Vulnerable Environments

Browse our collection of pre-built vulnerable environments for security research and education. Each environment is containerized with Docker and comes with detailed documentation.

Vulnerable Environments

Auth Bypass

Apache Superset Hardcoded JWT Secret Key Leads to Authentication Bypass

Next.js Middleware Authorization Bypass

Apache HugeGraph JWT Token Secret Hardcoding Leads to Authentication Bypass

Apache OFBiz Authentication Bypass Leads to RCE

Backdoor

PHP 8.1.0-dev User-Agentt Backdoor Remote Code Execution

CMS

CraftCMS ConditionsController Pre-Auth Remote Code Execution

CraftCMS register_argc_argv Leads to Remote Code Execution

Joomla 4.2.7 Permission Bypass

ECShop 4.x collection_list SQL Injection

Database

Adminer Server-side Request Forgery on Error Page of Elasticsearch and ClickHouse

CouchDB Erlang Distributed Protocol Code Execution

Redis Lua Sandbox Bypass Command Execution

H2 Database Console Unauthorized Access

Deserialization

Apache Superset Python Pickle Deserialization Leads to RCE

Tomcat Session Deserialization Remote Code Execution

Apache HertzBeat SnakeYaml Deserialization Remote Code Execution

Adobe ColdFusion XML Deserialization Leads to RCE

DoS

OpenSSL Infinite Loop Leads to DoS

Environment Injection

CGI Application Environment Variable Injection by HTTPoxy

GoAhead Web Server Environment Variables Injection and `LD_PRELOAD` Remote Code Execution

GoAhead Web Server Environment Variables Injection and `LD_PRELOAD` Remote Code Execution

Expression Injection

GeoServer Unauthenticated Remote Code Execution in Evaluating Property Name Expressions

Atlassian Confluence Pre-Auth Remote Code Execution via OGNL Injection

Atlassian Confluence Pre-Auth Remote Code Execution via OGNL Injection

Spring Cloud Function SpEL Expression Command Injection

File Deletion

Discuz!X <= 3.4 Arbitrary File Deletion

File Upload

Apache RocketMQ NameServer Arbitrary File Write

SaltStack Arbitrary File Read and Write

Drupal Cross-Site Scripting by File Upload

WebLogic Arbitrary File Upload

Framework

Next.js Middleware Authorization Bypass

Struts2 S2-067 Upload Path Traversal

Struts2 S2-066 Upload Path Traversal

Spring Security Authorization Bypass in RegexRequestMatcher

Hard Coding

Apache Superset Hardcoded JWT Secret Key Leads to Authentication Bypass

Apache HugeGraph JWT Token Secret Hardcoding Leads to Authentication Bypass

InfluxDB Empty JWT Secret Key Authentication Bypass

Apache APISIX Hardcoded API Token Leads to RCE

Info Disclosure

MinIO Cluster Mode Information Disclosure

OpenSSL Heartbleed Memory Leak Leads to Information Disclosure

Jetty WEB-INF Sensitive Information Disclosure

Jetty WEB-INF Sensitive Information Disclosure

Message Queue

Apache RocketMQ NameServer Arbitrary File Write

Apache ActiveMQ Jolokia Authenticated Remote Code Execution

Apache ActiveMQ OpenWire Protocol Deserialization RCE

Apache RocketMQ Broker Remote Command Execution

Other

DNS Domain Transfer

Path Traversal

Vite Development Server Arbitrary File Read

Vite Development Server Arbitrary File Read Bypass

GlassFish 4.1.0 Arbitrary File Read

FFmpeg AVI Arbitrary File Read

Privilege Escalation

V2board 1.6.1 Privilege Escalation

Polkit pkexec Privilege Escalation

SaltStack Information Disclosure Leads to Privilege Escalation

PostgreSQL Privilege Escalation

RCE

CraftCMS ConditionsController Pre-Auth Remote Code Execution

Cacti RRDTool Post-Auth Argument Injection Leads to RCE

Cacti graph_view.php SQL Injection Leads to RCE

ImageMagick Imagetragick Command Injection

SQL Injection

Cacti graph_view.php SQL Injection Leads to RCE