trapdoorsec/dvwapi repository overview

⁠DVWAPI - Damn Vulnerable Web API

⚠️ INTENTIONALLY VULNERABLE - FOR SECURITY TESTING ONLY ⚠️

A deliberately insecure REST API built in Rust for learning and practicing API security testing. Perfect for training, CTFs, and testing security tools.

⁠Quick Start

docker pull trapdoorsec/dvwapi:latest
docker run -d -p 7341:7341 trapdoorsec/dvwapi

API available at http://localhost:7341

⁠What's Included

3 API versions with different response formats, each containing:

⁠Vulnerabilities

• 🔓 Missing authentication on sensitive endpoints
• 🔑 Hardcoded secrets & credentials exposure
• 💉 Command injection via path/query parameters
• 📊 GraphQL introspection + secrets disclosure
• ⚙️ Spring Boot Actuator misconfiguration
• 🛑 Unauthenticated shutdown endpoint
• 📁 Environment variable dumps
• 🧠 Simulated heap dumps with sensitive data

⁠Use Cases

• 🎯 API fuzzer development & testing
• 🎓 Security training & education
• 🏴 CTF challenges
• 🔍 Penetration testing practice
• 🛠️ Security tool validation

⁠Configuration

# Custom port and debug logging
docker run -d -p 8080:8080 trapdoorsec/dvwapi --port 8080 --log-level debug

# All options
--ip <IP>           # Bind address (default: 0.0.0.0)
--port <PORT>       # Port (default: 7341)
--log-level <LEVEL> # trace|debug|info|warn|error
--colored <BOOL>    # Colored output (default: true)

⁠Links

• 📦 GitHub: github.com/trapdoorsec/DVWAPI⁠
• 📖 Docs: See GitHub README for full endpoint documentation
• 🐛 Issues: Report bugs⁠

⁠Tags

• latest - Most recent stable release
• 0.1.0 - Specific versions (semver)

⁠⚠️ Security Warning

DO NOT deploy on public networks or production systems. This application is intentionally vulnerable and will compromise your host if exposed to the internet.

License: AGPL-3.0 | Built with: Rust + Axum