Practice range. VulnShop breaks on purpose so scanners have something to find. Keep it on 127.0.0.1 — never put it on the internet.
Vulnshop. Merch for people who read the source

Customer account

Sign in

Fill:

Demo accounts

All five, in the clear

UsernamePasswordRole
adminadmin123admin
alicealice123customer
bobbob123customer
charliecharlie123customer
dianadiana123customer
Lab note: passwords are stored and compared as plaintext, the session cookie ships without Secure, HttpOnly or SameSite, and the signing key is the one printed in /.env — so the cookie can be forged offline.