VulnLab

A deliberately insecure web application, published as a practice target for the CyberaHAT security scanner. Every weakness below is planted on purpose so that nmap, nuclei, nikto, ffuf, whatweb, ZAP and sqlmap all have something real to find.

Search the product catalogue

This endpoint concatenates your input straight into an SQL query and echoes it back unescaped. See also the product lookup: /product.php?id=1 — an integer-context injection point.

What a scanner should find here

Injection

Error-based and boolean SQL injection on /search.php?q=, plus reflected XSS in the same parameter.

Exposed files

A readable .git directory, a committed .env, and a database dump left in the web root.

Missing headers

No CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy or Permissions-Policy.

Information disclosure

A public phpinfo.php, verbose server banners, and directory listing enabled on uploads.

Broken access control

An admin panel reachable without authentication and an API that returns user records to anyone.

Open redirect

/redirect.php?url= forwards to any host supplied in the query string.

Planted paths

Deliberately out of scope

This target does not implement command injection, file upload, local file inclusion or any other path to code execution. It is reachable from the public internet, and a genuine RCE here would be a foothold on real infrastructure rather than a lesson. The weaknesses above are detectable and explainable without that risk.