VulSearch - Vulnerable PHP Application 🚨🐳

⚠️ WARNING: This is an INTENTIONALLY VULNERABLE application for testing security vulnerability scanners and penetration testing tools. DO NOT deploy to production! ⚠️

A deliberately insecure PHP application running in Docker with Apache, MySQL, Redis, and phpMyAdmin. Perfect for testing your favorite vulnerability detection plugins, security scanners, and penetration testing tools. Because sometimes you need a punching bag that punches back!

🚀 Quick Start

📖 New to Development? Start Here!

For VS Code users (Recommended for beginners):

• See SETUP_GUIDE.md for a complete step-by-step guide to setting up your development environment using VS Code Dev Containers
• Includes detailed prerequisites, troubleshooting, and everything a new user needs

Prerequisites

• Docker & Docker Compose (obviously)
• Git (for version control, because YOLO deployments are so last year)
• Optional: VS Code with Dev Containers extension (see SETUP_GUIDE.md)

Getting Started

Option 1: Using VS Code Dev Containers (Recommended)

See SETUP_GUIDE.md for detailed instructions.

Quick version:

1. Install Docker Desktop, VS Code, and Dev Containers extension
2. Open project folder in VS Code
3. Click "Reopen in Container" when prompted
4. Wait for setup to complete (5-15 minutes first time)
5. Access at http://localhost:8080

Option 2: Using Docker Compose (Traditional)

1. Clone and setup the project:

   git clone <your-repo-url>
   cd vulsearch

2. Build and run the application:

   docker-compose up -d --build

3. Install PHP dependencies:

   docker-compose exec app composer install

4. Access your application:

   • Main App: http://localhost:8080
   • phpMyAdmin: http://localhost:8081
   • MySQL: localhost:3306

📁 Project Structure

├── public/                 # Web root directory
│   └── index.php          # Application entry point
├── src/                   # PHP source code
│   ├── Models/           # Data models
│   ├── Services/         # Service classes (TemplateService, etc.)
│   ├── Database.php      # Database connection class
│   └── helpers.php       # Helper functions
├── views/                # Smarty templates
│   ├── layouts/         # Layout templates
│   ├── pages/           # Page templates
│   ├── cache/           # Template cache (auto-generated)
│   └── templates_c/     # Compiled templates (auto-generated)
├── docker/               # Docker configuration
│   ├── apache/          # Apache configuration
│   ├── php/             # PHP configuration
│   └── mysql/           # MySQL initialization
├── config/              # Application configuration
├── Dockerfile           # PHP-Apache container definition
└── docker-compose.yml   # Multi-container orchestration

🚨 Security Vulnerabilities Included

This application contains the following intentional vulnerabilities for testing:

🔓 Currently Implemented

• ✅ Basic SQL Injection - Classic injection vulnerabilities (GET, POST, search, ORDER BY, LIMIT)
• ✅ Production-Style Vulnerabilities - Real-world patterns based on actual enterprise codebases:
  • Array implode SQL injection (extremely common in production)
  • Integer casting bypass vulnerabilities
  • Date parameter injection (reporting systems)
  • Dynamic table/column name injection (admin systems)
  • Locale function injection (enterprise applications)
  • Filter condition building vulnerabilities (search systems)

🎯 Planned Vulnerabilities

• 🔴 SQL Injection - Multiple injection points (GET, POST, cookie-based)
• 🔴 Cross-Site Scripting (XSS) - Reflected, Stored, and DOM-based
• 🔴 Cross-Site Request Forgery (CSRF) - Unprotected state-changing operations
• 🔴 Local File Inclusion (LFI) - Directory traversal and file reading
• 🔴 Remote File Inclusion (RFI) - Remote code execution via includes
• 🔴 Command Injection - OS command execution vulnerabilities
• 🔴 Path/Directory Traversal - Access to restricted files
• 🔴 Insecure File Upload - Malicious file upload capabilities
• 🔴 Authentication Bypass - Weak authentication mechanisms
• 🔴 Session Management Issues - Session fixation and hijacking
• 🔴 Information Disclosure - Sensitive data exposure
• 🔴 Weak Cryptography - Poor encryption implementations

🛡️ Testing Your Security Tools

Use this application to test:

• SAST Tools (Static Analysis) - CodeQL, SonarQube, Semgrep, etc.
• DAST Tools (Dynamic Analysis) - OWASP ZAP, Burp Suite, Netsparker
• Vulnerability Scanners - Nessus, OpenVAS, Nikto
• Web Application Firewalls - ModSecurity rules testing
• Penetration Testing Tools - Manual exploitation practice

📍 Vulnerability Endpoints

Currently Available:

• /vulnerable/ - Main vulnerability showcase
• /vulnerable/sqli/ - SQL injection examples
  • /vulnerable/sqli/basic - Basic GET parameter injection
  • /vulnerable/sqli/login - Login form injection
  • /vulnerable/sqli/search - Search function injection
  • /vulnerable/sqli/orderby - ORDER BY clause injection
  • /vulnerable/sqli/limit - LIMIT clause injection
• /vulnerable/realistic/ - Production-style vulnerabilities
  • /vulnerable/realistic/implode - Array implode injection
  • /vulnerable/realistic/casting - Integer casting bypass
  • /vulnerable/realistic/dates - Date parameter injection
  • /vulnerable/realistic/dynamic - Dynamic table/column names
  • /vulnerable/realistic/locale - Locale function injection
  • /vulnerable/realistic/filters - Filter condition building

