List of vulnerable machines for testing and training. Nothing more. Nothing less.
Every machine is automatically restarted every 2 hours (on even hours, local time).
Deliberately insecure by design. For testing and training.
Machines
| Machine | Vulns | Source | Live |
|---|---|---|---|
| Boxcutter Store | Mixed injection, XSS, broken access control, API & GraphQL, business logic, info disclosure | source | boxcutter.appsec.study |
| Stalker | Leaked Git artifacts, hidden admin panel, SQL injection, code execution | source | stalker.appsec.study |
| DVWA (fork of DVWA) | SQL injection (incl. blind), command injection, file inclusion (LFI/RFI), file upload, XSS (reflected/stored/DOM), CSRF, brute force, weak session IDs | source | dvwa.appsec.study |
| frontend-str-react | React-specific client-side bugs: dangerouslySetInnerHTML, javascript: href, props-spread injection, dynamic-component render |
source | freact.appsec.study |
| frontend-str-vue | Vue-specific client-side bugs: v-html, :href javascript:, runtime-compiler CSTI, <component :is> |
source | fvue.appsec.study |
| frontend-str-angular | Angular-specific client-side bugs: bypassSecurityTrust* (HTML/URL/ResourceUrl), open redirect, JIT CSTI |
source | fangular.appsec.study |
| nomnom | Food-ordering REST API (~117 endpoints, Swagger UI): BOLA/IDOR, BFLA, mass assignment, price tampering, referral race condition, SSRF, SQLi, JWT (alg:none/weak secret), XXE, SSTI, file upload, open redirect, CORS, GraphQL | source | nomnom.appsec.study |
| juicy | JS-analysis SPA: secrets & assembled/prefixed endpoints buried in bundles at varied obfuscation (minified, webpack, hex, base64, source-map leak) + 8 DOM-XSS sinks behind hidden params | source | juicy.appsec.study |
| graph | Vue + GraphQL (Apollo) shop, JWT access/refresh: pervasive BOLA/IDOR, invite-IDOR, hidden recentUsers, GraphQL SQLi, path traversal, mass-assignment, weak/leaked reset, price-tamper, option-price abuse, stored XSS (reviews/CMS), unauth CMS mutation, enumeration |
source | graph.appsec.study |
| lstalker (variant of Stalker) | SQL injection → cleartext credential disclosure → hidden admin panel → eval RCE. No .git — content-discovery instead of Git recovery |
source | lstalker.appsec.study |
| shoppy (REST twin of graph) | Same shop, full REST API (Express) + JWT access/refresh: BOLA/IDOR, SQLi, path traversal, mass-assignment, price/coupon/refund/credits abuse, SSRF, file upload, stored XSS, impersonation, verbose errors | source | shoppy.appsec.study |
Scanner coverage
Planted vulnerabilities each scanner discovered (valid findings / total embedded). A new column is added per scan.
| Machine | boxcutter web-full (unauthed) |
|---|---|
| Boxcutter Store | 19 / 109 |
| DVWA | 9 / 14 |
| nomnom | 5 / 42 |
| Stalker | 1 / 4 |
| frontend-str-react | 0 / 5 |
| frontend-str-vue | 0 / 5 |
| frontend-str-angular | 0 / 5 |
| juicy | — |
| graph | — |
| lstalker | — |
| shoppy | — |