railsgoat
A vulnerable version of Rails that follows the OWASP Top 10
Tech stack & purpose
RailsGoat is a deliberately vulnerable web application built on Ruby on Rails that demonstrates real-world security vulnerabilities from the OWASP Top 10. Created by OWASP and built with Rails 8.0 and Ruby 3.4.1, it serves as a hands-on training platform for developers and security professionals to learn how common security flaws like SQL injection, cross-site scripting, authentication issues, and insecure direct object references manifest in Rails applications. The project includes a training mode with a test suite that guides learners through vulnerabilities, detailed wiki tutorials on exploitation and remediation, and support for multiple Rails versions spanning from Rails 3.2 through Rails 8, with optional MySQL configuration for certain vulnerability demonstrations.
Community & reference links
Languages
Contributors (top 30 of 43)
- Al Snow1,013 commits
- Ken Johnson432 commits
- cktricky197 commits
- Mike McCabe73 commits
- Joseph Mastey43 commits
- mccabe61539 commits
- James Espinosa24 commits
- Ken Toler18 commits
- chrismo16 commits
- Michael McCabe14 commits
- Justin Collins9 commits
- relotnek9 commits
- Nicole Rifkin7 commits
- John Poulin7 commits
- dependabot[bot]5 commits · 0 followers
- GSMcNamara3 commits
- nVisium-ken-johnson2 commits
- Tom Copeland2 commits
- Tada, Tadashi2 commits
- jackMannino2 commits
- Fred Nixon2 commits
- yuji.matsunaga2 commits
- Rory McCune1 commits
- shiva chetan reddy1 commits
- Ben Sebastian1 commits
- Eli Block1 commits · 6 followers
- Gary Moore1 commits
- Adi1 commits
- Bharath1 commits
- Jayson Grace1 commits
