Field mission · Level 7

Assess a real project on GitHub

These four projects are real code, built to be insecure on purpose so people can practise on them. Pick one, read it, and find three assets, three threats and three vulnerabilities — each with a link that proves it.

Read only. Find your proof in the code and the documents. Never test, scan or attack a live copy of any website. If you want to run one, run it on your own laptop, never on a public server.

juice-shop / juice-shop

A full online shop: customer accounts, orders and baskets, payment cards, product reviews.

Look in: the README (it calls itself insecure on purpose), package.json for old libraries, and SECURITY.md.

Open on GitHub ↗

digininja / DVWA

A small web app with a login page and a database. "Damn Vulnerable Web Application."

Look in: the README "Default Credentials" section, and config/config.inc.php.dist where the database password is written in the code.

Open on GitHub ↗

WebGoat / WebGoat

A teaching app with one lesson for every kind of flaw, maintained by OWASP.

Look in: the README (deliberately insecure), and each lesson folder, which names the flaw it teaches.

Open on GitHub ↗

OWASP / NodeGoat

A retirement-savings app that holds salaries, bank account details and user profiles.

Look in: the README (it prints the admin login), and config/env/all.js where the secret keys are written in the code.

Open on GitHub ↗
Where to look on any project
  1. README — what the app does and what data it holds. These are your assets. Watch for warnings and default logins.
  2. Data folders (models, data, schema) — the tables and fields it stores.
  3. Config files (config, .env examples) — a password or secret key in the code is a vulnerability.
  4. Dependency file (package.json, pom.xml, composer.json) — old libraries carry known flaws (CVEs).
  5. Security tab / Issues — what others have already reported.