Shop floor · open · no code review

Everything here is for sale. Including the flaws.

12 pieces of security merch, sold by a storefront that trusts every input it is handed. The back room has every deliberate defect laid out with a form to reproduce it — no README required.

Browse the shop Open the security lab

On the shelf

See all 12 products →

VS-001 VulnShop T-Shirt Classic cotton tee with VulnShop logo $19.99 View →

VS-002 Hacker Hoodie Comfortable hoodie for late-night coding $44.99 View →

VS-003 SQL Injection Mug Ceramic mug with classic payload $12.99 View →

VS-004 XSS Sticker Pack 5 vinyl stickers for your laptop $7.99 View →

VS-005 Buffer Overflow Beanie Keeps your stack warm $22.99 View →

VS-006 RCE Tote Bag Carry your exploits in style $15.99 View →

VS-007 IDOR Keychain Access any order with this key $5.99 View →

VS-008 XXE XML Parser Parses external entities for you $29.99 View →

The security lab

Open the lab with working forms →

Each card is a real weakness in this app, reachable from the URL shown. Nothing here is simulated — the shop genuinely runs the input you give it.

GET

SQL Injection

The q parameter is concatenated into SQL with no binding.

/search?q=shirt

GET

Reflected XSS + SSTI

User input rendered with Jinja2 without escaping.

/greet?name=guest

GET

Command Injection

Host parameter passed to shell ping command.

/api/ping?host=127.0.0.1

GET

Path Traversal

File parameter not sanitized for .. sequences.

/download?file=readme.txt

GET

Open Redirect

URL parameter passed directly to redirect().

/redirect?url=/

GET

IDOR

Order endpoint returns any order by id, no ownership check.

/api/orders/1

POST

XXE (XML External Entity)

XML parser accepts external entity declarations.

/api/import

Sign in with admin / admin123 — the same credentials sitting in /.env and stored unhashed in the users table. Placing an order gives you a receipt at /api/orders/<id>, which never checks whose order it is.