OWASP WebGoat is a deliberately insecure Java application for legal, controlled security education. The easiest setup is the official Docker image because it includes WebGoat and WebWolf without requiring a local Java build environment. Keep both ports on loopback, create a disposable account, and never expose the lab to the public internet.
Install OWASP WebGoat with Docker in a Few Minutes
The official project publishes a combined image that serves WebGoat on port 8080 and WebWolf on port 9090. The host-side addresses below are explicitly bound to 127.0.0.1, so another computer cannot reach the lab through the machine's normal network address.
Use a pinned, localhost-only start command
The tagged image makes a workshop more repeatable than an unpinned latest image. Set TZ to the host's IANA timezone because selected JWT and time-sensitive lessons depend on matching time settings.
docker version docker pull webgoat/webgoat:v2025.3 docker run --name webgoat -d -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Etc/UTC webgoat/webgoat:v2025.3 docker logs -f webgoat
Replace Etc/UTC with a suitable IANA timezone such as Asia/Jerusalem, Europe/Berlin, or America/Toronto. When the log shows that the application has started, press Ctrl+C to stop following the log; the container continues running.
1. Open WebGoat
2. Register locally
Create a unique disposable username and password. There is no universal default account.
3. Use WebWolf when asked
4. Stop after the lesson
Run docker stop webgoat, or remove it with docker rm -f webgoat.
What Is OWASP WebGoat?
WebGoat is a deliberately insecure application maintained by OWASP to teach common server-side application weaknesses. It is implemented with Java and Spring Boot and organizes training into guided lessons that normally explain a concept, present an assignment, offer hints, and conclude with mitigation guidance.
The project is useful for developers studying secure coding, students learning application security, instructors building repeatable classes, testers practicing browser-proxy workflows, and defenders learning what vulnerable application behavior looks like. It is not a public target and should not be treated as a complete benchmark for every modern application or API security requirement.
Guided lessons
Lessons connect vulnerable behavior to root cause and mitigation rather than presenting only an unstructured challenge.
Java application
The maintained project is a Java and Spring Boot application. WebGoat.NET is a separate legacy project.
WebWolf companion
Selected lessons use WebWolf as an attacker-controlled mailbox, file host, or request receiver inside the lab.
Disposable environment
Use synthetic data, a local account, a known image tag, and a clear shutdown or reset process.
Safety Boundaries Before Running WebGoat
The project's own documentation warns that the application makes the host intentionally vulnerable while it is running. The default loopback configuration reduces exposure, but containerization does not turn a deliberately insecure service into a production-safe application.
| Boundary | Why it matters | Recommended practice |
|---|---|---|
| Network exposure | WebGoat intentionally contains exploitable behavior | Keep both published ports on 127.0.0.1 |
| Authorization | Training does not permit testing unrelated systems | Use only your own or explicitly authorized lab |
| Credentials | Lesson data may be stored or displayed | Register a disposable account and password |
| Data | Inputs may appear in responses, logs, or lesson state | Use synthetic values only |
| Lifecycle | An existing container can retain local lesson progress | Stop it after use and remove it for a clean reset |
| Internet access | A vulnerable lab should not be exposed to untrusted traffic | Prefer an isolated workstation or disposable VM |
127.0.0.1 with 0.0.0.0 merely to make the lab easier to reach. A supervised class that needs shared access should use an isolated private network, temporary infrastructure, explicit firewall controls, and a shutdown plan.Official WebGoat Sources and Current Version
WebGoat has existed for many years, so search results often mix the maintained project with old images, legacy releases, WebGoat.NET, and third-party walkthroughs. Begin with the official sources below.
v2025.3 images for amd64 and arm64. Verify the official pages again before reusing saved commands.Install WebGoat on Ubuntu, RHEL and Windows
The WebGoat runtime command is almost identical across platforms. The main difference is how Docker is installed and whether the Docker command needs administrative privileges.
