A FreeFungi vulnerable app
SourCode
Sweets with a bite.
A deliberately vulnerable sweet shop with the security of a corner-shop till
drawer. Fifteen planted flaws, one docker run, and a written
walkthrough for every single one.
Nothing in the code is labelled, so the flaws have to be found, not read off a cheat sheet. And it is small enough that you actually finish it.
docker run -d --name SourCode -p 3000:3000 ghcr.io/bad-adventure/freefungi How it works
Run it, then break it your way
- 1
Run the shop
One
docker runand the sweet shop opens on your own machine atlocalhost:3000. Fresh, self-contained, nothing to configure. - 2
Break it your way
Would rather hunt the flaws down yourself? Point your tools at it, manual or automated, with no hints in the code. Prefer a guided path? Work through the exercises instead.
- 3
Learn how
Every flaw has a walkthrough that shows the exploit from first poke to fix, in plain English. Come here to learn, or to check your work.
Why bother with another one
Finishable
Fifteen flaws, not a hundred. One good evening and you've cleared the lot, with every fix written up properly instead of buried behind a hint wall.
No cheat sheet in the code
The app carries no list of its own flaws, so you have to find them for real, whatever your tools. Score your results against a held-back answer key.
Write-ups on the site
Stuck, or want to check your work? Every exercise has a full walkthrough here, from first blood to the fix. The code stays clue-free.
The pick ’n’ mix
Work your way along the counter
Rated by how chewy they are. Start on the gobstoppers. You won't need a single tool you haven't already got open.
Pick 'n' Mix🔑
The search box builds its SQL by gluing strings together. Glue something else on.
Unlocks the whole customer table and the admin hash, which opens the staff areas and hands you accounts for the logged-in attacks.
Read the walkthrough →Sticky Label
Whatever you searched for comes back on the page, exactly as you typed it.
Read the walkthrough →The Staff Room
The back office is locked. The export sitting next to it is not.
Read the walkthrough →Sour Token
The shop signs your session. It also believes you when you say it did not.
Read the walkthrough →Someone Else's Order
Your order is number 4. Nobody checked whether number 2 is yours.
Read the walkthrough →Half Price Humbugs
The browser tells the server what a bag of humbugs costs. Be generous to yourself.
Read the walkthrough →For the tool builders
No cheat sheet in the code
The app ships with no list of its own flaws. No labels, no manifest, no solutions in the repo. So the flaws have to be found for real, and a good score reflects the work rather than an answer key leaking out of the source.
The answer key is held back. Run your tool against the shop, then score the findings against it: found, missed, or false positive. The write-ups live here on the site for when you want to check your work.
How the scoring works// held-back answer key, one per flaw
{
"id": "FF-001",
"cwe": "CWE-89",
"endpoint": "GET /api/sweets/search",
"parameter": "q",
"proof": "' UNION SELECT
email,password_hash
FROM customers-- "
}Read this bit
SourCode is broken on purpose. It sticks to localhost by default and
won't boot on a public cloud box without you forcing it. Handy, but they're
seatbelts, not a hall pass.
Never run it on a real network, next to real data, or on anything you don't own. Test only what you're allowed to test.