# BWAPP

BWAPP is a free, open-source deliberately insecure web application containing over 100 injectable vulnerabilities covering all OWASP Top 10 risks. It is open source and self-hosted, installable on Docker Hub and Unraid.

Canonical page: https://ourlocalhost.com/app/1087/bwapp

## Description

bWAPP (buggy Web Application) is a free, open-source deliberately insecure web application containing over 100 injectable vulnerabilities covering all OWASP Top 10 risks. It helps security professionals, developers, and students discover, exploit, and remediate web vulnerabilities as part of penetration testing and ethical hacking practice.

## Platform availability

Available on 1 of 9 platforms: Unraid.

## Health score

19/100 (Low), based on 4 of 4 factors.
- Maintained: 0 (last commit 1773 days ago)
- Popular: 18 (7 GitHub stars)
- Easy to install: 35 (1 install platform, install notes, Docker image)
- Light to run: 50 (2 GB minimum RAM)

## Links

- Docker Hub: https://hub.docker.com/r/raesene/bwapp/
- Unraid: https://ca.unraid.net/apps/bwapp-1mnbb6q0llh08e?q=bwapp
- GitHub: https://github.com/ajpalok/bWAPP

## Common questions

### Is it safer to get and run bWAPP in an isolated environment?

Community advice says to get it from a reputable source or run it in an isolated VM.

### What post-installation concerns does the Linux bWAPP guide address?

It covers service management, verification steps, and solutions to common installation problems.

### Which database task is mentioned in bWAPP setup discussions?

Initializing the database is mentioned as part of setup.

### What exploitation notes are available in a public bWAPP walkthrough?

The walkthrough documents exploit code, payloads, and notes covering SQL injection, XSS, CSRF, RCE, and more.

---
Source: Our Local Host (https://ourlocalhost.com/app/1087/bwapp), the self-hosted and open-source app directory.