Vulhub
A collection of deliberately vulnerable Docker Compose setups covering web apps, databases, middleware and services. Each environment is self-contained and ready to spin up for hands-on exploitation practice. Useful for learning specific CVEs or testing tools against known weaknesses without building the vulnerable stack yourself.
Read the original on github.com
Run it safely. Deliberately vulnerable setups belong inside an isolated attack range: a host-only network with no route out, and a snapshot to roll back to.