Coming Soon:

• /vulnerable/xss/ - XSS demonstrations
• /vulnerable/lfi/ - File inclusion vulnerabilities
• /vulnerable/upload/ - Insecure file uploads

🔧 Development

Available Commands

# Start all services
docker-compose up -d

# Stop all services
docker-compose down

# View logs
docker-compose logs -f

# Access PHP container shell
docker-compose exec app bash

# Run Composer commands
docker-compose exec app composer install
docker-compose exec app composer require package-name

# Database access
docker-compose exec mysql mysql -u app_user -p app_db

API Endpoints

The application provides a simple REST API:

• GET /api/status - Application status
• GET /api/users - List all users
• GET /api/posts - List all posts
• POST /api/users - Create new user
• POST /api/posts - Create new post

Example API Usage

# Get all users
curl http://localhost:8080/api/users

# Create a new user
curl -X POST http://localhost:8080/api/users \\
  -H "Content-Type: application/json" \\
  -d '{"username":"newuser","email":"[email protected]","password":"password123"}'

# Create a new post
curl -X POST http://localhost:8080/api/posts \\
  -H "Content-Type: application/json" \\
  -d '{"user_id":1,"title":"Hello Docker","content":"This is my first post!"}'

🗄️ Database

The application uses MySQL 8.0 with the following default configuration:

• Database: app_db
• Username: app_user
• Password: secret_password
• Root Password: root_secret

Sample Data

The database is initialized with sample users and posts for testing purposes.

🛠️ Configuration

Environment Variables

Copy .env.example to .env and adjust as needed:

APP_NAME="PHP Docker Application"
APP_ENV=development
DB_HOST=mysql
DB_DATABASE=app_db
DB_USERNAME=app_user
DB_PASSWORD=secret_password
REDIS_HOST=redis

PHP Configuration

Custom PHP settings can be modified in docker/php/php.ini.

Apache Configuration

Apache virtual host settings are in docker/apache/vhost.conf.

🎨 Smarty Templating

The application uses Smarty 5.x for templating to separate logic from presentation.

Template Structure

• Layouts: views/layouts/ - Base templates with common structure
• Pages: views/pages/ - Specific page templates
• Cache: views/cache/ - Template cache (auto-generated)
• Compiled: views/templates_c/ - Compiled templates (auto-generated)

Using Templates

// In your controllers
use App\Services\TemplateService;

// Render and display template
TemplateService::display('pages/home.tpl', [
    'users' => $users,
    'posts' => $posts
]);

// Or get rendered content as string
$html = TemplateService::render('pages/404.tpl');

Template Features

• Template inheritance with {extends} and {block}
• Global variables (app config, request info, server info)
• Security policies enabled by default
• Automatic caching in production
• Debug mode for development

Clear Template Cache

# Access container and clear cache
docker-compose exec app php -r "App\Services\TemplateService::clearCache();"

📊 Services

PHP-Apache (Port 8080)

• PHP 8.2 with Apache
• Smarty 5.x templating engine
• Composer for dependency management
• Custom PHP configuration
• Volume mounted for live reload

MySQL (Port 3306)

• MySQL 8.0
• Persistent data storage
• Initialization scripts
• Direct access available

phpMyAdmin (Port 8081)

• Web interface for MySQL
• Pre-configured connection
• Development convenience

Redis (Port 6379)

• Session storage
• Caching layer
• Persistent data

🚨 Troubleshooting

Common Issues

1. Port already in use: Change ports in docker-compose.yml
2. Permission issues: Check file permissions and Docker daemon
3. Database connection failed: Ensure MySQL container is running
4. Composer autoload issues: Run composer dump-autoload

Useful Commands

# Check container status
docker-compose ps

# Rebuild specific service
docker-compose up -d --build app

# Clear all Docker data (nuclear option)
docker system prune -a

⚠️ DISCLAIMER & ETHICAL USE

🚨 SECURITY WARNING

This application is INTENTIONALLY VULNERABLE and contains serious security flaws. It is designed exclusively for:

• ✅ Security research and education
• ✅ Testing vulnerability scanners and security tools
• ✅ Penetration testing practice in controlled environments
• ✅ Security awareness training

🛡️ DO NOT USE FOR:

• ❌ Production environments
• ❌ Public-facing deployments
• ❌ Any real-world applications
• ❌ Malicious activities

⚖️ Legal Notice

Users are responsible for complying with applicable laws and regulations. This tool should only be used in authorized environments where you have explicit permission to test. The authors are not responsible for any misuse or damage caused by this application.

🔐 Network Security

• Only run in isolated/controlled networks
• Use for authorized penetration testing only
• Consider using VPN or isolated lab environments
• Monitor network traffic during testing

🔒 Legacy Security Notes

The original application setup notes (now superseded by intentional vulnerabilities):

• Change all default passwords (Now using weak passwords for testing)
• Use proper SSL certificates (Deliberately using HTTP for vulnerability testing)
• Implement proper authentication (Implementing weak auth for bypass testing)
• Review security headers (Removing security headers for testing)
• Use environment-specific configurations (Using insecure configs for testing)

📝 Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Test thoroughly
5. Submit a pull request

📄 License

This project is open source and available under the MIT License.

---

Built with ❤️ and a healthy dose of sarcasm by developers, for developers.