Top 6 PHP Penetration Testing Projects

mutillidae

5 1,169 7.8 PHP

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.

Project mention: If you're looking for resources pertaining to hands-on practical demonstrations of learned skills and tools/techniques, look no further. | /r/Kalilinux | 2023-11-15

There's also a bunch of intentionally vulnerable Webapps and VMs aimed at demonstrating potential footholds and common exploits leading to owning of the host including but not limited to: bWAPP, Damn Vulnerable Web App, WebGoat, Metasploitable 3, Mutillidae, Juice Shop

CloudPeler

2 1,161 4.9 PHP

CrimeFlare is a useful tool for bypassing websites protected by CloudFlare WAF, with this tool you can easily see the real IP of websites that have been protected by CloudFlare. The resulting information is certainly very useful for conducting further penetration testing, and analyzing websites with the same server.
WorkOS

workos.com sponsored

The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
Payloads

1 842 3.7 PHP

Payload Arsenal for Pentration Tester and Bug Bounty Hunters (by sh377c0d3)
phishing-frenzy

1 749 2.9 PHP

Ruby on Rails Phishing Framework
php-reverse-shell

2 419 3.2 PHP

PHP shells that work on Linux OS, macOS, and Windows OS. (by ivan-sincek)
sqli-postgres-rce-privesc-hacking-playground

1 71 0.0 PHP

Application with SQL Injection vulnerability and possible privilege escalation. Free vulnerable app for ethical hacking / penetration testing training.

NOTE: The open source projects on this list are ordered by number of github stars. The number of mentions indicates repo mentiontions in the last 12 Months or since we started tracking (Dec 2020).