Pentest-Ground

Pentest Ground is a free security testing playground provided by Pentest-Tools.com. Designed for penetration testers, ethical hackers, and other offensive security professionals, it offers deliberately vulnerable web applications and network services for evaluating vulnerability scanners and practicing security skills. The systems can be accessed without authentication, enabling users to simulate testing services exposed to the internet.

The available targets cover several technologies and common security weaknesses. They include a classic web application and a GraphQL application with issues such as cross-site scripting (XSS), cross-site request forgery (CSRF), SQL injection, and command injection; a REST API with SQL injection, code injection, and XML external entity (XXE) vulnerabilities; and examples involving WebLogic and Redis remote code execution flaws. GuardianLeaks provides a further web application target featuring XSS, server-side request forgery, and code injection.

Users may scan the listed applications and services, but other people may be testing them at the same time. To restore a clean environment, each application is destroyed and redeployed every 30 minutes.