I am looking for sample test cases for all 10 vulnerabilities to exploit those scenarios. I would highly appreciate if any one share or share the link for test cases for a web application with all 10 vulnerabilities or any OWASP vulnerability?

  • 2
    While I do not know whether such a test case exist I doubt that it will be very valuable. SQL Injection samples are available in the web. Having a sample showing one specific type may create the impression that fixing this will make your app save from sql injection, which is not necessarily true. Therefore such test cases would not be complete and imply that making these test cases pass result in a secure application.
    – Samuel
    Commented Aug 20, 2014 at 10:53
  • you're looking for test cases to run against your own site? There are numerous testing suites that run a battery of tests for most of the OWASP top 10.
    – schroeder
    Commented Aug 20, 2014 at 22:50

3 Answers 3


There are loads. Mutillidae, Damn Vulnerable Web App, WebGoat, BWaPP etc. Also, check out vulnhub, hack.me and others like them.

  • I want to test manually..so asking for test cases. Please help me out here
    – Aruna
    Commented Aug 20, 2014 at 12:23
  • 4
    @Aruna maybe you should first look up what WebGoat is, actually put in some effort and then come back with a request for help if you have a SPECIFIC problem. Commented Aug 20, 2014 at 12:35

We have an OWASP project which tracks vulnerable web apps: https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project

The OWASP Top 10 is actually all about risks rather than vulnerabilities. So its not really possible to have simple examples for all of them. For example, how many ways are there to 'misconfigure security' (A5)? As many ways as there are different web apps I'd guess ;)


You can take a look at the Software Assurance Reference Dataset http://samate.nist.gov/SARD/index.php - These are effectively vulnerable code snippets for multiple programming languages and include the OWASP top 10 vulnerabilities.

However, if you want to try live examples you can try a number of opensource or commercial wargame apps:


Owasp WebGoat


Damn Vulnerable Web Application

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .