vuln-bank vs DVWA
Deliberately vulnerable security training apps compared
vuln-bank and DVWA provide deliberately vulnerable applications for practicing security testing in controlled environments. vuln-bank centers on banking workflows and covers web, API, GraphQL, and AI scenarios, while DVWA focuses on common web vulnerabilities with adjustable challenge difficulty.
vuln-bank: Practice Web, API, and AI Security Testing
Vuln Bank is an intentionally vulnerable banking web app for learning application security testing and secure code review. It offers hands-on scenarios across web, API, GraphQL, and AI features, and should only run in an isolated educational environment.
DVWA: Practice Web Application Security in a PHP/MariaDB Lab
DVWA is a deliberately vulnerable PHP/MariaDB web application for security professionals, developers, students, and teachers to practice common web vulnerabilities. Its difficulty levels and Docker setup make it useful for controlled training, not public deployment.
| vuln-bank | DVWA | |
|---|---|---|
| Language | HTML | PHP |
| License | MIT | GPL-3.0 |
| Stars | 960 | 13.9k |
| Forks | 348 | 5.2k |
| Last analyzed | Oct 3, 2026 | Oct 24, 2026 |
Key differences
- vuln-bank includes banking features such as transfers, loans, and bill payments; DVWA presents common web vulnerability challenges through a straightforward web interface.
- vuln-bank covers web, API, GraphQL, and AI security scenarios; DVWA offers documented and intentionally undocumented vulnerabilities, plus difficulty levels.
- vuln-bank is listed with HTML and an MIT license; DVWA is built with PHP and MariaDB and uses GPL-3.0.
- Both offer Docker Compose, but vuln-bank also documents a local Python/PostgreSQL path, while DVWA supports installation on a PHP/MariaDB web stack.
- The provided repository figures list 960 stars and 348 forks for vuln-bank, compared with 13.9k stars and 5.2k forks for DVWA.
Choose vuln-bank if you…
- need practice across banking workflows, APIs, GraphQL, and AI security scenarios.
- want to review intentionally flawed application code or test security workflows against a banking-style app.
- prefer a lab with a documented Docker Compose setup or local Python/PostgreSQL installation path.
Choose DVWA if you…
- want a PHP/MariaDB lab focused on common web vulnerabilities.
- need adjustable challenge difficulty or want to investigate intentionally undocumented vulnerabilities.
- plan to use the app for classroom exercises or to test tools against a straightforward web interface.
Compare the numbers side by side, or add more projects
This comparison is generated with AI from the OSRepos analyses of both projects. Always check each project's repository and documentation before choosing.