OWASP WebGoat is an interactive lesson platform that explains a vulnerability, lets you complete a controlled exercise, and then shows the defensive idea. This page gives a direct Docker launch for WebGoat and WebWolf, the correct browser paths, account setup, and reusable commands for later sessions.
What is OWASP WebGoat?
WebGoat is a deliberately insecure Java application maintained by OWASP. Instead of presenting an empty vulnerable website, it organizes security topics as guided lessons. A lesson explains the weakness, gives you an exercise, and finishes with mitigation guidance.
WebWolf runs beside WebGoat and supports lessons that need email, file, or callback-style interactions. Modern WebGoat normally asks you to create a local learner account rather than using one shared default login.
Download, install, run and test OWASP WebGoat and WebWolf
WebGoat is an OWASP teaching application with guided lessons; WebWolf is its companion service. No project folder is required for the fastest path because the official Docker image is the complete download.
Ubuntu: complete Bash installation
Open a Bash terminal and paste the full block. It installs every required package, downloads the current project or image, starts the lab, tests the web service, and prints the browser address.
RHEL, Rocky Linux or AlmaLinux: complete Bash installation
Open Bash and paste the full block. These commands use and the Docker RHEL repository.
Windows 10 or 11: complete cmd.exe installation
Open Command Prompt as Administrator. The first block installs Docker Desktop. If Windows requests a restart, restart, reopen , and paste the same block again.
A sensible first WebGoat walkthrough
Create one local learner account and start with the introductory lessons. WebGoat tracks progress inside that account, so keeping one account makes it easier to return later. Read the lesson goal before opening browser developer tools or a proxy; understanding the expected application behavior makes the security flaw easier to recognize.
When you reach an assignment that uses email, a hosted file, or a callback, open WebWolf in a second tab. Use the same account where requested. For SQL injection and access-control lessons, focus on how data crosses trust boundaries and how the server decides what the user may read or change.
Troubleshooting that actually helps
| Problem | What to check | Fix |
|---|---|---|
| WebGoat page is still loading | Startup time | Wait another 20–40 seconds and run |
| WebWolf is unavailable | Port 9090 mapping | Confirm the run command contains |
| JWT-related lesson behaves strangely | Container timezone | Recreate the container with |
| Registration data should be cleared | Existing container state | Remove and recreate the container with the reset command. |
How Ammune helps with production risks represented by WebGoat
WebGoat covers many web and API-adjacent weaknesses, including SQL injection, access-control failures, JWT mistakes, SSRF, XXE, insecure deserialization, and client-side issues. Ammune connects these lesson concepts to observed production API traffic.
Build an inventory from observed traffic and show which endpoints, methods, parameters, and response fields are actually in use.
Inspect both sides of an API transaction so analysts can see the input, returned data, status, identity context, and related behavior.
Turn suspicious API activity into risk-ranked, SIEM-ready evidence that can support monitoring, investigation, and carefully controlled enforcement.
| Training weakness | Production API risk | How Ammune can help |
|---|---|---|
| Broken access control | A caller changes an object ID or function path and reaches data or actions outside its role. | Analyze user-to-object and user-to-endpoint behavior to surface BOLA, IDOR, and function-level authorization anomalies. |
| JWT and authentication mistakes | Weak token validation or unusual token reuse enables unauthorized API calls. | Correlate token, identity, endpoint, and session behavior and highlight unusual authentication or replay patterns. |
| Injection and parser abuse | JSON, XML, query, or header input reaches a vulnerable parser or backend. | Inspect payloads and content types, identify suspicious structures, and retain request/response evidence for triage. |
| Sensitive responses | An endpoint returns credentials, personal data, or excessive object properties. | Inspect response bodies for sensitive data and expose endpoints that return more information than expected. |
Related Ammune guidance: JWT API security best practices BOLA and IDOR API security API sensitive data exposure OWASP Juice Shop Docker installation and login guide
Verified project sources
The tutorial above is complete; these links are included for release history, project ownership, and future verification—not because you need to leave this page to finish the installation.
Frequently asked questions
Why does WebGoat include WebWolf?
WebWolf supports lessons that need a second service, such as receiving messages, files or callbacks in a controlled training workflow.
Does WebGoat use one shared default account?
Current versions normally ask each learner to create a local account so lesson progress remains separate.
Are WebGoat lessons only about Java?
No. The application is Java-based, but the lessons teach web-security concepts that apply across languages and frameworks.
What is the best order for a beginner?
Complete the introductory HTTP and authentication material first, then move to injection, access control, session and client-side lessons.
Why should WebGoat remain local?
It is deliberately insecure, so exposing it could give other people an unsafe target on your machine or network.
How does Ammune relate to WebGoat lessons?
Ammune can inspect real API request and response behavior, surface unusual access and data exposure, and provide context for SOC investigation.
Apply the lessons from OWASP WebGoat to real API traffic
Ammune helps security, DevSecOps, and SOC teams discover APIs, inspect requests and responses, identify abuse and data exposure, and turn runtime evidence into practical investigation or enforcement workflows.