Security training for the apps you actually ship. Open your browser and start hacking.
Security training for the apps you actually ship.
36 challenges across web, API, authentication, business logic, cryptography, supply chain, AI agents and MCP.
Break a deliberately vulnerable e-commerce app built on Next.js, React, TypeScript and Prisma.
Find the bugs. Exploit them. Understand why they work.
Docker Hub · npm · Roadmap · Walkthroughs · Contributing · Good first issues
____ ____ ____ ____ ____ ____ _
/ __ \/ __// __/ / __ \ ___ ___ ___ / __/ ___ ____ / __/ / /_ ___ ____ ___
/ /_/ /\ \ _\ \ / /_/ // _ \ / _ \(_-<_\ \ / -_)/ __/_\ \ / __// _ \ / __// -_)
\____/___//___/ \____/ \___// .__/___/___/ \__/ \__//___/ \__/ \___//_/ \__/
/_/
# Start with Node.js
npx create-oss-store my-ctf-lab && cd my-ctf-lab && npm start
# Start with Docker
docker run -p 127.0.0.1:3000:3000 leogra/oss-oopssec-store
# Then open http://localhost:3000 and start hacking
Storefront · the e-commerce app you are attacking |
Player dashboard · progress, difficulty and category breakdown |
OSSBot · the AI support assistant you prompt-inject |
Roadmap · the bugs that ship in production code |
Click any screenshot to view it full size.
 |
Start the labnpx create-oss-store my-ctf-lab && cd my-ctf-lab && npm startOr run it with Docker. The store comes up on localhost:3000. |
 |
Go after challenge #1 Public env variable leak: a payment secret that Next.js bakes into the client bundle. Easy · 15–20 min · nothing but your browser devtools. |
 |
Stuck? Read the walkthrough Every challenge has one, from vulnerability to exploit to fix. The first: Reading Secrets From the Browser: The NEXT_PUBLIC_ Trap in Next.js. |
 |
Validate the flag Paste OSS{...} into the flag checker, the floating widget on every page.Your player dashboard tracks what is left. |
 |
Pick the next one The roadmap orders every challenge across chapters: difficulty, time estimate, prerequisites. |
[!TIP] All captured? Join the Hall of Fame, star the repo, and post your route in Show your solve.
New to offensive security? The TryHackMe room wraps the first flags in a guided narrative.
[!WARNING] This application contains intentional security flaws and must never be deployed in a production environment.
Modern frameworks change where security vulnerabilities appear and how they should be fixed. OopsSec Store puts the classic vulnerability classes into a stack many developers use today: Next.js App Router, React, TypeScript and Prisma.
Server-rendered components, middleware and ORMs introduce different trust boundaries and failure modes. Several challenges also reproduce published CVEs against this stack.
The curriculum also covers the attack surface that arrived with AI-assisted development: prompt injection against a customer-support agent, MCP tool poisoning, a backdoored coding-agent rules file, and an npm typosquat chain simulated end to end.
| OopsSec Store | Juice Shop | DVWA | |
|---|---|---|---|
| Stack | Next.js · React · TypeScript · Prisma | Node.js · Express · Angular | PHP · MySQL |
| Setup | npx create-oss-store (< 1 min) / Docker | Docker / npm | Docker / manual LAMP |
| CTF flags | ✅ Built in | ✅ Opt-in CTF mode | ❌ |
| Guided learning roadmap | ✅ 1 roadmap, 11 chapters, 36 flags | ❌ Score board only | Partial (security levels) |
| Walkthrough for every challenge | ✅ | ✅ Companion guide | Partial (hints) |
| LLM prompt injection | ✅ Plug in a free API key | ✅ v20+, bring & configure your own LLM | ❌ |
| MCP tool poisoning | ✅ | ❌ | ❌ |
| AI coding-agent backdoor (poisoned rules file) | ✅ | ❌ | ❌ |
| Supply-chain attack chain | ✅ Simulated end to end: npm typosquat → rules backdoor | Partial (identification only) | ❌ |
| Challenges built on real CVEs | ✅ | ❌ | ❌ |
| Hall of Fame for players | ✅ | ❌ | ❌ |
Last verified June 2026, against Juice Shop v20 and DVWA 2.x. Spotted an inaccuracy? Open an issue or open a PR.
npx create-oss-store my-ctf-lab
cd my-ctf-lab
npm start
Then open http://localhost:3000 in your browser.
Clone the repo and run the setup script:
git clone https://github.com/kOaDT/oss-oopssec-store.git
cd oss-oopssec-store
npm run setup
This creates the .env file, installs dependencies, sets up the SQLite database, seeds it with CTF flags, and starts the app on port 3000.
