feat: add OWASP VulnerableApp as a CTF/training service

[t0kubetsu]

Proposal

Add OWASP VulnerableApp (by SasanLabs) to the catalog as a deployable CTF/web-security training service.

What is VulnerableApp?

OWASP VulnerableApp is a modular, deliberately vulnerable Spring Boot application designed for:

• Security scanner benchmarking — ships a built-in comparator that grades DAST/SAST scanners against ground truth
• CTF / hands-on training — covers a wide set of OWASP Top 10 vulnerabilities across realistic web app patterns
• Repeatable, deterministic scenarios — ideal for structured training sessions on a cyber range

Latest release: v2.0.1 (2026-03-29) · 402 stars · 70 contributors · Apache-2.0 license · actively maintained

Covered vulnerability types

Category	Examples
Injection	SQL Injection (Error/Union/Blind), Command Injection, LDAP Injection
XSS	Reflected XSS, Persistent XSS
Broken Auth	JWT Vulnerabilities, Authentication flaws
Sensitive Data	Cryptography Failures, File Upload
Access Control	IDOR, Path Traversal, SSRF
Misc	XXE, Open Redirect, Clickjacking

Suggested integration

• Docker stack under 03_container_layer/docker/_ctf/vulnerableapp/ — official image available at sasanlabs/owasp-vulnerableapp
• Ansible role under 02_ansible_layer/_ctf/vulnerableapp/ to deploy and configure the service on trainee VMs

Minimal docker-compose.yml:

services:
  vulnerableapp:
    image: sasanlabs/owasp-vulnerableapp:latest
    ports:
      - "9090:9090"

Full stack (with modern UI via VulnerableApp-facade): use the upstream docker-compose.yml which adds facade + JSP + PHP services and exposes the UI at http://localhost.

Why it fits range42

• Drop-in Docker deployment aligns with existing catalog structure
• Modular vulnerability design maps well to scenario-based exercises
• The built-in scanner benchmarking endpoint (POST /VulnerableApp/scanner/benchmark) could be leveraged for automated scoring in gamification scenarios
• Apache-2.0 license — no restrictions on use in a training platform

References

• GitHub: https://github.com/SasanLabs/VulnerableApp
• Docker Hub: https://hub.docker.com/r/sasanlabs/owasp-vulnerableapp
• Docs: https://sasanlabs.github.io/VulnerableApp
• OWASP project page: https://owasp.org/www-project-vulnerableapp/