Ubuntu installation
Use Docker's official APT repository. Docker currently documents Ubuntu 22.04, 24.04, 25.10, and 26.04 among its supported 64-bit releases. Review conflicting packages and firewall implications before installing Docker on an existing managed system.
sudo apt update
sudo apt install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
sudo tee /etc/apt/sources.list.d/docker.sources > /dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo systemctl enable --now docker
sudo docker run --rm hello-world
sudo docker run --name webgoat -d -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Etc/UTC webgoat/webgoat:v2025.3
sudo docker logs -f webgoatOfficial reference: Docker Engine on Ubuntu. Using sudo docker avoids silently granting the current account powerful Docker-daemon access.
Red Hat Enterprise Linux installation
Docker currently documents maintained RHEL 8, 9, and 10 releases. Remove or review conflicting container packages before installing Docker Engine from Docker's RPM repository.
sudo dnf -y install dnf-plugins-core sudo dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin sudo systemctl enable --now docker sudo docker run --rm hello-world sudo docker run --name webgoat -d -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Etc/UTC webgoat/webgoat:v2025.3 sudo docker logs -f webgoat
Official reference: Docker Engine on RHEL.
Windows installation with Docker Desktop
Install Docker Desktop, normally using its WSL 2 backend, start it in Linux-container mode, and verify that the Docker client can reach the engine. Docker Desktop licensing requirements may apply to larger commercial organizations.
wsl --version wsl --update docker version docker pull webgoat/webgoat:v2025.3 docker run --name webgoat -d ` -p 127.0.0.1:8080:8080 ` -p 127.0.0.1:9090:9090 ` -e TZ=Etc/UTC ` webgoat/webgoat:v2025.3 docker logs -f webgoat
Official reference: Docker Desktop on Windows.
WebGoat Registration, Login and WebWolf
Current WebGoat normally opens a login and registration experience. A new learner should create a local account rather than searching for a universal default username and password.
WebGoat home
http://127.0.0.1:8080/WebGoat/
Registration
Create disposable credentials that are not used anywhere else.
WebWolf
http://127.0.0.1:9090/WebWolf/
Context path
Keep the capitalized /WebGoat/ and /WebWolf/ paths.
WebWolf supports selected assignments that need a second lab-controlled service. It may receive requests, hold a temporary file, or simulate an external mailbox or attacker-controlled endpoint. Use the account and workflow presented by your installed lesson rather than copying credentials or exact answers from a different release.
Choose Docker, the Desktop Image, a Standalone JAR or Source
| Option | Best for | Requirements | Buyer or learner note |
|---|---|---|---|
| Official Docker image | Most learners and repeatable classes | Docker | Recommended default |
| WebGoat desktop image | Self-contained browser workstation | Docker and more resources | Useful for workshops |
| Versioned release JAR | Standalone Java demonstrations | Compatible Java runtime | Check the release asset and requirements |
| Current source | Contributors and source-level debugging | Git, Java 25, Maven wrapper | Main may differ from v2025.3 |
| WebGoat.NET | Legacy .NET-specific study | Legacy project stack | Separate project |
Browser-based desktop image
The official README provides a separate image that runs a complete Linux desktop in the browser. It can be useful when a workshop wants the training tools and WebGoat environment bundled together.
docker run --name webgoat-desktop -d -p 127.0.0.1:3000:3000 webgoat/webgoat-desktop docker logs -f webgoat-desktop
Standalone release JAR
Download a versioned asset only from the official Releases page. Do not assume that an old tutorial's JAR filename or Java requirement applies to the latest release. Confirm the downloaded filename and the release notes, then run it locally.
java -version # Replace the placeholder with the downloaded official asset java -Dfile.encoding=UTF-8 -jar <webgoat-release.jar> # Optional alternate ports java -Dfile.encoding=UTF-8 -jar <webgoat-release.jar> --webgoat.port=8001 --webwolf.port=8002
Build current source
The current main-branch README lists Java 25 as a source-build prerequisite. Use the Maven wrapper included in the repository and record the commit because the main branch can move ahead of the latest release.
git clone https://github.com/WebGoat/WebGoat.git cd WebGoat git rev-parse HEAD java -version ./mvnw clean install ./mvnw spring-boot:run
Use an Intercepting Proxy Without Publishing the Lab
The official project recommends custom local hostnames when using ZAP, Burp Suite, or another browser proxy. This lets the proxy distinguish WebGoat and WebWolf while both names still resolve to the loopback address.
