A deliberately insecure web application, published as a practice target for the CyberaHAT security scanner. Every weakness below is planted on purpose so that nmap, nuclei, nikto, ffuf, whatweb, ZAP and sqlmap all have something real to find.
This endpoint concatenates your input straight into an SQL query and echoes it back unescaped.
See also the product lookup: /product.php?id=1
— an integer-context injection point.
Error-based and boolean SQL injection on /search.php?q=, plus reflected XSS in the same parameter.
A readable .git directory, a committed .env, and a database dump left in the web root.
No CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy or Permissions-Policy.
A public phpinfo.php, verbose server banners, and directory listing enabled on uploads.
An admin panel reachable without authentication and an API that returns user records to anyone.
/redirect.php?url= forwards to any host supplied in the query string.
*This target does not implement command injection, file upload, local file inclusion or any other path to code execution. It is reachable from the public internet, and a genuine RCE here would be a foothold on real infrastructure rather than a lesson. The weaknesses above are detectable and explainable without that risk.