⚠️ VULNERABLE OWASP APP

🔒 This application contains INTENTIONAL security vulnerabilities

For security testing, CTF challenges, and educational purposes ONLY

A01:2021 - Broken Access Control

POST/login - Weak authentication
GET/profile/:id - IDOR
GET/admin - Cookie bypass
GET/api/v1/users - Overly permissive

A02:2021 - Cryptographic Failures

GET/encrypt - Weak "encryption"
POST/register - Plaintext passwords
GET/config CRITICAL
GET/jwt - Weak JWT

A03:2021 - Injection

GET/users SQLi
POST/auth - SQLi login bypass
GET/ping CMDi
GET/dns - Command injection
GET/file - Command injection
GET/ldap - LDAP injection
GET/xpath - XPath injection

A04:2021 - Insecure Design

POST/reset-password - Predictable tokens
GET/security-questions
POST/verify-code - No rate limiting
POST/brute - Brute force

A05:2021 - Security Misconfiguration

GET/config CRITICAL
GET/error - Stack traces
GET/files - Directory listing
GET/defaults - Default creds
GET/debug CRITICAL

A06:2021 - Vulnerable Components

POST/merge - Prototype pollution
POST/deserialize RCE
GET/fetch SSRF
GET/proxy - Internal SSRF

A07:2021 - Auth Failures

GET/session - Session fixation
POST/brute - No rate limiting
POST/change-password - Weak policy

A08:2021 - Integrity Failures

GET/download - No integrity
GET/deploy - Insecure CI/CD

A09:2021 - Logging Failures

POST/log - Log injection
GET/debug-logs - Sensitive logs
GET/audit - No monitoring

A10:2021 - SSRF

GET/fetch SSRF
POST/webhook - Webhook SSRF
GET/pdf - PDF SSRF
GET/proxy

XSS - Cross-Site Scripting

GET/search-xss Reflected
POST/comments Stored
GET/comments - View comments
GET/dom-xss DOM

File Upload

POST/upload - No validation
GET/uploads/:file - Path traversal

Path Traversal

Open Redirect

GET/redirect
GET/login-redirect

Remote Code Execution

GET/shell CRITICAL
GET/reverse-shell
POST/webshell CRITICAL
GET/cmd CRITICAL

XXE - XML External Entity

POST/xml - XXE vulnerable

CORS Misconfiguration

GET/api/data - Reflects Origin

Debug / Info Disclosure

GET/debug CRITICAL
GET/source - Source code
GET/vulns - All vulnerabilities