Cybersecurity Training with OSS – OopsSec Store
CybersecurityWebSecurityOWASPCTFTraining
OopsSec Store is an open-source, intentionally vulnerable web application designed to teach cybersecurity through practical, real-world scenarios. Built with modern technologies like Next.js and React, it simulates an e-commerce environment where users can safely practice identifying and exploiting vulnerabilities—from OWASP Top 10 flaws to API security misconfigurations and frontend attack vectors.
This platform bridges the gap between theory and practice, offering a self-hosted, CTF-focused training ground for security professionals, developers, and educators. Whether you're honing penetration testing skills, learning secure coding, or teaching web security, OopsSec Store provides a controlled, legal environment to explore vulnerabilities without risk.
Key Features
Purpose-Built for Security Training
- Realistic vulnerabilities embedded in a modern tech stack (Next.js, React, Prisma).
- Interactive learning with hidden CTF flags and documented attack vectors.
- Self-hosted and deployable in minutes via
npx create-oss-storeor manual cloning.
Comprehensive Vulnerability Coverage
- OWASP Top 10: Includes XSS, CSRF, IDOR, JWT attacks, path traversal, and more.
- API Security: Tests mass assignment, excessive data exposure, and rate-limiting bypasses.
- Frontend Attacks: Covers DOM-based XSS, prototype pollution, and insecure deserialization.
Educational Resources
- Detailed documentation for each vulnerability (e.g.,
/vulnerabilities/xss). - Project transparency with a clear directory structure and attack/solution guides.
- Community-driven with a public roadmap and contribution guidelines.
Who Should Use OopsSec Store?
Security Professionals
- Practice penetration testing in a legal, isolated environment.
- Test API security with REST endpoints and modern frontend attack vectors.
- Benchmark skills with progressively challenging CTF flags.
Developers
- Learn secure coding by identifying and fixing vulnerabilities in a production-like SPA.
- Understand real-world risks (e.g., how JWT misconfigurations lead to account takeovers).
- Integrate security awareness into development workflows.
Educators & Students
- Teach web security with hands-on labs and structured documentation.
- Supplement coursework with a ready-to-use training platform.
- Encourage collaboration through community contributions and roadmap-driven challenges.
Vulnerabilities Covered
| Category | Examples |
|---|---|
| Injection | SQLi, NoSQLi, OS command injection |
| Broken Authentication | JWT attacks, weak session management, credential stuffing |
| Sensitive Data Exposure | Hardcoded secrets, improper logging, insecure API responses |
| XXE | Malicious XML payloads, file disclosure |
| Broken Access Control | IDOR, privilege escalation, insecure direct object references |
| Security Misconfiguration | Default credentials, exposed debug endpoints, CORS misconfigurations |
| XSS | Stored, reflected, and DOM-based XSS |
| Insecure Deserialization | JavaScript object manipulation, prototype pollution |
| CSRF | Cross-Site Request Forgery with demo payloads |
| API Security | Mass assignment, excessive data exposure, rate-limiting bypasses |
Getting Started
Quick Deployment
npx create-oss-store my-security-lab
cd my-security-lab
npm run dev
Access the application at http://localhost:3000.
Manual Setup
git clone https://github.com/kOaDT/oss-oopssec-store.git
cd oss-oopssec-store
npm run setup # Initializes DB, seeds flags, and starts the app
Project Structure
| Directory | Purpose |
|---|---|
app/ | Next.js pages, API routes, and React components |
app/vulnerabilities/ | Pages documenting each vulnerability (e.g., /vulnerabilities/xss) |
content/vulnerabilities/ | Markdown files with attack vectors, solutions, and learning resources |
prisma/ | Database schema, migrations, and CTF flag seeds |
public/ | Static assets (e.g., exploit payloads, screenshots) |
docs/ | Static documentation site |
Best Practices for Safe Use
- Isolate the environment: Run OopsSec Store in a virtual machine or Docker container to prevent accidental exposure.
- Document findings: Use the built-in vulnerability pages to log exploits and solutions.
- Contribute back: Report bugs, suggest new challenges, or improve documentation via GitHub Issues.
- Combine with tools: Pair with Burp Suite, OWASP ZAP, or Postman for advanced testing.
- Review the disclaimer: Ensure compliance with local laws and ethical guidelines.
Important: This project is for educational and authorized security testing only. The authors are not liable for misuse, damage, or unauthorized access. Always deploy in isolated environments.
Advanced Use Cases
- Red Team Exercises: Simulate real-world attacks in a controlled environment.
- Secure Coding Workshops: Demonstrate secure vs. insecure patterns using the codebase.
- Bug Bounty Preparation: Practice identifying vulnerabilities before participating in public programs.
Learn More
Community Resources
- GitHub Repository
- NPM Package
- ROADMAP.md (Planned features and vulnerabilities)
- CONTRIBUTING.md (How to contribute)
Additional Tools to Pair With
- Burp Suite: For intercepting and modifying HTTP requests.
- OWASP ZAP: Automated vulnerability scanning.
- Postman: API testing and exploitation.
- Docker: For isolated deployment environments.