DonkAI

Hands-on lab for the OWASP Top 10 for LLM Applications (2025) - no real LLM required.

DonkAI is deliberately vulnerable web app you can run in one command and use to learn how LLM-integrated systems get broken by actually breaking them. Every OWASP LLM Top 10 category is represented by at least one playable challenge, with a written brief, a payload editor, an active defense to bypass, progressive hints, and a per-user history of every attempt. More than a fixed set of exercises, it's an extensible teaching lab: the modular architecture (one file per category, backend and frontend) makes it straightforward to add new vulnerabilities, harden existing defenses, or build entirely new tracks for workshops, courses, and CTFs.

Warning this application intentionally exposes live attack surfaces (prompt injection, IDOR, SQL injection, hard-coded credentials, and more). It must be run only in an isolated lab environment, preferably inside a dedicated virtual machine, and must never be deployed on the open internet.

Why this exists

The OWASP Top 10 for LLM Applications maps out the risks and gives the vocabulary for talking about them, essential reading for anyone working on LLM security. DonkAI is designed as a hands-on extension of that work: a small, deterministic playground where you try the attacks yourself, see them succeed against a fake-but-realistic chatbot, and read a debrief explaining what just worked and how a real system would defend against it. There is no real LLM behind the curtain, the whole stack is rule-based, so the lab is cheap, offline-friendly, and reproducible.

Quick Start

Clone, build, and launch the full stack with two commands:

git clone https://github.com/OWASP/DonkAI.git && cd DonkAI
docker compose up --build

Then open http://localhost:3000, sign in with alice / password123, and pick your first challenge from the OWASP panel on the left.

Services

Default Accounts

Tip — to wipe all state (users, sessions, attempt history) and start from a clean slate:

root@kitploit:~

docker compose down -v

OWASP LLM Top 10 Coverage

Every category in the OWASP LLM Top 10 is represented by at least one playable challenge.

To add or modify categories and challenges, see Extending challenges.

Architecture

   ┌──────────────────┐      ┌──────────────────┐      ┌────────────────┐
   │   React SPA      │ ───► │     FastAPI      │ ───► │   PostgreSQL   │
   │   :3000          │      │     :8000        │      │     :5432      │
   │   webapp/        │      │   ml-service/    │      │   database/    │
   └──────────────────┘      └──────────────────┘      └────────────────┘

Disclaimer

This application is intentionally vulnerable. The defaults (passwords, database credentials, hard-coded secrets in system prompts) are part of the educational content, not security oversights. Run locally or in an isolated lab, never on a shared host or the public internet, and never against real production data.

Only apply techniques you learn here against systems you own or have explicit written permission to test.