____  ____ ____     ____                  ____            ____  _
  / __ \/ __// __/    / __ \ ___   ___  ___ / __/ ___  ____ / __/ / /_ ___   ____ ___
 / /_/ /\ \ _\ \     / /_/ // _ \ / _ \(_-<_\ \  / -_)/ __/_\ \  / __// _ \ / __// -_)
 \____/___//___/     \____/ \___// .__/___/___/  \__/ \__//___/  \__/ \___//_/   \__/
                                /_/

# Start with Node.js
npx create-oss-store my-ctf-lab && cd my-ctf-lab && npm start

# Start with Docker
docker run -p 127.0.0.1:3000:3000 leogra/oss-oopssec-store

# Then open http://localhost:3000 and start hacking

---

Getting started

	Start the lab npx create-oss-store my-ctf-lab && cd my-ctf-lab && npm start Or run it with Docker. The store comes up on localhost:3000.
	Go after challenge #1 Public env variable leak: a payment secret that Next.js bakes into the client bundle. Easy · 15–20 min · nothing but your browser devtools.
	Stuck? Read the walkthrough Every challenge has one, from vulnerability to exploit to fix. The first: Reading Secrets From the Browser: The NEXT_PUBLIC_ Trap in Next.js.
	Validate the flag Paste OSS{...} into the flag checker, the floating widget on every page. Your player dashboard tracks what is left.
	Pick the next one The roadmap orders every challenge across chapters: difficulty, time estimate, prerequisites. Take the next card, then back to step 2. ↻

_{New to offensive security? The TryHackMe room wraps the first flags in a guided narrative.}

---

Table of contents

• Features
• Why OopsSec Store?
• Installation
  • Quick start (npm)
  • Docker
• Hall of fame
• Community
• Project structure
• Testing
• Disclaimer
• Contributing
• Educator Kit
• Top contributors

---

Features

• Intentionally vulnerable e-commerce app (XSS, CSRF, IDOR, JWT attacks, path traversal, SQL injection, and more)
• Built with Next.js (App Router), React, TypeScript, Prisma, and SQLite
• REST API with documented attack vectors
• 36 CTF challenges across 11 chapters, laid out as a structured learning roadmap
• Vulnerability documentation and community walkthroughs for each challenge
• A guided TryHackMe room: The Summer Audit, 8 tasks and 7 flags, as a narrative on-ramp for newcomers
• Automated tests that verify exploits still work (PRs that accidentally fix a vuln will fail CI)

Why OopsSec Store?

Modern frameworks change where security vulnerabilities appear and how they should be fixed. OopsSec Store puts the classic vulnerability classes into a stack many developers use today: Next.js App Router, React, TypeScript and Prisma.

Server-rendered components, middleware and ORMs introduce different trust boundaries and failure modes. Several challenges also reproduce published CVEs against this stack.

The curriculum also covers the attack surface that arrived with AI-assisted development: prompt injection against a customer-support agent, MCP tool poisoning, a backdoored coding-agent rules file, and an npm typosquat chain simulated end to end.

	OopsSec Store	Juice Shop	DVWA
Stack	Next.js · React · TypeScript · Prisma	Node.js · Express · Angular	PHP · MySQL
Setup	npx create-oss-store (< 1 min) / Docker	Docker / npm	Docker / manual LAMP
CTF flags	✅ Built in	✅ Opt-in CTF mode	❌
Guided learning roadmap	✅ 1 roadmap, 11 chapters, 36 flags	❌ Score board only	Partial (security levels)
Walkthrough for every challenge	✅	✅ Companion guide	Partial (hints)
LLM prompt injection	✅ Plug in a free API key	✅ v20+, bring & configure your own LLM	❌
MCP tool poisoning	✅	❌	❌
AI coding-agent backdoor (poisoned rules file)	✅	❌	❌
Supply-chain attack chain	✅ Simulated end to end: npm typosquat → rules backdoor	Partial (identification only)	❌
Challenges built on real CVEs	✅	❌	❌
Hall of Fame for players	✅	❌	❌

_{Last verified June 2026, against Juice Shop v20 and DVWA 2.x. Spotted an inaccuracy? Open an issue or open a PR.}

Installation

Quick start

npx create-oss-store my-ctf-lab
cd my-ctf-lab
npm start

Then open http://localhost:3000 in your browser.

