Security PS created an intentionally vulnerable ASP.NET MVC application with the goal of mimicking common flaws found in applications we assess. Both new and experienced security professionals can use this application to test their skill in bypassing steps of the authentication process and compromising other users' accounts. If you would like to start a career in software security, you live in the Kansas City area, and you're interested in working at Security PS then reach out by visiting: https://www.securityps.com and clicking "Contact Us".

Several accounts are created already to test with. Their details are below:

UsernamePasswordSSNAccount NumberAccount Balance
test1@test.comPassw0rd1!1231212311111111111.11
test2@test.comPassw0rd2!1231212322222222221.12
test3@test.comPassw0rd3!1231212333333333331.13
test4@test.comPassw0rd4!1231212344444444441.14

Also, there are three accounts you can attempt to compromise. They have been created with a random password, SSN, account number, and account balance. The username is of the format target###@test.com where the ### is a random three digit number (i.e. target853@test.com).

At first, practice finding vulnerabilities with the test1@test.com through test4@test.com. Try to skip process steps and compromise those accounts. Then move on to the target accounts. You can try things like:

Some of the exploits require you to use a proxy tool such as Burp Suite, OWASP ZAP, or Fiddler to exploit. Depending on your platform, you may have to add a host entry to be able to proxy traffic properly. On Windows add an entry to c:\windows\system32\drivers\etc\hosts such as:

127.0.0.1 application.local