{"content":"\n\n\n \n \n \n \n VulnShop \u2014 second-hand merch, first-hand mistakes\n \n VS\">\n\n\nSkip to content\n\n
\n
\n Local only\n This shop is broken on purpose for scanner practice. Keep it on 127.0.0.1 \u2014 don't put it online.\n
\n
\n\n
\n
\n \n VS\n Vulnshop.\n second-hand merch, first-hand mistakes\n \n\n
\n \n \n \n
\n\n \n
\n\n \n
\n\n
\n \n
\n\n
\n
\n

A practice shop \u00b7 runs on 127.0.0.1 only

\n

A junk shop that trusts everything it's told.

\n

\n 12 things on the shelf. Search box builds SQL by hand,\n the greeter page renders what you type as a template, and\n /api/exec?cmd=id does exactly what it looks like.\n It's all on purpose \u2014 point a scanner at it and take notes.\n

\n
\n Browse the shelf\n See what's broken\n
\n

\n Sign in as admin / admin123. Docs at /api/docs.\n

\n
\n\n \n
\n\n
\n
13Orders placed
\n
1","headers":{"Access-Control-Allow-Credentials":"true","Access-Control-Allow-Headers":"*","Access-Control-Allow-Methods":"GET, POST, PUT, DELETE, OPTIONS","Access-Control-Allow-Origin":"*","Connection":"close","Content-Length":"22974","Content-Type":"text/html; charset=utf-8","Date":"Mon, 28 Sep 2026 11:59:50 GMT","Server":"Werkzeug/3.1.8 Python/3.12.14, VulnShop/1.0.0 (Flask 3.0.3)","Set-Cookie":"session_id=abc123def456; Path=/; SameSite=None","Vary":"Cookie","X-Powered-By":"Python Flask"},"status":200,"url":"http://127.0.0.1:5000/"}