[{"_1":2,"_179":-5,"_180":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_158":159},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_89":90,"_111":112,"_149":-5,"_150":11,"_151":21,"_152":11,"_153":-5,"_154":11,"_155":-5,"_156":157},"canonicalUrl","https://hub.docker.com/r/aasaam/vulnerable-application/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","aasaam","reponame","vulnerable-application","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":73,"_74":75,"_80":11,"_81":82,"_86":33,"_87":88},"categories",[],"content_types",[44],"image","date_registered","2022-01-24T02:35:42.305291Z","description","","is_private","last_updated","2022-01-24T10:42:18.615201Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",296,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","

\n Vulnerable Application\n

\n Vulnerable application is test case study for check protection mechanism.\n

\n $\"build\"$ \n $\"docker\"$ \n

\n\nThis is the simple vulnerable application for testing using [sqlmap](https://github.com/sqlmapproject/sqlmap), [XSStrike](https://github.com/s0md3v/XSStrike), [testssl.sh](https://github.com/drwetter/testssl.sh) for testing the Web server, TLS, WAF rules, protection and etc...\n\nIt's use [aasaam web-server](https://github.com/aasaam/web-server) for edge waf/reverse/proxy/ssl off loader.\n\n## Run\n\n```bash\ngit clone --depth 1 https://github.com/aasaam/vulnerable-application\ncd vulnerable-application\ndocker-compose up -d\n# wait for all databases to be ready\n```\n\nYou can see app run in browser\n\n* `http://localhost:10800` Normal application\n* `http://localhost:10801` Behind aasaam web-server WAF activated\n* `https://localhost:10802` Behind aasaam web-server WAF and SSL/TLS activated\n\n## SQL Injection check\n\n```bash\ngit clone --depth 1 https://github.com/sqlmapproject/sqlmap.git tmp/sqlmap-dev\ncd tmp/sqlmap-dev\n# remove old tests result\nrm ~/.local/share/sqlmap -rf\n# no waf\n./sqlmap.py -u 'http://localhost:10800/show.php?id=1&type=bXlzcWw=&title=DevOps+is+important'\n# with waf\n./sqlmap.py -u 'http://localhost:10801/show.php?id=1&type=bXlzcWw=&title=DevOps+is+important'\n```\n\n## XSS Check\n\n```bash\ngit clone --depth 1 https://github.com/s0md3v/XSStrike.git tmp/XSStrike\ncd tmp/XSStrike\n# no waf\npython3 xsstrike.py --fuzzer --blind -u 'http://localhost:10800/show.php?id=1&type=bXlzcWw=&title=DevOps+is+important'\n# with waf\npython3 xsstrike.py --fuzzer --blind -u 'http://localhost:10801/show.php?id=1&type=bXlzcWw=&title=DevOps+is+important'\n```\n\n## Test SSL/TLS\n\n```bash\ngit clone --depth 1 https://github.com/drwetter/testssl.sh tmp/testssl.sh\ncp addon/ssl/ca.pem tmp/testssl.sh/ca.pem\ncd tmp/testssl.sh\n./testssl.sh --add-ca ca.pem 'https://localhost:10802'\n```\n\n## Benchmark\n\n```bash\nmkdir -p tmp/cassowary\ncp addon/ssl/ca.pem tmp/cassowary/ca.pem\ncd tmp/cassowary\nwget -O cassowary.tgz https://github.com/rogerwelin/cassowary/releases/download/v0.11.0/cassowary_0.11.0_Linux_x86_64.tar.gz\ntar -xf cassowary.tgz\n./cassowary run --ca ca.pem -c 100 -n 10000 -u 'https://localhost:10802/benchmark/upstream'\n./cassowary run --ca ca.pem -c 100 -n 10000 -u 'https://localhost:10802/benchmark/webserver'\n```\n\n

\n \n $\"aasaam$ \n \n
\n aasaam software development group\n

\n","has_starred","hub_user","mhfdotir","immutable_tags_settings",{"_76":11,"_77":78},"enabled","rules",[79],".*","is_automated","permissions",{"_83":21,"_84":11,"_85":11},"read","write","admin","user","storage_size",345481023,"orgData",{"_91":92,"_93":94,"_95":96,"_97":33,"_98":99,"_100":48,"_101":33,"_102":103,"_104":105,"_106":107,"_108":48,"_109":48,"_110":21},"id","4b8bab39fbf743b1bb00cb348a85a96a","uuid","4b8bab39-fbf7-43b1-bb00-cb348a85a96a","type","organization","orgname","full_name","aasaam software development group","location","company","profile_url","https://aasaam.com","date_joined","2020-07-03T08:21:52.143021Z","gravatar_url","https://www.gravatar.com/avatar/0505c1e98822afb9a5e06abb4bc1a28f?s=80&r=g&d=mm","gravatar_email","badge","is_active","recentTags",[113],{"_114":44,"_115":116,"_117":118,"_91":119,"_120":121,"_50":138,"_139":116,"_140":73,"_141":56,"_57":142,"_143":144,"_145":129,"_146":138,"_147":66,"_148":21},"content_type","creator",418697,"full_size",185712052,188601423,"images",[122],{"_123":124,"_125":126,"_127":48,"_128":129,"_130":131,"_132":133,"_134":48,"_135":-5,"_136":118,"_63":66,"_137":-5},"architecture","amd64","digest","sha256:565534b6700f8403aabdfffbc3c9b230da5dc807033fdfe3b3ca3c20f6a69af5","features","last_pulled","2026-09-30T20:37:03.149278004Z","last_pushed","2022-01-24T10:42:19Z","os","linux","os_features","os_version","size","variant","2022-01-24T10:42:18.270224Z","last_updater","last_updater_username","media_type","latest","repository",16307026,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_38":160,"_167":168,"_156":177,"_178":11},{"_40":161,"_42":162,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":163,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":73,"_74":164,"_80":11,"_81":166,"_86":33,"_87":88},[],[44],[56],{"_76":11,"_77":165},[79],{"_83":21,"_84":11,"_85":11},"tags",{"_169":64,"_170":-5,"_171":-5,"_172":173},"count","next","previous","results",[174],{"_114":44,"_115":116,"_117":118,"_91":119,"_120":175,"_50":138,"_139":116,"_140":73,"_141":56,"_57":142,"_143":144,"_145":129,"_146":138,"_147":66,"_148":21},[176],{"_123":124,"_125":126,"_127":48,"_128":129,"_130":131,"_132":133,"_134":48,"_135":-5,"_136":118,"_63":66,"_137":-5},[],"canDeleteTags","actionData","errors"]

aasaam/vulnerable-application

Tags for aasaam/vulnerable-application