How to use this reference
Study lesson concepts in an isolated local training setup, recording the relevant trust assumption and prevention principle. Use the material to improve secure-design reasoning without extending exercise activity to third-party systems.
Before reading
- A web browser and the ability to run a local teaching application using a supported deployment option.
- Basic HTTP and web-application concepts are helpful.
Context and limits
- The publisher warns that running WebGoat makes the host vulnerable, recommends disconnecting from the Internet, and notes that its default configuration binds to localhost.
- Use only an isolated, explicitly authorized training environment. No application was installed, started, or tested.
- The release date belongs to the educational training application, not the original project-page publication.
- Prerequisites vary with the selected release and deployment method; consult current official documentation before setup.
- Training application release v2026.5 is dated 2026-10-12 in the official release source. It is retained as maintenance evidence; no dated document edition is asserted.
Sources and provenance
- OWASP WebGoat OWASP Foundation · reviewed 2026-10-12
- WebGoat: A deliberately insecure Web Application OWASP WebGoat · reviewed 2026-10-12
- WebGoat v2026.5 OWASP WebGoat · reviewed 2026-10-12
Record reviewed 2026-10-12. Snapshot cb017eaea66e. Open the complete JSON contract.