Web application penetration testing lab — vulnerable Flask app, automated scanner, and professional pentest report. Covers OWASP Top 10, SQLi, XSS, command injection, file upload, and more.
git clone https://github.com/Sarthak4126/Web-App-PenTesting.git
cd Web-App-PenTesting/target_app
pip install -r requirements.txt
python app.py
App runs at: http://127.0.0.1:5000
cd ../security_audit_tools
python run_audit.py
Outputs structured findings to audit_results.json.
reports/PENETRATION_TESTING_REPORT.html in a browser → click "Print / Export to PDF"reports/PENETRATION_TESTING_REPORT.md for full CVSS 3.1, CWE mappings, and remediation diffs| Task | Target Component | Finding | CVSS v3.1 |
|---|---|---|---|
| Reconnaissance | Headers, /robots.txt | Server banner & sensitive path disclosure | 5.3 |
| Directory Enumeration | /backup, /admin, /api/v1/users | Exposed backup directory & unauthenticated API | 7.5–8.6 |
| Authentication Testing | POST /login | SQLi auth bypass (admin' --) & no rate limiting | 9.8 Critical |
| SQL Injection | /products?category= | UNION SQLi & error-based credential extraction | 9.8 Critical |
| Cross-Site Scripting | /search, /feedback | Reflected XSS & Stored XSS | 7.2–7.5 |
| File Upload Testing | POST /upload_avatar | Unrestricted upload — no MIME/extension validation | 8.8 High |
| Command Injection | POST /network_tools | Remote OS command execution via unsanitized ping | 9.8 Critical |
| Reporting | reports/ | Professional pentest report (Markdown & HTML/PDF) | ✅ |
Click "Switch to Remediated Mode" in the nav banner or visit /toggle_mode.
| Vulnerability | Patch Applied |
|---|---|
| Command Injection | shell=False + strict IP validation |
| SQL Injection | Parameterized prepared statements |
| XSS | HTML autoescaping + Content-Security-Policy |
| File Upload | Extension whitelist + UUID randomized filenames |
| Broken Access Control | Role-based session authorization (RBAC) |
Kali Linux · Burp Suite · Nmap · Gobuster · SQLMap · Python · Flask · SQLite
OWASP Top 10 (2021) · NIST SP 800-115 · PTES · CVSS v3.1 · CWE