VULN99

Installation & setup

One script, one URL, a known state on every boot.

git clone https://github.com/hackops-academy/vuln99.git
cd vuln99
./setup.sh          # macOS/Linux — venv, deps, and run in one step
# .\setup.ps1        Windows PowerShell equivalent

Or by hand:

python3 -m venv venv
source venv/bin/activate   # Windows: venv\Scripts\activate
pip install -r requirements.txt
python run.py

Open http://127.0.0.1:5099. The database is SQLite and reseeds from scratch on every process start — you always boot into a known, clean state.

Anatomy of the range

Know the shape of the target before you start pulling triggers.

Vuln99 is a full storefront — catalog, cart, checkout, reviews, accounts, and an admin panel — not just a page of isolated bugs. 24 vulnerabilities are wired into that realistic flow, each independently switchable between low/medium/hard from Admin → Difficulty settings (/admin/settings).

Every vulnerable route that has a hardened counterpart ships a /safe-* sibling — /safe-search, /safe-product, /safe-read-file, /safe-ping, /safe-go — the same pattern as Glacier's old test app, useful for confirming a scanner correctly stays quiet on a hardened endpoint instead of just firing on everything.

Difficulty tiers

The same bug, three ways — pick the lesson you actually want to teach or learn.

Bulk "set all to low/medium/hard" buttons live on the same settings screen. Without a valid login, if broken_admin is set to LOW, visit /admin/become-admin-demo to set the forgeable is_admin cookie the low-difficulty check trusts.

SQL injection family

Seven distinct SQLi surfaces — from a URL parameter to an HTTP header.

XSS & CSRF

Reflected, stored, and the request-forgery classic — right where a scanner and a human diverge.

Access control & logic flaws

The bugs no scanner finds without help — this is where manual testing earns its keep.

File & command vulnerabilities

Where the scanner's path-traversal and command-injection checks earn their keep.

SSRF, XXE, SSTI & deserialization

The admin-only advanced labs — highest impact, easiest to under-scope.

All four are admin-gated — you'll need a valid admin session (or the /admin/become-admin-demo shortcut from Module 03) to reach them. None of these have automated Glacier checks; they're deliberately manual-only labs.

Redirects & misc findings

The smaller findings that round out a full report.

Running Glacier against Vuln99

Where the two courses actually meet.

Point Glacier's proxy and active scanner at http://127.0.0.1:5099/ with the injection-family and broken_admin vulnerabilities set to LOW (the default). Route paths, parameter names (username/password, q, id, file, host, url), and the SQL error format (sqlite3.OperationalError) all match what Glacier's check_* functions expect out of the box.

# from Glacier's course, Module 04
POST /api/spider/start
{ "start_url": "http://127.0.0.1:5099/" }

# from Glacier's course, Module 05 — confirm scope is localhost before running this
POST /api/active/scan
{ "url": "http://127.0.0.1:5099/product?id=1", "confirm": true }

The combined methodology

Glacier's methodology, run end-to-end against this specific range.

Multi-VM labs & next steps

Graduating from localhost without losing the safety rails.

If you're running a real isolated lab (a scanner on one VM, Vuln99 on another, both on a private network with no route to the internet), override the bind address:

VULN99_HOST=0.0.0.0 VULN99_PORT=5099 python run.py

run.py prints a warning banner whenever it's bound to anything other than localhost — treat that banner as a hard stop-and-check, not noise. Every request lands in logs/access.log and every admin action in logs/events.log, both handy for lining up what the app saw against a simultaneous nmap scan or Wireshark capture.

1. Run the full Module 11 methodology against Vuln99 at LOW, then again at MEDIUM.
2. Diff your two Glacier findings exports and see exactly which findings a real-world mitigation would have hidden from an automated scan alone.
3. Once this feels routine, go back to Glacier's own course Module 11 and run its full methodology against Vuln99 as the final exercise.