⚡ VoltMart — Multi-App Vulnerable Pentest Platform

Five apps behind one launcher — an e-commerce store, a bank, a finance portal, a SaaS workspace and a dedicated AI/LLM pentest lab. 280+ vulnerabilities across the OWASP Top 10, the OWASP LLM Top 10, modern attack classes (JWT, GraphQL, SSRF→cloud-metadata, SAML/XXE, OAuth, PHP object injection, HTTP request smuggling, weak TLS) and real business logic. Every lab has four difficulty levels, from the textbook bug to the patched code — and the AI runs with NO API KEY: a built-in deterministic offline engine, nothing to install.

A self-hosted, Dockerized penetration testing lab and OWASP Top 10 + LLM training ground for hands-on web & AI application security practice — a modern DVWA / OWASP Juice Shop alternative.

TL;DR — Self-hosted penetration-testing labs: five realistic, intentionally vulnerable apps (incl. a dedicated AI/LLM lab) you run locally with one command, packed with 280+ real vulnerabilities to find and exploit. Think DVWA or OWASP Juice Shop — but five apps, a shared difficulty engine, an AI assistant that needs no API key, and a modern attack surface (JWT, GraphQL, SSRF→cloud-metadata, SAML/XXE, OAuth, object injection, request smuggling, weak TLS, OWASP LLM Top 10).

Why VoltMart? · The apps · Quick start · Default accounts · How difficulty works · Vulnerability coverage · Architecture · Project layout · For pentesters & instructors · Legal & ethics

Most vulnerable apps teach you one stack and a handful of bug classes. VoltMart is a platform: five distinct, fully-featured applications that share a difficulty engine, so you practise the way real engagements work — recon a new target, map its features, find the bugs, then study the fix.

• 🧩 Five separate targets, one click. A portal launches each app in its own tab — its own host, port, database and login — so you can attack each in isolation. Low on RAM? Start just one with a profile (docker compose --profile ai up -d).
• 🎚️ Four difficulty levels per lab — Low → Medium → High → Secure. Go from the textbook vulnerability, through naive/partial defences you can bypass, to the correct fix as a patch reference. The instructor sets the level for the whole class.
• 🥷 No "this is a lab" tells. To a student it looks like a normal product. The answers and controls live behind a hidden, password-protected instructor area.
• 🛠️ Genuinely vulnerable stack — Apache + PHP 7.4 (mod_php) and raw mysqli on MySQL 5.7, pinned end-of-life, so injection and RCE are real, not simulated.
• 🤖 Real AI / LLM pentesting — no API key. Every app has a vulnerable assistant, plus a dedicated AI lab — VoltMart Copilot (a multi-tenant RAG-and-tools support agent, 14 labs) covering the OWASP LLM Top 10 2025: direct, indirect (RAG) & multi-turn prompt injection, system-prompt leak, insecure output → XSS / SQLi-via-tool, excessive agency (tool SSRF, file read, unauthorized actions), cross-tenant RAG, RAG poisoning, supply-chain (malicious MCP skill), an agentic kill-chain and model DoS. It's a built-in deterministic offline engine — no model, no API key, no network — zero setup, instant.

Open the portal and pick a surface. Each opens in a new tab on its own port and login.

git clone https://github.com/Baymax-armed/voltmart-pentest-lab.git
cd voltmart-pentest-lab

# Run EVERYTHING (first run builds images and auto-seeds each DB)
docker compose --profile full up -d --build

# Open the launcher
#   Portal ........ http://localhost:8080
#   DB browser .... http://localhost:8081     (server: db · user: root · pass: root)
#   Weak TLS ...... https://localhost:8543    (Cloud over intentionally weak TLS)
#   Smuggling ..... http://localhost:8544     (CL.TE request-smuggling front)

# Stop
docker compose down

The full stack is 11 containers. If your laptop can't run them all, start a single app with a profile — each is db + a lightweight PHP container (the AI lab needs no API key and runs offline):

docker compose --profile store   up -d --build   # Store    → http://localhost:8090   (lightest: 2 containers)
docker compose --profile ai      up -d --build   # AI lab   → http://localhost:8094   (Copilot)
docker compose --profile bank    up -d --build   # Bank     → http://localhost:8091
docker compose --profile capital up -d --build   # Capital  → http://localhost:8092
docker compose --profile cloud   up -d --build   # Cloud    → http://localhost:8093
docker compose --profile full    up -d --build   # Everything

You can combine them (--profile store --profile ai). docker compose down stops whatever is running. The database is shared and starts automatically with any profile.

