Skip to content
Legacy WebGoat 6.0 - Deliberately insecure JavaEE application
Branch: master
Clone or download
Latest commit 1e7e110 Aug 3, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information.
doc Fixed directory layout Mar 30, 2014
newDesign Updated logo bg, added modal for about icon Sep 11, 2014
src/main Fix typo Sep 30, 2015
.gitignore WEB-214: Fixed build failure while downloading javax.transaction depe… Jul 12, 2015
README.MD Update README.MD Aug 3, 2018


Sonatype DepShield

DepShield Badge

Important Information

Thank you for downloading WebGoat! This is the WebGoat Legacy version which is essentially the WebGoat 5 with a new UI.

This program is a demonstration of common server-side application flaws. The exercises are intended to be used by people to learn about application penetration testing techniques.

WARNING 1: While running this program your machine will be extremely vulnerable to attack. You should to disconnect from the Internet while using this program.

WARNING 2: This program is for educational purposes only. If you attempt these techniques without authorization, you are very likely to get caught. If you are caught engaging in unauthorized hacking, most companies will fire you. Claiming that you were doing security research will not work as that is the first thing that all hackers claim.

You can find more information about WebGoat at: (

Easy Run Instructions ( For non-developers )

Follow these instructions if you simply wish to run WebGoat


Java VM >= 1.6 installed ( JDK 1.7 recommended)

  1. Download the executable jar file to any location of your choice:


  2. Run it using java:

    java -jar WebGoat-6.0-exec-war.jar

  3. Then navigate in your browser to: (http://localhost:8080/WebGoat)

  4. If you would like to change the port or other options, use:

    java -jar WebGoat-6.0-exec-war.jar --help

Standard Run Instructions (For Developers)

Follow These instructions if you wish to run Webgoat and modify the source code as well.


  • Java >= 1.6 ( JDK 1.7 recommended )
  • Maven > 2.0.9
  • Your favorite IDE, with Maven awareness: Netbeans/IntelliJ/Eclipse with m2e installed. If you are setting up an IDE, Netbeans 8.0 contains the Maven and Git support you need: (
  • Git, or Git support in your IDE

Note: WebGoat source code can be downloaded at: (

  1. Building the project (Developers) using a command shell/window:

    cd webgoat mvn clean package

  2. After opening the project in Netbeans or Eclipse, you can easily run the project using maven:

    mvn tomcat:run-war

  3. Maven will run the project in an embedded tomcat. The package phase also builds an executable jar file. You can run it using:

    cd target java -jar WebGoat-6.0-exec-war.jar http://localhost:8080/WebGoat

You can’t perform that action at this time.