- Add
127.0.0.1 www.webgoat.local www.webwolf.localto the local hosts file. - On Linux, edit
/etc/hosts. On Windows, editC:\Windows\System32\drivers\etc\hostswith administrative permission. - Start the container with the two host environment variables.
- Configure the browser to use the local proxy and visit the custom local names.
docker rm -f webgoat 2>/dev/null || true docker run --name webgoat -d -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e WEBGOAT_HOST=www.webgoat.local -e WEBWOLF_HOST=www.webwolf.local -e TZ=Etc/UTC webgoat/webgoat:v2025.3
Open http://www.webgoat.local:8080/WebGoat/ and http://www.webwolf.local:9090/WebWolf/. Do not map the service to a general network interface simply because a proxy is involved.
Make WebGoat Workshops Repeatable
Lesson wording, assignments, images, and dependencies can change between releases. A reliable class records the image tag, digest, host timezone, Docker version, date verified, and any known lesson issues.
docker pull webgoat/webgoat:v2025.3
docker image inspect webgoat/webgoat:v2025.3 --format '{json .RepoDigests}'
docker version
docker inspect webgoat --format '{.Config.Image}'
docker logs webgoat 2>&1 | head -n 80| Practice | Evidence | Why it helps |
|---|---|---|
| Pin the tag | webgoat/webgoat:v2025.3 | Prevents surprise lesson changes |
| Record the digest | Output from docker image inspect | Identifies the exact image content |
| Set the timezone | IANA TZ value | Reduces JWT and time-based lesson failures |
| Use disposable accounts | Class-specific naming convention | Avoids credential reuse |
| Document reset steps | Stop, remove, and recreate commands | Restores a known starting state |
WebGoat Troubleshooting: Startup, Ports and Login
Most failures come from Docker not running, an exited container, a port conflict, the wrong context path, a timezone mismatch, or instructions written for another release.
docker ps -a --filter name=webgoat
docker logs --tail 200 webgoat
docker inspect webgoat --format '{.Config.Image}'
# Linux port check
sudo ss -lntp | grep -E ':8080|:9090' || true
# Recreate on alternate host ports when necessary
docker rm -f webgoat 2>/dev/null || true
docker run --name webgoat -d -p 127.0.0.1:8081:8080 -p 127.0.0.1:9091:9090 -e TZ=Etc/UTC webgoat/webgoat:v2025.3| Symptom | Likely cause | Fix |
|---|---|---|
docker: command not found | Docker is missing or not in PATH | Use the official platform installation section |
| Browser cannot connect | Docker Desktop is stopped, the container exited, or startup is incomplete | Run docker ps -a and inspect logs |
| Port already allocated | Another process uses 8080 or 9090 | Map host ports 8081 and 9091 |
| 404 or wrong page | The context path was omitted or incorrectly capitalized | Open /WebGoat/ |
| Registration or login behaves unexpectedly | Stale browser state or release mismatch | Use a private window and verify the installed image |
| JWT lesson fails unexpectedly | Host and container timezone differ | Recreate the container with the correct TZ |
| Walkthrough does not match | The walkthrough targets another WebGoat release | Use built-in hints and matching release notes |
Use WebGoat as a Defensive Learning Environment
A useful walkthrough teaches a repeatable method, not only an answer. Exact lesson fields can change, but the reasoning remains valuable across releases.
- Read the lesson objective. Describe the weakness or control in one sentence.
- Create a normal baseline. Record the normal request, response, visible result, and timing.
- Change one controlled variable. Keep the result interpretable and remain within the lesson.
- Compare allowed and denied behavior. One surprising response is not enough evidence.
- Use the built-in hints. They are more likely to match the installed version than an old answer page.
- Explain the root cause. Identify the missing validation, authorization, parameterization, or design control.
- Write the mitigation. Describe the secure implementation and a regression test.
- Capture minimal evidence. Avoid placing passwords, session tokens, or sensitive values in notes and logs.
