Skip to main content

​
Overview

Want to see MindFort in action before testing your own applications? These intentionally vulnerable web applications let you evaluate MindFort’s capabilities in a safe environment.
Internet Access Required: MindFort needs to access your target over the internet. These apps run locally via Docker, so you’ll need to expose them through a tunnel service (like ngrok, Cloudflare Tunnel, or similar) or deploy them to a cloud server with a public domain.

​
Quick Setup Steps

  1. Run the app locally using Docker
  2. Expose to internet via tunnel or cloud deployment
  3. Point a domain you control at the exposed app
  4. Add as target in MindFort and run an assessment

​
OWASP Juice Shop

The gold standard for modern web app testing. A fully functional e-commerce store with real vulnerabilities in a modern Single Page Application architecture. Tech Stack: Node.js, Express, Angular, SQLite What It Tests: XSS, injection vulnerabilities, authentication flaws, business logic issues 
docker run --rm -p 3000:3000 bkimminich/juice-shop
Local URL: http://localhost:3000

Repository

juice-shop/juice-shop

​
AltoroJ (Banking Application)

A classic enterprise banking application simulating account transfers and transaction history. Ideal for testing session management and business logic exploits. Tech Stack: Java, JSP, Apache Tomcat What It Tests: Authentication bypass, session management, business logic flaws 
docker run -d -p 8080:8080 jasonhubs/altoroj:3.1.1
Local URL: http://localhost:8080/altoro Default Credentials: jsmith / demo1234 or admin / admin

Repository

HCL-TECH-SOFTWARE/AltoroJ

​
Hackazon (E-Commerce)

A rich e-commerce application with mobile API backend and AJAX-driven features. Designed specifically for automated security testing. Tech Stack: PHP, MySQL, JavaScript What It Tests: SQL injection, XSS, REST API vulnerabilities, AJAX security 
docker run -d -p 8081:80 mutzel/all-in-one-hackazon:postinstall supervisord -n
Local URL: http://localhost:8081

Repository

rapid7/hackazon

​
Broken Crystals (Modern React App)

A modern “crystal shop” with React frontend and GraphQL/REST backend. Excellent for testing modern API discovery and SPA crawling. Tech Stack: React, Node.js, GraphQL, PostgreSQL What It Tests: GraphQL vulnerabilities, modern API security, React SPA issues 
git clone https://github.com/NeuraLegion/brokencrystals.git
cd brokencrystals
docker compose --file=compose.local.yml up -d
Local URL: http://localhost:3000

Repository

NeuraLegion/brokencrystals

​
Damn Vulnerable Bank (API-First)

A banking API backend perfect for testing API logic flaws without a heavy UI. Focus on IDOR, authentication, and JWT vulnerabilities. Tech Stack: Python, Flask What It Tests: API logic flaws, IDOR, JWT vulnerabilities, improper authorization 
git clone https://github.com/rewanthtammana/Damn-Vulnerable-Bank.git
cd Damn-Vulnerable-Bank/backend
docker build -t dvb-backend .
docker run -d -p 5000:5000 dvb-backend
Local URL: http://localhost:5000

Repository

rewanthtammana/Damn-Vulnerable-Bank

​
Comparison Table

ApplicationTypeComplexityBest For
Juice ShopE-CommerceHighModern SPAs, DOM XSS, business logic
AltoroJBankingMediumLegacy flows, authentication, sessions
HackazonE-CommerceHighAJAX, REST APIs, SQL injection
Broken CrystalsE-CommerceHighGraphQL, React, API discovery
Damn Vuln BankBanking APIMediumAPI logic, IDOR, JWT

​
Exposing to the Internet

MindFort requires internet-accessible targets. Here are your options:

​
Option 1: Tunnel Service (Quickest)

Use ngrok, Cloudflare Tunnel, or similar to expose your local app: 
# Example with ngrok
ngrok http 3000
This gives you a public URL like https://abc123.ngrok.io that you can use as your MindFort target.

​
Option 2: Cloud Deployment

Deploy to a cloud provider (AWS, GCP, Azure, DigitalOcean) with a public IP, then point your domain at it.

​
Option 3: Self-Hosted Server

Run Docker on a server with a public IP and configure your domain’s DNS to point to it.
Domain Verification: You’ll need to verify domain ownership in MindFort before running assessments. Make sure you control the domain pointing to your test application.

​
Tips for Testing

  • Start with Juice Shop - It’s the most comprehensive and well-documented
  • Use Turbo mode - Quick assessments are perfect for evaluation
  • Add authentication - Test with the default credentials for deeper coverage
  • Compare results - These apps have known vulnerabilities you can verify MindFort finds
All these applications start in a vulnerable state immediately—no setup wizards or challenge selection required. MindFort can crawl and test them as real applications.