This repository is an intentional collection of security flaws, bad practices, and common vulnerabilities in web applications.
- Learn how to identify security vulnerabilities
- Understand how hackers exploit these flaws
- Train developers in security best practices
- Test security scanning tools (SAST, DAST, etc.)
❌ DO NOT USE THIS CODE IN PRODUCTION!
AWS_SECRET_KEY = "AKIAIMNO78987EXAMPLE"
DATABASE_PASSWORD = "super_secret_password_123!"Risk : Attackers can access external services. Best Practice : Use environment variables or a secrets manager.
os.system("echo " + user_data)Risk : An attacker can execute arbitrary commands. Exploitation Payload :
?data=; rm -rf /
?data=; cat /etc/passwd
Best Practice : Use subprocess with shell=False or avoid shell commands.
cursor.execute(f"SELECT * FROM users WHERE id = '{user_data}'")Risk : Database manipulation or data exfiltration. Exploitation Payload :
?data=' OR '1'='1
?data=' UNION SELECT * FROM admin--
Best Practice : Use parameterized queries (prepared statements).
raw_pickle = base64.b64decode(user_data)
decoded_data = pickle.loads(raw_pickle)Risk : Arbitrary code execution via pickle.
Best Practice : Use json instead of pickle or strictly validate data.
app.run(debug=True)Risk : Exposure of stack traces, sensitive information, and access to interactive debugger.
Best Practice : Disable debug in production (debug=False).
.
├── README.md # This file
├── SECURITY_FIXES.md # Solutions and best practices
├── CODE_OF_CONDUCT.md # Responsible use policy
├── QUICKSTART.md # Installation & quick start guide
├── Dockerfile # Docker configuration
├── docker-compose.yml # Setup for local testing
├── .env.example # Environment variables template
├── .gitignore # Files to ignore
├── python/
│ ├── main.py # Intentionally vulnerable code
│ └── requirements.txt # Python dependencies
└── tests/ # Exploitation tests (future)
└── test_vulnerabilities.py
-
Cybersecurity Training
- Understand OWASP Top 10 vulnerabilities
- Learn exploitation and mitigations
-
Security Testing (Pentesting)
- Verify security scanning tools (SAST/DAST)
- Validate detection rules
-
Security Development
- Benchmark security linting rules
- Test security frameworks
- Deploy this code in production
- Use for attacking other systems
- Ignore security warnings
- Python 3.8+
- pip or poetry
git clone https://github.com/username/security-vulnerabilities.git
cd security-vulnerabilities
pip install -r python/requirements.txtpython python/main.pyThe app starts on http://localhost:5000
curl "http://localhost:5000/vulnerable-action?data=' OR '1'='1"curl "http://localhost:5000/vulnerable-action?data=;whoami"This project is under the MIT License. However, use it responsibly.
The authors of this repository are not responsible for damages caused by malicious or irresponsible use of this code.
This tool is reserved for education and authorized security testing in a controlled environment.
Contributions to add new documented vulnerabilities are welcome! 🎓
Last updated : January 2026