Choose the practice app that matches your team's language, covers the bug classes you plan to teach, and starts in one command. Everything else is secondary. A Java shop gets more from a Java-based app than from a polished app in a stack nobody uses.
Criteria that matter
Stack match. Developers learn fixes by reading code. If the vulnerable code is in a language they write, the fix transfers directly to their work.
Coverage. List the bug classes for your session first, then check the app has them. OWASP describes Juice Shop as built on Node.js, Express and Angular and covering vulnerabilities from the OWASP Top Ten. It tracks challenges on a scoreboard, which suits competitive sessions. OWASP describes WebGoat as a deliberately insecure application that lets developers test vulnerabilities commonly found in Java-based apps that use popular open source components, and as an interactive teaching environment.
Learning mode. Some apps guide you lesson by lesson. Others drop you into a shop and let you find things. Guided suits beginners. Open-ended suits CTF days and experienced engineers.
Setup cost. Time to first working instance is the number that decides whether your 90 minutes survive. Test installation on a clean laptop, on your corporate VPN and on the oldest machine in the room.
Maintenance. Check that the project is still updated and its documentation matches the current version. An app that has not changed in years may teach outdated patterns.
Fix path. Can attendees edit the source and rerun? Exploit-only apps teach attackers' tricks. Apps with editable code teach engineering.
Two common session shapes
For a guided course, pick an app with step-by-step lessons and let people work at their own pace with a facilitator circulating.
For a competition, pick an app with a scoreboard and hints, and hide the challenge list so people explore.
Build your own when
Build a small custom app when your stack is unusual, or when you want bugs that mirror your real architecture, such as a broken authorization check on your own API style. Ten files and three deliberate flaws is plenty. Keep it in a repository so that you can update it, and review it as carefully as production code, because a deliberately vulnerable app is still software that can be misused.
Test before you commit
Run the app once yourself, find two of the bugs, and write the fix. If you cannot do that in under an hour, your attendees will not manage it in thirty minutes.
For setup safety, see our guide to running vulnerable training apps safely.
Quick check
Do I need a different app for each language?
Not always, but a fix exercise is stronger in a language people use daily. For mixed teams, run one app and discuss how the fix looks in each language.
Sources
Last reviewed: 19 October 2026.
