Get started

Open the shop

Two ways in. Docker on your own machine, or a throwaway sandbox in the browser.

Option A · Docker

The fastest route. Nothing to clone, nothing to build.

One command

docker run -p 3000:3000 ghcr.io/bad-adventure/freefungi

Then open http://localhost:3000. The shop seeds itself on boot with a catalogue of sweets and a set of obviously fake customers.

Option B · From source

If you want to read the code as you go, which is rather the point:

git clone https://github.com/bad-adventure/freefungi
cd freefungi
npm install
npm start

Node 20 or newer. Read the source as you go if you like: it is a realistic codebase with no flaws labelled and no answer key inside, so you have to find things yourself.

Option C · In the browser

No local setup at all. Spin up a Codespace and the shop runs in a sandbox that’s nobody’s problem but the platform’s.

Open on GitHub →

What you need

A browser, plus a way to send raw HTTP. Burp, curl or the dev tools console all do the job.
Docker or Node 20+, depending on the route above.
Nothing else. No target list, no scope form, no VPN.

Accounts

Some of the app sits behind a login. For grey-box testing there are two ready-made customer accounts:

Email	Password
`alice@example.com`	`Password123!`
`bob@example.com`	`Hunter2day!`

Or register your own at /register, as many as you like. Two accounts is often all you need to start poking at what one user can do to another’s data. There is an administrator too, but that password is not handed out. Earning it is one of the exercises.

Before you run it

FreeFungi is deliberately vulnerable. It binds to localhost by default and refuses to start on a public cloud instance without an override flag, but treat those as reminders, not guarantees.

Never expose it to a network, run it beside real data, or point it at anything you are not authorised to test.

Where next

Start with the Pick ’n’ Mix SQL injection. First blood takes about five minutes, then work along the counter.