I'm looking for some really small apps on Ubuntu for some bufferoverflow exploitation training.

I don't want to start off with some huge apps.

I know some sites like http://www.oldversion.com.de/ where i could start but most of the apps are just to big or too hard to exploit for a beginner or just not available for linux. Most of the tutorial on the Internet or windows based.

Do you know any app where i could start playing around? Which debugger do usually people use on ubuntu?

As a .NET dev i already have the theoretical knowledge for exploits, but I need to do it myself to understand it better.

3 Answers 3


There are plenty of apps i think, you can get old (vurnable) applications from www.oldapps.com. Then once there was Damn Vurnable Linux. Or Badstore: www.badstore.net then we have exploit training: exploit-exercises.com or Pentester lab: www.pentesterlab.com. Then there is Damn Vurnable webapp: www.dvwa.co.uk and what i like the most (windows) is vurnable server: www.thegreycorner.com/p/vulnserver.html‎. Vurnable server you could run on linux when using wine (did not test this by myself). The debugger of choice on Linux Gnu Debugger (gdb www.sourceware.org/gdb/‎). Also in the view of the fact that exploits get more and more sophisticated i have to mention exploit development is allways hard.

Kind regards,


  • Thank you very much. Just one more question, and i will accept your answer: Is there a good debugger with a gui like Ollydbg or ummunitydbg for linux & x64 system?
    – Teko
    Apr 27, 2014 at 21:55
  • Hey there no problem, there are some for gdb (afaik is gdb the only really good debugger in linux) it has some front ends like ddd: www.gnu.org/software/ddd/ , you can also use gdb within emacs or eclipse (extra config steps might needed) then there is a terminal interface for gdb cgdb.github.io . Unfortunaly there are no such pretty debuggers like in windows (i prefer immunitydbg). But this helps at start: stanford.edu/class/cs107/other/gdbrefcard.pdf
    – Dirk
    Apr 28, 2014 at 5:31

Try going through the extensive list on OWASP Vulnerable Web Applications Directory Project.

Some of them I know and have played with:

  • Google Gruyere
  • Damn Vunerable App

But some of ASP.NET specific ones include SPI Dynamics (live), Watchfire (live), Acunetix 2 and 3 (live), HackmeBank, and OWASP SiteGenerator. Hope this helps!


Gera’s Insecure Programming is a classic

It’s somewhat unique in that it includes a few that are either not exploitable, or are only exploitable on certain CPU architectures, which forces you to have a deep understanding of how things work, rather than providing something to copy/paste alephone style payloads in and call it a day

It’s also unique in that it includes more exotic bug classes, like those involving signals

Not the answer you're looking for? Browse other questions tagged .