VulnShop
An intentionally vulnerable FastAPI + PostgreSQL shop covering the OWASP Top 10, with a black-box exploit regression runner.
- Python
- FastAPI
- PostgreSQL
- OWASP
- pytest
Problem
Placeholder: describe the goal. VulnShop is a deliberately insecure web app used to practise and demonstrate the OWASP Top 10. Each vulnerability is introduced on purpose, then patched module by module.
Architecture
Placeholder: describe the app and the exploit runner. FastAPI serves the shop, PostgreSQL stores data, and a separate black-box runner fires real exploits against the running app to prove each vulnerability exists and later that the patch closes it.
# Example: a black-box check that a SQL injection is exploitable.
def test_login_sql_injection(base_url):
payload = {"username": "' OR 1=1 --", "password": "x"}
response = requests.post(f"{base_url}/login", data=payload)
assert response.status_code == 200Key decisions
Placeholder: list the decisions and why. For example, why black-box regression tests instead of unit tests (they prove the real attack path), why patch one module at a time, and how the app is kept safe to run and share.
What I learned
Placeholder: the lessons. For example, how each OWASP category looks in real code, how to write a safe regression suite for intentionally dangerous code, and how attackers chain small issues into a full compromise.