WebGoat's lesson catalog can support study of injection, access control, authentication, cryptography, request handling, and other application-security topics. The current released awareness list is the OWASP Top 10:2025, but WebGoat should not be presented as a one-to-one implementation of every current category or as a complete verification standard.
WebGoat Installation and Safety Checklist
| Check | Expected evidence | Status |
|---|---|---|
| Official source | OWASP project, WebGoat/WebGoat, or webgoat Docker Hub account | Required |
| Pinned release | v2025.3 tag and recorded digest for repeatable training | Recommended |
| Loopback binding | Both host mappings begin with 127.0.0.1 | Required |
| Timezone | Container TZ matches the host | Required for selected lessons |
| Disposable account | No reused personal or corporate password | Required |
| Correct URLs | /WebGoat/ and /WebWolf/ | Required |
| Safe evidence | Sanitized notes without raw credentials or tokens | Required |
| Shutdown | Container stopped or removed after the lesson | Required |
Primary Sources Used for This Guide
OWASP WebGoat Installation and Login FAQs
What is OWASP WebGoat?
OWASP WebGoat is a deliberately insecure Java and Spring Boot application maintained by OWASP for authorized application-security education. Its guided lessons explain vulnerabilities, provide controlled assignments, and describe mitigations. Run it only on localhost or in an isolated lab you own or are explicitly authorized to use.
What is the fastest safe way to install WebGoat?
Install Docker, then run the official webgoat/webgoat image with ports 8080 and 9090 bound to 127.0.0.1. Set the TZ environment variable to your IANA timezone, wait for the startup log, and open http://127.0.0.1:8080/WebGoat/.
What is the official WebGoat Docker command?
The official project publishes ports 8080 and 9090 on loopback. A repeatable example is docker run --name webgoat -d -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=Etc/UTC webgoat/webgoat:v2025.3. Replace Etc/UTC with the correct IANA timezone.
What URL opens WebGoat?
Open http://localhost:8080/WebGoat/ or http://127.0.0.1:8080/WebGoat/. The context path uses a capital W and G. Opening only the server root can be less reliable than using the complete /WebGoat/ path.
Does WebGoat have a default username and password?
Current WebGoat normally asks each learner to register a local account. There is no universal default login to rely on. Create disposable credentials used only for this local lab and never reuse a real password.
What is WebWolf and where do I open it?
WebWolf is WebGoat's companion application for lessons that need an attacker-controlled mailbox, file host, request receiver, or related lab service. With the standard Docker ports, open http://127.0.0.1:9090/WebWolf/.
What is the current WebGoat release?
As of August 5, 2026, GitHub marks v2025.3, released March 11, 2025, as the latest WebGoat release. Docker Hub also publishes a v2025.3 image for amd64 and arm64. Recheck the official Releases page before reusing saved workshop instructions.
How do I install WebGoat on Ubuntu?
Install Docker Engine from Docker's official Ubuntu repository, verify the engine with hello-world, and run the official WebGoat image with both ports bound to 127.0.0.1. Then open localhost:8080/WebGoat from the same computer.
How do I install WebGoat on RHEL?
Use Docker's official RHEL repository on a supported RHEL 8, 9, or 10 system, start Docker, verify it with hello-world, and run the official WebGoat image with loopback-only port bindings.
How do I install WebGoat on Windows?
Install and start Docker Desktop in Linux-container mode, normally with the WSL 2 backend. Run the PowerShell Docker command in this guide, wait for WebGoat to initialize, and open localhost:8080/WebGoat.
Why is localhost:8080/WebGoat not loading?
Confirm Docker is running, inspect docker ps -a, and review docker logs webgoat. Check whether ports 8080 or 9090 are already in use, confirm the capitalized /WebGoat/ path, and allow time for the Spring Boot application to start.
How do I stop, reset, or remove WebGoat?
Run docker stop webgoat to stop it while keeping the container. Run docker start webgoat to resume it. Run docker rm -f webgoat to remove the container and its local progress. Recreate it from the same pinned image when you need a clean lab.
Turn lab lessons into repeatable security controls
WebGoat helps teams observe individual application weaknesses in a controlled environment. Real programs also need secure design requirements, automated verification, inventory, production evidence, incident response, and controlled protection across applications and APIs.