I wanted a local environment where I could practice vulnerabilities that feel closer to what security researchers encounter in real applications.
So, I built a deliberately vulnerable PHP/MySQL application for practicing web and API security.
Instead of creating another generic CTF-style challenge, I based the vulnerabilities on issues I have encountered during my own research and on patterns commonly found in real applications.
What Is Inside the Lab?
The application is fully Dockerized and currently contains 10 intentional vulnerabilities, including:
- API-level BOLA
- JWT forgery
- Unrestricted file upload leading to remote code execution
- Time-based SQL injection
- Several other vulnerabilities left for you to discover
The goal is not only to find the vulnerabilities, but also to understand how they work, how they can be chained, and what security impact they may have.
Field Manuals
I also included field manuals in the repository.
They walk through the intended exploit chains, so you can use them if you get stuck or want to compare your approach with mine. If you prefer discovering everything yourself, try the lab before reading them.
Important Safety Note
This application is deliberately vulnerable. Run it only on your local machine or inside an isolated environment.
Never expose it directly to the internet or use its techniques against systems you do not own or have explicit permission to test.
Try the Lab
You can find the source code and setup instructions here:
If you try it, let me know which vulnerabilities you find—or whether you manage to pop a shell!
Top comments (0)