Owner

WebGoat

1 indexed repository · View on GitHub

WebGoat
WebGoat is a deliberately insecure application

JavaScript · 9343 stars

Beginner friendly Everything

Open All

Both WebGoat Docker and the Jar forgets my user registration. Open

Difficulty 3/5 1-2 days Newbie friendliness 50/100

WebGoat/WebGoat#2535 · 2 comments · Opened Sep 13, 2026
fix(it): WebGoat Injection mitigation lesson 8 __ responds with 404 Open

Difficulty 3/5 1-2 days Newbie friendliness 48/100

WebGoat/WebGoat#2502 · 1 comment · Opened Aug 6, 2026
fix(it): static mutable user objects shared across test instances causing race condition Open

WebGoat/WebGoat#2473 · 1 assignee · Opened Jun 27, 2026
Proposal: Add GitHub actions script to hinder AI issues and PRS Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

WebGoat/WebGoat#2377 · 2 comments · 1 reaction · Opened Mar 28, 2026
[Proposal] Add Simplified Chinese (cnlang) localization Open

WebGoat-UI

WebGoat/WebGoat#2263 · 1 comment · 1 assignee · Opened Nov 29, 2025
Move progress through versions? Open

help wanted

Difficulty 5/5 Over a week Newbie friendliness 20/100

WebGoat/WebGoat#2021 · 5 comments · Opened Feb 8, 2025
Add the Korean language Open

WebGoat/WebGoat#1908 · 2 comments · 1 assignee · Opened Sep 23, 2024
Do we need to support TLS in WebGoat? Open

Difficulty 4/5 3-5 days Newbie friendliness 30/100

WebGoat/WebGoat#1861 · Opened Jul 28, 2024
Logfile should also be written to home directory Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

WebGoat/WebGoat#1859 · 3 comments · Opened Jul 28, 2024
List all vulnerable code for SAST tooling Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

WebGoat/WebGoat#1847 · 2 comments · 1 reaction · Opened Jul 14, 2024
Error page should contain more details Open

help wanted

Difficulty 3/5 1-2 days Newbie friendliness 48/100

WebGoat/WebGoat#1740 · 5 comments · Opened Feb 5, 2024
Command injection lesson Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

WebGoat/WebGoat#1555 · 5 comments · Opened Aug 7, 2023
Create more structure within the lessons/menu by introducing personas Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 30/100

WebGoat/WebGoat#1550 · Opened Aug 5, 2023
WebWolf: introduce state Open

enhancement help wanted WebWolf

Difficulty 5/5 Over a week Newbie friendliness 25/100

WebGoat/WebGoat#1546 · Opened Aug 4, 2023
WebWolf: add a page to create a response Open

enhancement help wanted WebWolf

Difficulty 4/5 3-5 days Newbie friendliness 38/100

WebGoat/WebGoat#1545 · Opened Aug 4, 2023
Add JWT vulnerability with `kid` Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

WebGoat/WebGoat#1538 · Opened Jul 30, 2023
Create new lesson for open-redirects Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

WebGoat/WebGoat#1537 · Opened Jul 30, 2023
Add blind sql injection lesson Open

help wanted

Difficulty 5/5 Over a week Newbie friendliness 25/100

WebGoat/WebGoat#1536 · 1 comment · Opened Jul 30, 2023
Can't access localhost WebGoat via ZAP proxy Open

Difficulty 3/5 1-2 days Newbie friendliness 25/100

WebGoat/WebGoat#1464 · 4 comments · Opened Mar 31, 2023
Add more explanations of all the lessons each assignment should have a write up Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

WebGoat/WebGoat#1409 · 3 comments · Opened Feb 14, 2023
Extend XXE lesson with example where a mitigation of static analysis does not work Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

WebGoat/WebGoat#1408 · 2 comments · Opened Feb 14, 2023
Update proxy lesson Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

WebGoat/WebGoat#1405 · Opened Feb 13, 2023
Change login screen and make forgot password a challenge Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

WebGoat/WebGoat#1300 · 3 comments · Opened Jul 19, 2022
Introduce security solution as part of WebGoat assignments Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

WebGoat/WebGoat#1194 · 3 comments · Opened Dec 19, 2021
Session Fixation Lesson Open

WebGoat/WebGoat#1165 · 1 assignee · Opened Nov 19, 2021
Add Session Management Flaws integration tests Open

WebGoat/WebGoat#1112 · 1 assignee · Opened Oct 4, 2021
Hints should also replace references to the host Open

Difficulty 3/5 1-2 days Newbie friendliness 25/100

WebGoat/WebGoat#1046 · Opened Sep 5, 2021
Update the code around the quiz Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

WebGoat/WebGoat#951 · Opened Mar 15, 2021
Framework contains specific lesson references Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

WebGoat/WebGoat#889 · Opened Nov 4, 2020
XSS - Identify potential for DOM-based XSS - unclear answer key Open

Difficulty 3/5 1-2 days Newbie friendliness 35/100

WebGoat/WebGoat#842 · 1 comment · 1 reaction · Opened Jun 19, 2020
Output of exceptions should appear after n times Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

WebGoat/WebGoat#469 · Opened May 20, 2018
Using the hints should be incorporated in the report card Open

1 - Ready

Difficulty 4/5 3-5 days Newbie friendliness 25/100

WebGoat/WebGoat#301 · 1 comment · Opened Jan 1, 2017

WebGoat

Get new issues in your inbox