google/firing-range

Health v2 · maintenance only

Flags: no_releases archived

Adoption not part of the score

1413 stars · 234 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Firing Range is a deliberately vulnerable Java web application that serves as a test bed for web application security scanners. It provides synthetic, wide coverage of an array of vulnerabilities and can be deployed on Google App Engine or run locally.

Use cases

• test a web application security scanner against known vulnerabilities
• benchmark coverage of a DAST scanner
• validate that a vulnerability scanner detects XSS and injection flaws
• set up a local vulnerable target for security tooling development
• compare effectiveness of different web security scanners
• provide a safe synthetic target instead of testing on real apps

When to choose

• you need a broad, synthetic set of web vulnerabilities to evaluate or tune a security scanner
• you want a self-hosted or App Engine-deployable test target for DAST tooling
• you are developing web vulnerability detection logic and need reproducible test cases

When to avoid

• you need a real-world vulnerable application rather than synthetic test cases
• you want a security training platform with guided lessons rather than a raw test bed
• you need a non-Java or non-App Engine deployment target without adaptation

Facets

application · maturity maintenance

security testing http-server security testing web-development jvm cloud self-hosted vulnerable-app scanner-testbed app-engine synthetic-vulnerabilities penetration-testing-target web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="google/firing-range")