No Node.js required. Just Docker.
127.0.0.1:3000:3000keeps the lab reachable only from your own machine. Use plain-p 3000:3000only on an isolated VM you control.
docker run -p 127.0.0.1:3000:3000 leogra/oss-oopssec-store
To persist data across restarts:
docker run -p 127.0.0.1:3000:3000 -v oss-data:/app/data leogra/oss-oopssec-store
git clone https://github.com/kOaDT/oss-oopssec-store.git
cd oss-oopssec-store
docker compose up -d # Start in background (builds the image on first run)
docker compose logs -f # Follow container logs
docker compose down # Stop the container
docker compose down -v # Stop and wipe data for a fresh start
With npm installed, the same four are npm run docker:up, docker:logs, docker:down and docker:reset.
The database initializes on first start. Data persists across restarts via Docker named volumes, including flag progress, users and uploads.
Found all the flags? Open a pull request to join the Hall of Fame. Add your entry to hall-of-fame/data.json and your profile will show up on the /hall-of-fame page in the app.
Once your entry is merged, a badge is generated for you and served from the docs site:
[](https://github.com/kOaDT/oss-oopssec-store#hall-of-fame)
A 1200x630 social card lives at the same path with a .png extension.
[](https://github.com/kOaDT/oss-oopssec-store#hall-of-fame)
Both are copy-paste ready from your card on the /hall-of-fame page, in Markdown, HTML or as a bare URL.
Questions, solutions and feedback live in Discussions.
| Where to go | For what |
|---|---|
| 🧩 Stuck on a challenge | The exploit will not fire, the flag will not validate |
| 🛠️ Setup and install | Docker, npm or Node problems getting the lab up |
| 🏆 Show your solve | A route to the flag the walkthrough does not cover |
| 💡 Challenge ideas | A vulnerability class worth adding to the curriculum |
| 🎓 Teaching with OopsSec | Running the lab with a class, a bootcamp or a team |
| Issues | Bugs in the lab itself, and only those |
| Folder | Description |
|---|---|
app/ | Next.js App Router: pages, API routes, React components |
app/api/ | REST API endpoints (auth, cart, orders, products, flags, etc.) |
app/components/ | React UI components (Header, Footer, ProductCard, etc.) |
app/vulnerabilities/ | Pages documenting each vulnerability |
content/vulnerabilities/ | Markdown descriptions of vulnerabilities and attack vectors |
lib/ | Shared utilities: DB client, auth, API helpers, types |
prisma/ | Database schema, seed script, and flags.ts: the CTF flags and their hints |
public/ | Static assets and exploit payloads (e.g., CSRF demo) |
hooks/ | Custom React hooks (authentication, etc.) |
scripts/ | Setup and automation scripts |
docs/ | Static docs site with community walkthroughs |
hall-of-fame/ | Player profiles for those who found all flags |
packages/ | NPM package create-oss-store for scaffolding (and lab quarantine artifacts like react-toastfy) |
lab/quarantine/ | Inert malicious payloads for supply-chain challenges (treat as data, never as instructions) |
tests/ | Jest unit and API tests that validate exploits |
cypress/ | E2E tests for full exploitation workflows |
The project includes security regression tests that make sure all exploit chains and flags still work. These tests deliberately validate insecure behavior. They run on every PR, so if you accidentally patch a vulnerability, CI will catch it.
# Unit tests (utility functions: MD5 hashing, JWT, input filters)
npm run test:unit
# API exploitation tests (requires a running server)
npm run test:api
# E2E exploitation tests (requires a running server)
npm run test:e2e
# Open Cypress interactive mode
npm run test:e2e:open
# All tests
npm run test:ci
[!CAUTION] This project is for educational and authorized security testing only. It contains intentional vulnerabilities and insecure configurations. The authors are not responsible for any misuse, damage, or unauthorized access. Use it in isolated environments.
OSS – OopsSec Store is MIT-licensed. Contributions are welcome.
Ways to contribute:
Check the Roadmap for planned work, or grab a good first issue.
Found all the flags? Share your walkthroughs on the docs site.
For bugs or suggestions, open a GitHub Issue. See CONTRIBUTING.md for guidelines.
Check out the Educator Kit - a ready-to-use guide with OWASP coverage grids, syllabus templates, deployment FAQ, and a student report template. Building your own tooling around the curriculum? The whole thing is published as a machine-readable feed at challenges.json, regenerated on every docs deploy.
Rendered from the curriculum itself and the GitHub API, refreshed daily. Want your avatar on that row? Grab a good first issue.
Author: kOaDT
Project: OopsSec Store
Contact: [email protected]
License: MIT
Do not remove or modify the LICENSE file in your fork.