LabVulnerDursGo - A collection of vulnerable applications to test th

项目说明

DursGo Labs

A collection of applications to test the DursGo scanner.

---

This repository contains two different lab applications, each with its own configuration. Here is how to run both using Docker.

Lab Descriptions

<p align="center">
<img src="images/lab-dursgo.png" width="720">
</p>

The following labs are a in this collection:

Open Redirect Lab

- A lab demonstrating a classic Open Redirect where the application redirects to any user-supplied URL.

<details>
<summary>Click Video Solved Lab - Open Redirect</summary>

<video src=" width="600" controls>
Your browser does not support the video tag.
</video>
</details>

Blind Lab

- Contains both Blind SSRF and Blind Command Injection , detectable via OAST.

<details>
<summary>Click Video Solved Lab - Blind SSRF</summary>

<video src=" width="600" controls>
Your browser does not support the video tag.
</video>
</details>

<details>
<summary>Click Video Solved Lab - Blind Command Injection</summary>

<video src=" width="600" controls>
Your browser does not support the video tag.
</video>
</details>

SSRF (In-Band) Lab

- A classic SSRF where the application fetches and displays content from a user-supplied URL.

<details>
<summary>Click Video Solved Lab - SSRF (In-Band)</summary>

<video src=" width="600" controls>
Your browser does not support the video tag.
</video>
</details>

DomXSS Lab

- This Lab is to DOMXSS. The script on this page takes the content from the URL fragment

<details>
<summary>Click Video Solved Lab - DomXSS</summary>

<video src=" width="600" controls>
Your browser does not support the video tag.
</video>
</details>

Mass Assignment Lab

- This link leads to a protected API endpoint to Mass Assignment.

<details>
<summary>Click Video Solved Lab - Mass Assignment</summary>

<video src=" width="600" controls>
Your browser does not support the video tag.
</video>
</details>

CORS Misconfiguration Lab

- An API endpoint that improperly reflects the Origin header, allowing data theft from any domain.

<details>
<summary>Click Video Solved Lab - CORS Misconfiguration</summary>

<video src=" width="600" controls>
Your browser does not support the video tag.
</video>
</details>

Authentication Lab

- A login page to test authenticated scanning capabilities and related . (: CSRF, BOLA, File Upload, Mass Assignment).

<details>
<summary>Click Video Solved Lab - Authentication</summary>

<video src=" width="600" controls>
Your browser does not support the video tag.
</video>
</details>

Exposed Files Lab

- A directory to test the detection of sensiti and folders like .env or .git/.

<details>
<summary>Click Video Solved Lab - Exposed Files</summary>

<video src=" width="600" controls>
Your browser does not support the video tag.
</video>
</details>

IDOR & Stored XSS Lab

- A login authenticated test for Insecure Direct Object References and Stored Cross-Site Scripting.

<details>
<summary>Click Video Solved Lab - IDOR & Stored XSS Lab</summary>

<video src=" width="600" controls>
Your browser does not support the video tag.
</video>
</details>

GraphQL API Lab

- A GraphQL endpoint to test for introspection, injection, and other API-specific flaws.

<details>
<summary>Click Video Solved Lab - GraphQL API </summary>

<video src=" width="600" controls>
Your browser does not support the video tag.
</video>
</details>

1. PHP Lab Application (index-vuln)

This application is a PHP-based lab and serves as the main dashboard for all labs.

> Important: The main page of this application () contains links to all labs, including those running on ports 5000 and 4000. To ensure all links work, you must run both applications (index-vuln and index-) simultaneously.

Requirements

Docker

Docker Compose

How to Run

1. Open a terminal and na to the index-vuln directory:

2. Run the following command to build and start the Docker container:

This command will run the application in the background.

3. Once the container is running, the application will be accessible at:

How to Stop

To stop the application, run the following command from within the index-vuln directory:

---

2. Python & Node.js Lab Application (index-)

This application consists of two services: a Flask-based web application (Python) and a Node.js-based GraphQL API.

Requirements

Docker

Docker Compose

How to Run

1. Open a terminal and na to the index- directory:

2. Run the following command to build and start both services:

3. Once the containers are running, the services will be accessible at:
- Web Application (Flask):
- GraphQL API (Node.js):

Credentials for Web Application (Port 5000)

The database is initialized with the following users:

Admin User

- Username: admin
- Password: admin123

Regular User

- Username: user1
- Password: password123

How to Stop

To stop both services, run the following command from within the index- directory:

---

📑 Report

This project includes a report that allows you to upload and scan results in a clean web interface, with the option to export them as PDF.

#### 🚀 How to Use

1. Access the at:

2. Upload report

Click the Choose File button.

Select the JSON report generated by DursGo.

3. View results

Scan Summary (target URL, technologies, total findings, etc.)

Detailed (each finding shown on a separate page for PDF export)

AI Analysis section with remediation guidance and code examples

4. Export as PDF

Once the report is loaded, click Download Report as PDF to export the findings into a professional PDF document.

项目信息

开发语言：PHP

Star 数：12

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A collection of vulnerable applications to test the DursGo scanner.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。