For internal testing, security education, and product demonstrations, intentionally vulnerable training applications are frequently utilized. Because they are by default insecure, tools like OWASP Juice Shop, DVWA, Hackazon, and bWAPP are helpful for understanding how common attack methods operate in controlled settings. The way that apps are frequently deployed and maintained in actual cloud environments is the problem, not the apps themselves.

Pentera Labs looked at how training and demo apps are used across cloud infrastructures and discovered a common trend: apps meant for private lab use were often discovered running inside active cloud accounts, connected to cloud identities with more access than necessary, and exposed to the public internet.

Patterns of Deployment These applications were frequently deployed with default configurations, little isolation, and excessively permissive cloud roles, according to research conducted by Pentera Labs. For inquiries or conversations, reach out to labs@pentera.io.