAST and DAST Benchmarking
One important limitation of all browser-based online labs: they cannot be used to benchmark local SAST or DAST scanners. For that, you need:
- SAST benchmarking — a locally cloned copy of the source code (DVWA, WebGoat, NodeGoat from GitHub)
- DAST benchmarking — a locally running application at a URL your DAST scanner can reach (Docker-based DVWA, Juice Shop, DVWA at localhost)
If your goal is to evaluate whether a SAST or DAST scanner correctly detects SQL injection, XSS, or command injection before running it against your production codebase, you need a locally deployed application.
For that purpose, the Docker-based setups in our vulnerable web applications guide cover DVWA, Juice Shop, WebGoat, bWAPP, and NodeGoat with single-command Docker setups.
Running a Real Security Scanner
If you’ve been practicing on vulnerable web applications and want to apply that knowledge to a real codebase or application:
- One-time SAST scan for $500 — submit your source code and get a full vulnerability report within 48 hours, no subscription required
- DAST scan of your web application — authenticated dynamic scanning of your running application, no local setup required
- Book a demo — see a live Offensive360 scan against a deliberately vulnerable application
Understanding vulnerabilities through practice labs is the foundation. Systematic scanning of your real application finds the same vulnerability classes in production code, where the impact is real.
Frequently Asked Questions
Are browser-based vulnerable applications safe to use?
Yes — when hosted on the platform’s own infrastructure (PortSwigger, HackTheBox, TryHackMe), the vulnerable applications run in isolated containers that can only be accessed through the platform’s interface. You’re attacking the platform’s servers (which they explicitly permit), not any production system.
Can I use PortSwigger Web Security Academy without Burp Suite?
Most labs can be solved using your browser’s built-in developer tools. Some advanced labs (particularly HTTP request smuggling) require Burp Suite to craft specific HTTP requests that browsers don’t send by default. Burp Suite Community Edition is free.
Which platform is best for the OSCP certification?
PortSwigger Web Security Academy and HackTheBox are the most recommended platforms for OSCP web security modules. OSCP includes web exploitation (file inclusion, SQL injection, XSS) but its primary focus is network exploitation and privilege escalation. For comprehensive OSCP preparation, TryHackMe’s “Jr Penetration Tester” path and HackTheBox full machines complement web-only practice.
Are these platforms suitable for professional security certifications like GWAPT or eWPT?
Yes. PortSwigger Web Security Academy’s coverage aligns closely with the GIAC Web Application Penetration Tester (GWAPT) and eLearnSecurity Web Application Penetration Tester (eWPT) exam topics. Working through all of PortSwigger’s topics — especially the Practitioner and Expert level labs — provides strong preparation for these certifications.
Can teams use these for security awareness training?
Yes. PortSwigger Academy and TryHackMe both work well for developer security awareness training — guiding developers through understanding how vulnerabilities work from an attacker’s perspective. This builds more durable security intuition than compliance-checkbox training.