Download vulnerable Python applications to practice web security skills. Each lab accompanies a lesson from The Hacker's Arsenal series.
A simple search page with XSS vulnerability. Perfect for your first hack - see your code execute in the browser.
Five XSS challenges with increasing difficulty - no filter, basic filter, advanced filter, stored XSS, and DOM-based XSS.
Practice SQL injection against a SQLite database. Login bypass, UNION attacks, table discovery, and secret extraction.
Practice brute force attacks, rate limit bypass via X-Forwarded-For, weak CAPTCHA bypass, and username enumeration.
Practice session prediction (weak token generation), session fixation, and view active sessions for demonstration.
Mock banking application with CSRF vulnerabilities. No protection, weak tokens, referer bypass, and GET-based attacks.
All labs are standalone Python scripts that run a local web server. You need:
Run any lab with:
python3 lab_name.py
Then open http://localhost:8888 in your browser.
Running two labs at once? Pass a
different port: python3 lab_name.py 8802 — then open
http://localhost:8802. Every lesson assumes the default 8888, so
only override it when you need a second lab up at the same time.
Note: These labs are intentionally vulnerable. Only run them on your local machine and never expose them to the internet.