https://github.com/kOaDT/oss-oopssec-store
Run `npx create-oss-store`, open your browser, and start hunting flags. Deliberately vulnerable Next.js e-commerce for web security training and CTF use.
https://github.com/kOaDT/oss-oopssec-store
appsec ctf ctf-challenges cve cybersecurity hacking javascript nextjs open-source oss owasp-top10 penetration-testing purple-team rce reactjs red-team typescript vulnerable-web-app web-security
Last synced: about 1 month ago
JSON representation
Run `npx create-oss-store`, open your browser, and start hunting flags. Deliberately vulnerable Next.js e-commerce for web security training and CTF use.
- Host: GitHub
- URL: https://github.com/kOaDT/oss-oopssec-store
- Owner: kOaDT
- License: mit
- Created: 2025-12-17T20:13:59.000Z (2 months ago)
- Default Branch: main
- Last Pushed: 2026-01-12T15:30:14.000Z (about 1 month ago)
- Last Synced: 2026-01-12T18:56:38.181Z (about 1 month ago)
- Topics: appsec, ctf, ctf-challenges, cve, cybersecurity, hacking, javascript, nextjs, open-source, oss, owasp-top10, penetration-testing, purple-team, rce, reactjs, red-team, typescript, vulnerable-web-app, web-security
- Language: TypeScript
- Homepage: https://koadt.github.io/oss-oopssec-store/
- Size: 854 KB
- Stars: 3
- Watchers: 1
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Roadmap: ROADMAP.md
Awesome Lists containing this project
- awesome-cybersecurity - oopssec-store - An intentionally vulnerable e-commerce application built with Next.js for web security training and CTF practice. (Technologies)
- awesome-vulnerable - OSS – OopsSec Store - An open-source, intentionally vulnerable e-commerce application built with Next.js and React. Provides a realistic CTF platform for learning web application security testing. Can be quickly set up using `npx create-oss-store`. (Vulnerable Web Applications)
- awesome-vulnerable-apps - OSS – OopsSec Store - An intentionally vulnerable e-commerce application built with Next.js and React. A self-hosted CTF platform for web security training covering OWASP Top 10 vulnerabilities. (OWASP Top 10)
- awesome-cyber-security - OopsSec Store (OSS) - An intentionally vulnerable e-commerce web application for CTF use. (Secure Software Development (OWASP))
README
OSS - OopsSec Store
```
____ ____ ____ ____ ____ ____ _
/ __ \/ __// __/ / __ \ ___ ___ ___ / __/ ___ ____ / __/ / /_ ___ ____ ___
/ /_/ /\ \ _\ \ / /_/ // _ \ / _ \(_-<_\ \ / -_)/ __/_\ \ / __// _ \ / __// -_)
\____/___//___/ \____/ \___// .__/___/___/ \__/ \__//___/ \__/ \___//_/ \__/
/_/
$ npx create-oss-store
$ cd my-oss-store && npm run dev
→ Open http://localhost:3000 and start hunting flags
```
An intentionally vulnerable e-commerce application for hands-on web security training.
Master real-world attack vectors through a realistic Capture The Flag platform. Hunt for flags, exploit vulnerabilities, and level up your security skills.
Contributing |
Roadmap |
WriteUps
[](https://github.com/kOaDT/oss-oopssec-store/blob/main/LICENSE)
[](https://www.npmjs.com/package/create-oss-store)
[](https://www.npmjs.com/package/create-oss-store)
[](https://github.com/kOaDT/oss-oopssec-store/issues)
[](https://github.com/kOaDT/oss-oopssec-store/pulls)
[](https://github.com/kOaDT/oss-oopssec-store/stargazers)
---
OSS – OopsSec Store is an open-source, intentionally vulnerable e-commerce application built with Next.js and React. It provides a realistic environment to learn and practice web application security testing, including OWASP Top 10 vulnerabilities, API security flaws, and modern frontend attack vectors.
Designed for penetration testers, security engineers, developers, and cybersecurity students, this project demonstrates how real-world vulnerabilities manifest in production-like single-page applications (SPA) with REST APIs.
**Warning:** This application contains intentional security flaws and must never be deployed in a production environment.
## Features
- Realistic e-commerce application with intentional security vulnerabilities (XSS, CSRF, IDOR, JWT attacks, path traversal, and more)
- Modern tech stack: Next.js, React, Prisma
- API security testing environment with documented attack vectors
- Capture The Flag (CTF) challenges with hidden flags to discover
- Comprehensive vulnerability documentation for learning and training
- Suitable for security awareness training, penetration testing practice, and AppSec education
---
## Recent activity [](https://repography.com)
[](https://github.com/kOaDT/oss-oopssec-store/commits)
[](https://github.com/kOaDT/oss-oopssec-store/commits)
---
## Installation
### Quick Start
```bash
npx create-oss-store my-ctf-lab
cd my-ctf-lab
npm run dev
```
Then open http://localhost:3000 in your browser.
### Manual Setup
Alternatively, clone the repository and run the setup script:
```bash
git clone https://github.com/kOaDT/oss-oopssec-store.git
cd oss-oopssec-store
npm run setup
```
The setup script will create the `.env` file, install dependencies, initialize the SQLite database, seed it with CTF flags, and start the application on port 3000.
---
## Project Structure
[](https://github.com/kOaDT/oss-oopssec-store)
| Folder | Description |
| -------------------------- | ------------------------------------------------------------------------ |
| `app/` | Next.js App Router – pages, API routes, and React components |
| `app/api/` | REST API endpoints (auth, cart, orders, products, flags, etc.) |
| `app/components/` | Reusable React UI components (Header, Footer, ProductCard, etc.) |
| `app/vulnerabilities/` | Pages documenting each security vulnerability |
| `content/vulnerabilities/` | Markdown files describing vulnerabilities, attack vectors, and solutions |
| `lib/` | Shared utilities: database client, authentication, API helpers, types |
| `prisma/` | Database schema, migrations, and seed script with CTF flags |
| `public/` | Static assets and exploit payloads (e.g., CSRF attack demo) |
| `hooks/` | Custom React hooks (authentication, etc.) |
| `scripts/` | Setup and automation scripts |
| `docs/` | Static documentation site |
| `packages/` | NPM package `create-oss-store` for quick project scaffolding |
---
## Disclaimer
This project is intended for educational and authorized security testing purposes only.
It contains intentional security vulnerabilities and insecure configurations. The authors assume no responsibility for any misuse, damage, or unauthorized access resulting from the use of this software. Use responsibly and only in isolated environments.
---
## Contributing
OSS – OopsSec Store is released under the MIT License. Contributions from the security community are welcome.
Ways to contribute:
- **Add new security challenges**
- **Extend the application**
- **Report and fix bugs**
- **Improve documentation**
Looking for ideas? Check out our [Roadmap project](https://github.com/users/kOaDT/projects/3) for planned features and vulnerabilities you can help implement.
For issues or suggestions, please open a [GitHub Issue](https://github.com/kOaDT/oss-oopssec-store/issues).
For contribution guidelines, see [CONTRIBUTING.md](CONTRIBUTING.md).