DynAST-Bench

A DAST benchmark of intentionally-vulnerable apps with ground-truth answer keys for scoring scanners.

⚠️ This repository contains DELIBERATELY INSECURE applications. They exist only to benchmark security tooling - DAST scanners, SAST engines, and LLM security agents. Every app binds to 127.0.0.1, ships a LOUD banner, and holds no real data. Never deploy any of this on a public network.

A suite of 19 intentionally-vulnerable apps, one per stack, each with a documented, machine-checkable ground truth. The point is to measure how well a scanner or agent (a) finds the planted bugs, (b) ignores the safe near-miss code sitting right next to them, and (c) doesn't hallucinate findings on the patched twin.

The apps at a glance

19 apps · 549 planted vulnerabilities · 146 near-misses · 546 runnable PoCs · 594 cataloged endpoints. Every app boots on 127.0.0.1:13311, ships a vuln/+safe/ twin pair and a single-image --solo build. dynast-bench list prints this table live; dynast-bench surface <app> prints its endpoint catalog.

App	Stack	Datastore	Vulns	Near-miss	Docs
aspnet	C# / ASP.NET Core Razor Pages	SQL Server	28	12	plan
fastapi	Python / FastAPI + Jinja2	Postgres	26	5	plan
gin	Go / Gin	Postgres	12	7	readme
golang	Go / chi	Postgres	26	4	plan
graphql	Node / GraphQL 16 API-only	Postgres	31	6	plan
jsp	Java / JSP + Servlets (Tomcat)	Postgres	28	6	plan
laravel	PHP 8.3 / Laravel 11 + Blade	MySQL	25	7	plan
llmagent	Node / Fastify + AI SDK + MCP	Postgres	29	8	plan
llmchat	Python / FastAPI + LangChain RAG	Postgres+pgvector	30	9	plan
nestjs	Node / NestJS + Handlebars	Postgres	23	6	plan
network	Simulated multi-host network range	mixed fleet	32	5	plan
nextjs	Node / Next.js 15 (reference impl)	Postgres	35	15	plan
php	PHP / procedural LAMP	MySQL	21	5	plan
rails	Ruby / Rails 7.2	Postgres	26	6	plan
springboot	Java / Spring Boot + Thymeleaf	Postgres	30	4	plan
swagger	OpenAPI / Swagger UI + spec loading	Postgres	19	5	plan
websocket	Node 22 / ws + Socket.IO realtime	Postgres	28	6	plan
weirdproxy	nginx + Apache + Traefik over one origin	none	16	4	plan
wordpress	PHP / WordPress + custom plugin	MySQL	28	6	plan

Extra sidecars per stack (Mailpit, MinIO, Redis, Jenkins, Prometheus, Ollama, …) are listed in The apps below.

The per-stack design docs live in benchmark-plans/ - start there for the full vulnerability catalog of each app. This README is the operational guide: how the repo is laid out and how to run and score an app.

Vulnerability classes covered

Every planted bug carries a CWE and an OWASP category. Rolled up by class - each bug counted once, under its primary CWE - the planted bugs break down roughly as (rollup last regenerated at 480 bugs; per-app counts above are current):