SamuraiWTF
OWASP-maintained web-app pentest training environment
SamuraiWTF has no official, structured tool listing we can auto-sync (unlike Kali, BlackArch, REMnux, and Tails). The tools below are maintained by hand and may be incomplete or outdated — check the official docs for the current tool set.
Last verified September 5, 2026
SamuraiWTF (“Web Training Framework”) is an OWASP project bundling web-application pentest tools — ZAP, Burp Suite Community Edition, sqlmap, ffuf, Nikto, TruffleHog — alongside deliberately vulnerable target apps (OWASP Juice Shop, DVWA, Mutillidae, crAPI, and others) for practicing against.
Use it only against the bundled training targets or systems you own or are explicitly authorized to test — see the disclaimer.
Notable bundled toolsmanually maintained
burpsuite
Platform for security testing of web applications
ffuf
Fast web fuzzer written in Go (program)
nikto
Web server security scanner
sqlmap
Automatic SQL injection tool
trufflehog
Searches through git repositories for secrets
zaproxy
Testing tool for finding vulnerabilities in web applications
Getting started
SamuraiWTF is distributed as a prebuilt VirtualBox OVA or Hyper-V VHDX image (or built yourself via Vagrant) on Ubuntu — there's no installer ISO. Both its tools and its deliberately vulnerable target apps are managed through its own Katana package tool (`katana install <name>`, `katana list`) rather than a system package manager, and targets resolve under a local `.test` domain via a self-signed root CA.