Govulnapi is a deliberately vulnerable API written in Go showcasing common security flaws that are made while developing an application backend. Govulnapi aims be be concise in respect to vulnerabilities it implements as to lower the entry barrier for junior security researchers (e.g. "Use of Weak Hash" weakness can be found in the codebase by searching for a comment containing its corresponding id CWE-328).
git clone --depth 1 https://github.com/govulnapi/govulnapi.gitcd govulnapimake buildmake run
- Web client: http://localhost:8080/
- API documentation: http://localhost:8081/
- Virtual Coingecko: http://localhost:8082/
-
- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
- CWE-319: Cleartext Transmission of Sensitive Information
- CWE-328: Use of Weak Hash
- CWE-340: Generation of Predictable Numbers or Identifiers
- CWE-523: Unprotected Transport of Credentials
- CWE-759: Use of a One-Way Hash without a Salt
- CWE-916: Use of Password Hash With Insufficient Computational Effort