The assistants and the Copilot lab run on a built-in deterministic offline engine — no model, no API key, no network, nothing to install or configure. The vulnerabilities live in the app code (prompt assembly, RAG, tools, output handling), so every AI lab is fully reproducible out of the box, instantly, on any machine.

# Reset everything back to a clean seed (wipes the database volume)
docker compose down -v && docker compose --profile full up -d

Requires Docker Desktop / Docker Engine with the Compose plugin. Each app auto-creates and seeds its own database on first request — no manual import needed.

Logins are not printed on the sign-in pages (finding them is part of the exercise). The seeded accounts are the same across apps:

Instructor console password: instructor (override with INSTRUCTOR_PASSWORD). These weak, default credentials are themselves part of the lesson.

Every vulnerable code path reads its lab level from the database and branches:

Flip any lab (or all of them) from the instructor control panel at each app's /lab.php (store: /lab/). Whatever you set is what every student session attacks.

Hundreds of vulnerabilities spanning the OWASP Top 10 (2021), the OWASP LLM Top 10, classic web bugs, modern API/auth classes and deep business logic. A selection:

Injection & input — SQLi (login bypass, UNION/error, second-order, blind/time-based behind a WAF + rate-limit), reflected/stored/DOM XSS, OS command injection, LFI/RFI, SSTI → RCE, XXE, CSV/formula injection, NoSQL-style type juggling.

Access control & auth — IDOR/BOLA everywhere (orders, accounts, statements, messages, members, invoices, dividends, secrets, OAuth clients), vertical privilege escalation, mass-assignment self-signup as admin, SCIM cross-tenant admin provisioning, CSRF, JWT attacks (alg:none, weak HMAC, kid/jwk injection, RS256→HS256 key confusion), SAML — assertion signature never verified → pre-auth account takeover via the "Sign in with Google" flow, OAuth redirect_uri code theft & missing-state CSRF, token-never-expires, session fixation, session not invalidated on logout, unlimited concurrent sessions / revocation that never invalidates, verb tampering, predictable-reset-token account takeover, 2FA/OTP weaknesses, weak/bypassable CAPTCHA.

Deserialization, smuggling & transport — PHP object injection → RCE (a POP gadget in a backup-restore feature writes a web shell), HTTP request smuggling (a CL.TE desync between a Content-Length front proxy and a Transfer-Encoding backend poisons the next request), and a weak-TLS front (TLS 1.0/1.1, no-PFS AES-CBC-SHA1 ciphers, 1024-bit SHA-1 self-signed cert, no HSTS, no HTTPS redirect).

SSRF & cloud — URL-fetch SSRF that reaches a mock IMDS / cloud-metadata service and returns temporary role credentials (the real "SSRF → steal cloud creds → pivot" kill chain), plus metadata for AWS & GCP shapes.

APIs — JWT-authenticated REST API + JWKS endpoint, GraphQL (introspection, cross-tenant BOLA, unauthorized mutations, no depth/cost limit → DoS), reflective CORS, a developer portal with curl recipes.

Misconfiguration — missing/weak security headers & cookie flags (no CSP/HSTS, no HttpOnly/SameSite), permissive OPTIONS/TRACE methods (XST), cross-tenant secret-vault disclosure and plaintext secrets written to the audit log, exposed .git/backups/phpinfo, version banners, directory listing.

Files — unrestricted upload → web shell, path traversal via filename (KYC), stored XSS via SVG, zip-slip archive extraction → RCE.

Business logic — coupon abuse & stacking (→ negative invoice), gift-card / instant-withdrawal / dividend double-spend races (TOCTOU), price/quantity/checkout & bond issue-price tampering, client-set plan price (enterprise for $0), margin over-leverage (no LTV cap), refund & loyalty abuse, BNPL limit bypass, self-approved loans, free plan upgrades, referral self-credit, inventory/flash-sale oversell races.

