I need to test vulnerability scanners such as Nessus, Nmap, and so on. My teacher told me, that there are some prepared websites (these scanners need the IP address of target to scan) with known vulnerabilities, that can be directly scanned with these scanners, without installing locally on my machine. But I can not find any suitable solution. Do you have some tips? The best would be any IP address with vulnerabilities that I can directly scan. Thank you very much, people.

2 Answers 2


Hmm. I too would be interested to know what your teacher is referring to. Ultimately, hosting a known-vulnerable site would put the host at serious risk of compromise. Please don't go scanning random sites without authorisation from the owners either.

I highly recommend using the Damn Vulnerable Web Application (DVWA) for this purpose. The easiest way to do this is to download the iso from the page linked above and run it as a Virtual Machine using Virtualbox or VMware Player. That will mean installing software though.

If your teacher can provide you with a few sites, I would be interested to hear about it!

Lastly, to quote the creator:

WARNING! Damn Vulnerable Web Application is damn vulnerable! Do not upload it to your hosting provider's public html folder or any Internet facing servers, as they will be compromised. It is recommended using a virtual machine (such as VirtualBox or VMware), which is set to NAT networking mode.


There are quite a few sites available for this. Some are online, e.g. Google's Gruyere.

As Sam mentioned above, some are designed to be run within a virtual machine like virtualbox or vmware, or even in a container like Docker. bWapp & OWASP's own Juice Shop and Webgoat spring to mind.

If it's a downloadable web app best to ensure that you're VM network is isolated from the host so that you don't unintentionally cause issues for yourself.

In any case here are some lists of legally compromisable sites and apps for learning pursposes.

15 Vulnerable Sites To (Legally) Practice Your Hacking Skills and 40+ Intentionally Vulnerable Websites To (Legally) Practice Your Hacking Skills

Some of these tools are old, but that shouldn't be a concern as many of the most leveraged vulnerabilities have been around for donkey's years.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .