vuln-bank: Practice Web, API, and AI Security Testing

Overview

Vuln Bank is a deliberately vulnerable banking application that provides a hands-on environment for practicing security testing and secure code review. It combines familiar banking workflows with intentionally flawed web, API, GraphQL, and AI support features.

The project is intended for security learners and practitioners who need a lab for exploring vulnerabilities and testing security workflows. It is not a safe banking product or a template for production software.

Key Features

• Banking workflows including accounts, transfers, loans, transaction history, and bill payments.
• Practice scenarios for authentication, authorization, input handling, file uploads, and transaction logic.
• API and GraphQL endpoints with documented vulnerability-testing areas.
• AI customer support agent with a real LLM option and a mock mode.
• Virtual cards and merchant payment integrations for testing payment-related security flaws.
• Docker Compose setup and a local Python/PostgreSQL installation path.
• Testing guidance for the included vulnerability categories.

Use Cases

• Security students can use the isolated app to explore common web and API vulnerabilities against realistic workflows.
• Developers can practice reviewing intentionally flawed application code and discuss safer implementation patterns.
• QA and security teams can try automation and DevSecOps testing against a controlled target.
• AI security learners can compare prompt-injection and data-disclosure scenarios in authenticated and anonymous chat modes.

Getting Started

With Docker Compose, clone the repository and start the lab:

git clone https://github.com/Commando-X/vuln-bank.git
cd vuln-bank
docker-compose up -d --build

The app is available at http://localhost:5000. See the README for local setup, testing scenarios, and configuration details.

Alternatives

• buffer-overflow-lab: It focuses on demonstrating buffer overflows in a Flask lab, while vuln-bank covers varied banking scenarios across web, API, GraphQL, and AI features.

Considerations

• The application intentionally contains serious vulnerabilities. Run it only in an isolated environment, never on a public network or with real personal data.
• The Docker setup uses the Flask development server with debugging enabled, as part of the training scenarios. Do not treat it as production-ready.
• Local installation requires Python 3.9 or higher and PostgreSQL. Docker is the documented recommended setup.
• The AI agent can use the DeepSeek API, or fall back to mock mode when no API key is configured.