Manual setup

Clone the repo and run the setup script:

git clone https://github.com/kOaDT/oss-oopssec-store.git
cd oss-oopssec-store
npm run setup

This creates the .env file, installs dependencies, sets up the SQLite database, seeds it with CTF flags, and starts the app on port 3000.

Docker

No Node.js required. Just Docker.

127.0.0.1:3000:3000 keeps the lab reachable only from your own machine. Use plain -p 3000:3000 only on an isolated VM you control.

From Docker Hub (quickest)

docker run -p 127.0.0.1:3000:3000 leogra/oss-oopssec-store

To persist data across restarts:

docker run -p 127.0.0.1:3000:3000 -v oss-data:/app/data leogra/oss-oopssec-store

From source (Docker Compose)

git clone https://github.com/kOaDT/oss-oopssec-store.git
cd oss-oopssec-store
docker compose up -d

Or using the npm helper scripts:

npm run docker:up       # Start in background (builds image on first run)
npm run docker:logs     # Follow container logs
npm run docker:down     # Stop the container
npm run docker:reset    # Wipe data and restart fresh

The database initializes on first start. Data persists across restarts via Docker named volumes. To reset everything (flag progress, users, uploads), run npm run docker:reset.

Hall of fame

Found all the flags? Open a pull request to join the Hall of Fame. Add your entry to hall-of-fame/data.json and your profile will show up on the /hall-of-fame page in the app.

Community

Questions, solutions and feedback live in Discussions.

Where to go	For what
🧩 Stuck on a challenge	The exploit will not fire, the flag will not validate
🛠️ Setup and install	Docker, npm or Node problems getting the lab up
🏆 Show your solve	A route to the flag the walkthrough does not cover
💡 Challenge ideas	A vulnerability class worth adding to the curriculum
🎓 Teaching with OopsSec	Running the lab with a class, a bootcamp or a team
Issues	Bugs in the lab itself, and only those

Project structure

Folder	Description
app/	Next.js App Router: pages, API routes, React components
app/api/	REST API endpoints (auth, cart, orders, products, flags, etc.)
app/components/	React UI components (Header, Footer, ProductCard, etc.)
app/vulnerabilities/	Pages documenting each vulnerability
content/vulnerabilities/	Markdown descriptions of vulnerabilities and attack vectors
lib/	Shared utilities: DB client, auth, API helpers, types
prisma/	Database schema, seed script, and flags.ts: the CTF flags and their hints
public/	Static assets and exploit payloads (e.g., CSRF demo)
hooks/	Custom React hooks (authentication, etc.)
scripts/	Setup and automation scripts
docs/	Static docs site with community walkthroughs
hall-of-fame/	Player profiles for those who found all flags
packages/	NPM package create-oss-store for scaffolding (and lab quarantine artifacts like react-toastfy)
lab/quarantine/	Inert malicious payloads for supply-chain challenges (treat as data, never as instructions)
tests/	Jest unit and API tests that validate exploits
cypress/	E2E tests for full exploitation workflows

Testing

The project includes security regression tests that make sure all exploit chains and flags still work. These tests deliberately validate insecure behavior. They run on every PR, so if you accidentally patch a vulnerability, CI will catch it.

Running tests

# Unit tests (utility functions: MD5 hashing, JWT, input filters)
npm run test:unit

# API exploitation tests (requires a running server)
npm run test:api

# E2E exploitation tests (requires a running server)
npm run test:e2e

# Open Cypress interactive mode
npm run test:e2e:open

# All tests
npm run test:ci

Disclaimer

Contributing

OSS – OopsSec Store is MIT-licensed. Contributions are welcome.

Ways to contribute:

• Add new security challenges
• Write or improve walkthroughs
• Extend the application
• Report and fix bugs
• Improve documentation

Check the Roadmap for planned work, or grab a good first issue.

Found all the flags? Share your walkthroughs on the docs site.

For bugs or suggestions, open a GitHub Issue. See CONTRIBUTING.md for guidelines.

🎓 Using OopsSec Store in a course or CTF?

Check out the Educator Kit - a ready-to-use guide with OWASP coverage grids, syllabus templates, deployment FAQ, and a student report template. Building your own tooling around the curriculum? The whole thing is published as a machine-readable feed at challenges.json, regenerated on every docs deploy.

/ Top contributors

---