The family
13 deliberately vulnerable applications, in the order to meet them. The order is attack surface: each band models more than the last, so each one can go wrong in ways the last could not.
Only the first has anything to work yet. The rest are declared here rather than hidden, because the progression is the point and it is easier to judge a lab you can see the shape of.
Low
The smallest surfaces: a single application and a single database.
-
1
Insecurity BBS Ready
A bulletin board.
One board, one database, a handful of forms. The smallest surface in the family, and the place to start.
Board
bbs.insecurity.cc· PHP · JSP · Perl -
2
Insecurity Food Coming soon
An online food shop.
A menu, a basket, a checkout and a delivery window, for a single seller.
Commerce
food.insecurity.cc· Web · Android · iOS -
3
Insecurity Market Coming soon
An online marketplace.
The shop again, with many sellers: storefronts, listings, payouts and disputes.
Commerce
market.insecurity.cc· Web · Android · iOS
Medium
Larger applications, with more than one moving part.
-
4
Insecurity Airways Coming soon
A flag-carrier airline, and its reservation system.
Flight search, seat maps, fares, holds and tickets.
Booking
airways.insecurity.cc· Web · Android · iOS -
5
Insecurity Times Coming soon
A newspaper.
Mostly read, by everyone; written by a few, through an editorial workflow with drafts, embargoes and corrections.
Media
times.insecurity.cc· Web · Android · iOS -
6
Insecurity Tube Coming soon
A video platform.
Video uploads that are transcoded, stored and played back.
Media
tube.insecurity.cc· Web · Android · iOS -
7
Insecurity Chat Coming soon
Social networking, by conversation.
Direct messages, group rooms, invitations, presence and a live connection that stays open.
Social
chat.insecurity.cc· Web · Android · iOS -
8
Insecurity Verse Coming soon
Social media, by community.
Followers, blocks, private posts and a feed assembled from all of them.
Social
verse.insecurity.cc· Web · Android · iOS -
9
Insecurity Soft Coming soon
A company site, in Go.
Staff, departments, documents, approvals and roles that change as people move.
Corporate
soft.insecurity.cc· Go · Web -
10
Insecurity Hard Coming soon
The same company site, in PHP.
The same organisation and the same approvals, in a different runtime.
Corporate
hard.insecurity.cc· PHP · Web
High
The largest surfaces, built as systems rather than single applications.
-
11
Insecurity Bank Coming soon
Accounts, cards and transfers.
Accounts, balances, transfers, cards and statements, with an audit trail.
Finance
bank.insecurity.cc· JSP · Web · Android · iOS -
12
Insecurity Group Coming soon
Groupware: mail, calendar, drive, chat, call and notices.
Six applications behind one sign-in, sharing one identity and one document store.
Groupware
group.insecurity.cc· Web · Android · iOS -
13
Insecurity Industry Coming soon
Enterprise infrastructure.
The largest surface in the family: single sign-on, many tenants, an API gateway and the services behind it.
Enterprise
industry.insecurity.cc· Web · Android · iOS
On the addresses
Each product has a hostname before it has a host
Every product answers to a name under insecurity.cc, and the
applications are built expecting it; they do not behave the same when the
host is localhost:8000. So the name comes first: run a product
locally and point its hostname at your own machine in
/etc/hosts, and the lab behaves the way it is written.
The hosted sample at each address is the fallback for when you have not done that. None of them are listed as links here, because none of the names resolve yet; a link that 404s is a worse answer than a name you can read.
Documentation will live at insecurity.cc/docs, on this site rather
than beside it.
Every application in this family is intentionally
insecure. Run them on isolated hosts only. Each repository
carries a SECURITY.md saying what is exposed and how.