⚠️

Authorized Security Training Environment

This application contains deliberate security vulnerabilities for penetration testing and defensive coding education. Never deploy to open public networks.

🎯 12 Vulnerability Labs

Dedicated modules covering the OWASP Top 10, SQLi, XSS, CSRF, IDOR, RCE, XXE, and more.

Self-Contained

🎚️ 3 Difficulty Levels

Toggle between Low (vulnerable), Medium (flawed filters), and High (secure implementation).

Low / Med / High

🛍️ Realistic Mock Store

Interact with real e-commerce workflows, product catalogs, customer reviews, and order lookup.

Live E-Commerce

Vulnerability Practice Modules

1. SQL Injection /lab/sqli.php

Classic, blind, and error-based injection in catalog search and login forms.
2. Reflected XSS /lab/xss_reflected.php

Unfiltered GET query parameters reflected into live HTML response.
3. Stored XSS /lab/xss_stored.php

Persistent script injection in customer reviews and product comment boards.
4. CSRF /lab/csrf.php

State-changing action without anti-CSRF token or SameSite protection.
5. Broken Auth & Sessions /lab/broken_auth.php

Predictable session IDs, lack of session regeneration, and credential brute force.
6. IDOR (Order Lookup) /lab/idor.php

Insecure direct object reference exposing customer invoices and addresses.
7. Unrestricted File Upload /lab/file_upload.php

No MIME or extension validation leading to web shell execution.
8. OS Command Injection /lab/command_exec.php

Direct shell_exec execution in network ping/traceroute diagnostic utility.
9. Misconfiguration /lab/misconfig.php

Exposed phpinfo(), verbose stack traces, and default credentials.
10. Sensitive Data Exposure /lab/sensitive_data.php

Unprotected database dumps (.sql), .bak files, and plaintext secrets.
11. Broken Access Control /lab/access_control.php

Unauthenticated direct URL access to admin functions and cookie tampering.
12. XML External Entity (XXE) /lab/xxe.php

XML product inventory importer parsing external DOCTYPE / SYSTEM entities.