🤖 AI / LLM — no API key required. Every app has a built-in assistant (store, bank, Capital, Cloud) covering prompt injection, insecure output→XSS, system-prompt & sensitive-info leakage, excessive agency, plus a dedicated AI pentest lab — VoltMart Copilot (:8094, 14 labs) — a multi-tenant RAG-and-tools support agent spanning the OWASP LLM Top 10 2025: direct, indirect (RAG) & multi-turn "crescendo" prompt injection, tool abuse → SSRF/IMDS, file read, unauthorized refunds, SQLi-via-tool, cross-tenant RAG (BOLA), RAG/data poisoning, supply-chain (a malicious community/MCP skill), an agentic kill-chain (poisoned doc → SQL dump → exfil) and model DoS / wallet-drain. Every assistant runs on a built-in deterministic offline engine — no model, no API key, no network — so the AI labs reproduce identically, instantly, with zero setup and zero cost.

Full per-lab hints live in docs/VULNERABILITIES.md; instructor walkthroughs (exploit + fix at every level) are in docs/SOLUTIONS.md, mounted outside the web root so students can't fetch them.

                         ┌──────────────────────────┐
        :8080  ─────────►│  Portal (launcher)        │
                         └──────────────────────────┘
   :8090  Store   :8091  Bank   :8092  Capital   :8093  Cloud ◄── :8543 weak-TLS front
      │              │              │               │              :8544 CL.TE smuggling front
      └──────────────┴──────┬───────┴───────────────┘
                            │   apps/shared (framework, JWT/WAF, difficulty engine,
                            │   CAPTCHA, mock IMDS, real-LLM AI assistant…)
                            ▼
                   ┌──────────────────┐        ┌──────────────┐
                   │  MySQL 5.7 (:13306)│◄─────►│ Adminer :8081 │
                   │  vulnshop / vulnbank        └──────────────┘
                   │  vulnfinance / vulnsaas │
                   └──────────────────┘

• All apps run the same php:7.4-apache image (intentionally weak config).
• The three newer apps share apps/shared/ — a themeable framework that provides the difficulty engine, auth, JWT/WAF/rate-limit helpers, the mock IMDS service, the CAPTCHA gate and the real-LLM AI assistant — so a single change adds a lab to all of them.
• Two extra fronts target the Cloud app: an nginx weak-TLS terminator (:8543) and a stdlib-Python request-smuggling proxy pair (:8544) — both standalone containers.
• Each app has its own database and its own session cookie (separate logins).

voltmart/
├── docker-compose.yml          # portal + store + bank + finance + saas + db + adminer + weaktls + smuggle
├── .env.example                # optional overrides (DB creds, instructor pw, LLM key)
├── README.md  SECURITY.md  LICENSE  CONTRACT.md
├── db/                         # store schema + seed (auto-loaded on first run)
├── docs/                       # VULNERABILITIES.md, SOLUTIONS.md, BURP-SETUP.md
├── PENTEST-GUIDE/              # methodology checklist + report template
├── apps/
│   ├── portal/                 # the launcher (:8080)
│   ├── bank/  finance/  saas/  # the three framework apps (:8091–:8093)
│   ├── shared/                 # shared framework (difficulty, auth, JWT, WAF, IMDS, CAPTCHA, LLM…)
│   ├── tls/                    # weak-TLS terminator for Cloud (:8543) — Dockerfile + nginx.conf
│   └── smuggle/                # CL.TE request-smuggling front/back (:8544) — stdlib Python + poc.py
└── web/                        # the e-commerce store (:8090) — Dockerfile + src/

• Methodology & reporting — a phased checklist and a finding/report template live in PENTEST-GUIDE/.
• Burp Suite — proxy setup and a suggested workflow in docs/BURP-SETUP.md.
• Instructor controls — per-app difficulty dashboards, live data counts and a one-click reset student data button. Change INSTRUCTOR_PASSWORD before sharing an image.

VoltMart exists for authorized, educational security testing on systems you own or have explicit permission to test. Do not use these techniques against systems you don't own. Provided as-is, with no warranty, for learning only. See LICENSE and SECURITY.md.