sheltonshi/webvulnbench repository overview

⁠WebVulnBench

WebVulnBench is a Docker-backed benchmark collection of intentionally vulnerable web applications with known ground-truth vulnerabilities and verifiable PoCs. It is designed for evaluation of web fuzzers, vulnerability scanners, and LLM-based security agents.

This Docker Hub repository hosts the runnable benchmark images. Ground-truth metadata and PoCs are maintained on GitHub:

https://github.com/SheltonShi/WebVulnBench⁠

⁠Current Release

The current release contains the 10 original PHPBench target applications:

• 10 vulnerable PHP web applications
• 375 ground-truth vulnerabilities
• 375 verifiable PoCs
• Vulnerability types: XSS, SQL injection, and command injection

Tag format:

phpbench-<application>-v0.1.0

v0.1.0 is the WebVulnBench image maintenance version. It is not the upstream application version.

⁠Pull An Image

docker pull sheltonshi/webvulnbench:phpbench-wordpress-v0.1.0

Replace the tag with any target listed below.

⁠Available Images

⁠Ground Truth And PoCs

Docker Hub stores the images only. For benchmark metadata, vulnerability locations, request-level PoCs, and source references, use the GitHub repository:

PHP/
  manifest.json
  <application>/
    metadata.json
    pocs.json

Each metadata.json records the application name, Docker image tag, source repository, vulnerability counts, and PoC counts. Each pocs.json stores the request-level PoC metadata for the corresponding target.

⁠Intended Use

WebVulnBench is intended for controlled security evaluation workflows, including:

• black-box web vulnerability scanner evaluation,
• web fuzzer evaluation,
• LLM security agent evaluation,
• reproducible benchmark experiments.

⁠Roadmap

WebVulnBench will expand beyond the current PHPBench-derived PHP targets. Future releases are expected to increase coverage across:

• application language ecosystems, such as Java and Golang,
• vulnerability categories, such as broken access control,
• target scale, including more applications and more ground-truth vulnerabilities.

⁠Citation

@inproceedings{shi2026phpbench,
  title = {PHPBench: Automated Generation of Verifiable and Hierarchical Benchmarks for PHP Web Fuzzing},
  author = {Shi, Youkun and Zhang, Yuan and Zhang, Lei and Dai, Jiarun and Bai, Tianhao and Liu, Fengyu and Xiang, Bocheng and Luo, Xiapu and Yang, Min},
  booktitle = {Proceedings of the ACM Conference on Computer and Communications Security (ACM CCS 2026)},
  year = {2026}
}

⁠Safety Notice

These images intentionally contain known vulnerabilities. Do not expose them to the public internet or run them in production environments. Use isolated benchmark networks, disposable containers, and controlled test infrastructure.