OWASP Mutillidae II is a free, open-source, deliberately vulnerable PHP web application that gives security learners, instructors, and tool testers a ready target for practising web hacking against the OWASP Top Ten.

What it is

OWASP Mutillidae II is a deliberately vulnerable web application written in PHP, released under GPL-3.0, and maintained as an OWASP project. It contains over 40 vulnerabilities and challenges covering each entry of the OWASP Top Ten from 2007 through 2017, and it is built to be genuinely exploitable rather than a hardened application dressed up to look weak. The README states this directly: Mutillidae is actually vulnerable, so users do not have to enter a "magic" statement to make a flaw appear.

The problem it solves is the shortage of a safe, resettable place to practise. It lives in the PHP ecosystem and installs on the standard AMP stacks — Linux and Windows setups including XAMPP, WAMP, and LAMP — and it replaces the simulated exercise in which a learner types a special phrase to trigger a vulnerability that is not really there. Because the application is real and the flaws are real, the same environment can serve a classroom exercise, a capture-the-flag round, and a scanner's assessment target.

Key capabilities

• Ships with over 40 vulnerabilities and challenges, organised to cover each OWASP Top Ten category from 2007 to 2017.
• Provides a "Setup" button for one-click restoration of the system to default settings, so a lab can be reset between sessions.
• Lets users switch between secure and insecure modes to compare the protected and unprotected behaviour of the same page.
• Installs on existing XAMPP, WAMP, and LAMP stacks, or runs from Docker images published on DockerHub.
• Keeps its code under the src directory, split into areas including ajax, classes, data with XML data sources, includes, javascript, and labs.
• Is distributed preinstalled on Rapid7 Metasploitable 2, Samurai Web Testing Framework (WTF), and OWASP Broken Web Apps, and can be updated on those platforms.

Who uses it and how

• It is used in graduate security courses, where the secure/insecure switch and the Setup reset let an instructor demonstrate a flaw and then return the environment to a known state.
• It is used in corporate web security training as a hands-on environment for staff learning application security.
• It serves as a lab environment for security enthusiasts and as a target for capture-the-flag exercises.
• It is used as an assessment target for vulnerability assessment software, giving scanners a known-vulnerable subject to measure against.
• Learners running Metasploitable 2, Samurai WTF, or OWASP Broken Web Apps already have it, because it is preinstalled on each of those distributions.

Getting started

The standard installation runs Mutillidae from DockerHub images, with a separate guide for running it on Google Kubernetes Engine and a legacy path for an existing LAMP stack documented in README-INSTALLATION.md. The source now lives in the src project directory, and the README warns that older instructions must be adjusted accordingly.

How it compares

It overlaps with Rapid7 Metasploitable 2, Samurai Web Testing Framework, and OWASP Broken Web Apps, but where those are whole distributions, Mutillidae is a single application that can be layered onto an existing XAMPP, WAMP, or LAMP stack, run from DockerHub, or used as the component already bundled inside those distributions. It is free and GPL-3.0 licensed, so it can be redistributed and run in a classroom without a licence fee, and the vulnerable content stays on infrastructure the operator controls.

When to use it — and when not

A self-hoster has to operate a PHP application on a LAMP, WAMP, or XAMPP stack or run the Docker images, and must keep a deliberately vulnerable application isolated from untrusted networks, since the flaws are the point rather than an oversight. It is not the right choice for anyone seeking a production web application, a codebase to harden, or a tool that stands in for a real scanner. Its documentation is partly delivered as video tutorials on YouTube and announcements on X rather than as text, and the directory listing in the README breaks off partway through the labs entry, so some setup details are easier to follow from the videos than from the repository.