Local only This shop is broken on purpose for scanner practice. Keep it on 127.0.0.1 — don't put it online.
Vulnshop. second-hand merch, first-hand mistakes

Customer account

Sign in

Fill:

Demo accounts

All five, in the clear

UsernamePasswordRole
adminadmin123admin
alicealice123customer
bobbob123customer
charliecharlie123customer
dianadiana123customer
Lab note: passwords are stored and compared as plaintext, the session cookie ships without Secure, HttpOnly or SameSite, and the signing key is the one printed in /.env — so the cookie can be forged offline.