🏦 Acme Pay — payments API

Origin app, intentionally vulnerable. Served on pod payments-api-7b9ccbfbd6-cf66f.

The same origin sits behind two hostnames so you can see a WAF's effect: open (no WAF) vs secure (wslproxy WAF, block mode).

Classic web (OWASP)

• Reflected XSS — /search?q=laptop
• SQL injection — /products?cat=deposit
• Path traversal / LFI — /statement?file=welcome.txt
• OS command injection — /ping?host=127.0.0.1
• Server-side template injection — /render?tpl=Hello

Named CVEs & SSRF (beyond the Top 10)

• Log4Shell / JNDI (CVE-2021-44228) — /lookup?user=guest
• Spring4Shell (CVE-2022-22965) — /bind?class.module.classLoader=x
• SSRF → cloud metadata — /fetch?url=https://acme.example/logo.png

API security

• NoSQL injection auth bypass — POST /api/login {"user":"admin","pass":{"$ne":null}}
• BOLA / IDOR — GET /api/accounts/9999
• Mass assignment — POST /api/profile {"role":"admin"}
• JWT alg:none forgery — GET /api/me with a forged bearer token
• XXE — POST /api/import (XML)
• GraphQL introspection — POST /graphql
• Prototype pollution — POST /api/merge {"__proto__":{"admin":true}}
• Open redirect — /api/redirect?to=https://evil.example
• HTTP request smuggling — POST /api/batch with a pipelined GET /admin HTTP/1.1