# OWASP ## Identification The Open Worldwide Application Security Project is a nonprofit community producing application-security guidance and deliberately vulnerable training systems. The notebook links mobile rooting and AOSP work to iGoat, WebGoat, and CloudGoat as authorized learning environments. ## Notebook evidence - [[Scanned_20260730-1659#PDF page 43 — CyanogenMod/AOSP chain to OWASP Goat training systems|PDF page 43: CyanogenMod/AOSP chain to OWASP Goat training systems]] — CyanogenMod was an aftermarket Android distribution whose community lineage continued as LineageOS; AOSP is Android’s open-source platform base. OWASP’s iGoat and WebGoat are intentionally insecure training applications, while CloudGoat provides vulnerable cloud scenarios. The chain shows a deliberate lab concept: root a device, install a controllable OS, then use vulnerable targets to study exploitation and defense. ## Relationships and overlays The source places this record in an evidence cluster with [[Android Open Source Project|Android Open Source Project]] · [[Android Rooting|Android Rooting]] · [[BLU Products|BLU Products]] · [[CyanogenMod|CyanogenMod]] · [[Microsoft Lumia 635|Microsoft Lumia 635]] · [[OWASP CloudGoat|OWASP CloudGoat]] · [[OWASP iGoat|OWASP iGoat]] · [[OWASP WebGoat|OWASP WebGoat]]. The occurrence contributes to the notebook's larger model of [[Identity Continuity|identity continuity]], [[Device Sovereignty|device sovereignty]], and [[Continuity Architecture|continuity architecture]]. ## Evidentiary status and open leads Recover the lab plan, target devices, and whether Goat systems were local, containerized, or cloud-hosted. ## Source - [[Scanned_20260730-1659|Scanned_20260730-1659]] ## Scanned_20260730-1946 overlay PDF page 5 records OWASP, WebGoat, iGoat, and ZAP; pages 17–18 extend the cluster into the Mobile Security Testing Guide, hacking playgrounds, vulnerable iOS applications, proxies, and runtime instrumentation. OWASP supplies the notebook's clearest lawful training and methodology backbone. Deliberately vulnerable applications and assessment tools are dual-use. Their written presence documents a research plan, not an unauthorized target, execution, or compromise.