buffer-overflow-lab: Demonstrate Web Application Buffer Overflows

Overview

buffer-overflow-lab is an intentionally vulnerable web application packaged for controlled demonstrations of buffer overflow behavior. It gives learners and instructors a practical setting to explore how different input sizes affect an application, rather than relying only on theory.

The project is intended for educational security training, not deployment as a production service. Its Docker-based setup and exploit script support guided exercises in an isolated environment.

Key Features

• Flask web interface for manual input testing.
• Automated Python exploit demonstration script.
• Scenarios covering normal input, boundary cases, and increasingly aggressive overflow tests.
• Docker and Docker Compose setup for running the lab.
• Resource-limited container environment with no privilege escalation.
• Threading support for concurrent attack simulation.

Use Cases

• Instructors can use it to demonstrate input-handling vulnerabilities in secure software development courses.
• Students can compare normal, boundary, and oversized inputs in a controlled web application.
• Security learners can observe how an automated script exercises a vulnerable endpoint.
• Developers can use the lab to discuss why intentionally vulnerable applications must be isolated from production systems.

Getting Started

With Docker and Docker Compose installed, clone the repository and start the lab:

git clone https://github.com/0x4m4/buffer-overflow-lab.git
cd buffer-overflow-demo
docker-compose up --build

See the README for prerequisites and instructions for running the exploit script.

Alternatives

• vuln-bank: vuln-bank is a vulnerable banking app for practicing web, API, and AI security testing, rather than a focused buffer overflow lab.

Considerations

This application intentionally contains vulnerable code and must not be exposed to production or untrusted networks. Docker and Docker Compose are needed to run the web application, and Python with the requests package is needed for the exploit script. The README describes a controlled educational lab, not a hardened or production-ready service.