HELP / FAQ
Before you start
experimenting.
A quick guide to your lab.
Do I need pentesting experience?
No. Start with SQL Injection or XSS Reflected. Basic programming, SQL and JavaScript knowledge will help. Each lab explains the attack mechanism, lets you try it and demonstrates a defense.
How do I run the full application?
Download the repository and install Docker with Docker Compose. Run this command in the project directory:
docker compose up --build -dOpen http://localhost:8080/vulnerability-vault/. On Windows, enable Docker Desktop integration with WSL.
What are the test accounts?
The lab includes the accounts admin/admin, test/test and user/user. The phpMyAdmin panel is available at http://localhost:8081.
What is the difference between vulnerable and protected variants?
The vulnerable variant intentionally contains a flaw that you explore in the exercise. The protected variant demonstrates a defense. Try the same input in both variants and compare the results and code.
Does a restart delete my data?
Stopping and restarting the containers normally preserves the database and uploaded files. The command docker compose down -v removes the volumes and their lab data. See the repository README for details.