gorigorisensei / gorisenvulnerableapp

This application is made with python flask that teaches users how to attack and protect against OWASP top 10 vuln

gorisenVulnerableApp

This application is made with python flask that teaches users how to attack and protect against OWASP top 10 vuln.

Description

This application has multiple OWASP top 10 vulnerabilities. The idea is that a user can download this application to their local environment test it for vulnerabilities (pen-testing) and then apply secure coding to the source code without breaking the app's functionality. Below is the basic training flow:

1. First, test it from black-box simulations and try to find these vulnerabilities by exploiting the application.
2. Then, try to fix the vulnerable code with the white-box approach by fully inspecting the code manually.
3. Solutions can be found inside the "website/solutions" folders.

Instructions

1. git clone this repository to your local environment.
2. download the dependencies with requirements.txt.
3. execute the main.py to start the application.
4. the main site can be accessed at http://localhost:8080/.

Warning

Spoiler Alert below! (For the the black-box testing approach)

Vulnerabilities implemented:

Vuln
SQL Injection
Stored XSS
Reflected XSS
LFI
Remote Code Execution
SSTI / RCE
CSRF
Insecure Session Management
XXE
IDOR
Security Misconfiguration and RCE

Note

The app is still in development. I am planning to implement more soon. 👾

Preview of the web application

Untitled.video.-.Made.with.Clipchamp.2.mp4

Author

gorigorisensei