doretox/atomicvulnsAtomic web vulnerability labs. One OWASP flaw per app — minimal Flask + Docker, intentionally broken for hands-on study with Burp Suite.
⚠️ Intentionally vulnerable. Run locally only. Never expose to the internet or a shared network.
Read this in other languages: Português (Brasil)
Milestone — v1.0: the web series now covers all ten OWASP Top 10 2021 categories (A01–A10), across 38 atoms. See the v1.0 release.
atomicvulns is a collection of atomic web applications — each one tiny, isolated, and focused on a single vulnerability from the OWASP Top 10. Every atom ships with the vulnerable app, the fixed version, a commented diff between the two, and a hands-on walkthrough of the exploit.
This is not another DVWA or Juice Shop. Monolithic vulnerable apps already exist. What sets atomicvulns apart is radical atomism: one app per flaw, fast to read, fast to explore. You map code cause → request/response → exploit without having to understand an entire application first.
The web series (Python/Flask) covers all ten OWASP Top 10 2021 categories — 38 atoms in total:
| Category | Atoms |
|---|---|
| A01 — Broken Access Control | idor-numeric-id, path-traversal-basic, idor-uuid-guessable, bola-rest, csrf-basic, open-redirect, mass-assignment |
| A02 — Cryptographic Failures | jwt-none-alg, jwt-weak-secret, jwt-key-confusion, crypto-weak-hash, crypto-ecb-mode |
| A03 — Injection | sqli-union-basic, xss-reflected, sqli-blind-boolean, sqli-blind-time, xss-stored, command-injection-basic, ssti-jinja, xss-dom, nosql-injection-mongo, ldap-injection, sqli-second-order |
| A04 — Insecure Design | race-condition-basic |
| A05 — Security Misconfiguration | xxe-basic, xxe-blind-oob, debug-enabled, cors-wildcard |
| A06 — Vulnerable and Outdated Components | cve-demo |
| A07 — Identification and Authentication Failures | session-fixation, weak-password-reset |
| A08 — Software and Data Integrity Failures | deserialization-pickle, prototype-pollution, deserialization-node |
| A09 — Security Logging and Monitoring Failures | logging-failures-demo |
| A10 — Server-Side Request Forgery (SSRF) | ssrf-basic, ssrf-blind-oob, ssrf-cloud-metadata |
The API series (TypeScript/Express) targets the OWASP API Security Top 10 2023. Its first phase — Authorization: Object & Function — is published: five atoms across two categories, closing the object-level and function-level authorization axes. The full ordered plan lives in its ROADMAP.
| Category | Atoms |
|---|---|
| API1 — Broken Object Level Authorization | bola-sequential-id, bola-uuid-leaked, bola-nested-resource |
| API5 — Broken Function Level Authorization | bfla-admin-function, bfla-method-based |
Pentest students and AppSec learners who already know the basics of HTTP and the terminal, use (or are learning to use) Burp Suite, and want a focused lab where each exercise is short enough to finish in one sitting. The material is written for someone who will apply this in a pentest career — Burp is the primary tool, the UI is just context.
Each atom lives in its own folder — atoms/web/A0X-<category>/<atom-id>/ for the web series, atoms/api/APIX-<category>/<atom-id>/ for the API series — and ships with a docker-compose.yml. A root wrapper script, ./atom, drives them:
./atom list # show all available atoms
./atom up <atom-id> # start the vulnerable + fixed pair
./atom down <atom-id> # stop and remove containers
./atom doctor # sanity-check your local setup
For example:
./atom up sqli-union-basic # web series
# vulnerable → http://127.0.0.1:8001
# fixed → http://127.0.0.1:8101
./atom up bola-sequential-id # API series
# vulnerable → http://127.0.0.1:8201
# fixed → http://127.0.0.1:8301
Every atom binds to 127.0.0.1 only. Never change that — these apps are intentionally broken.
Released under the MIT License. If you fork this repository for educational material, attribution is required.