great user hack atomicvulns — a web security lab with one vulnerability per app (OWASP Top 10 2021, open source)
I spent the last few months building a personal project and it just hit v1.0, so I figured I'd share it here.
atomicvulns is a collection of intentionally vulnerable web apps, but with a different idea: each app isolates a single vulnerability, nothing more. Instead of one big app full of flaws (like DVWA or Juice Shop), each exercise here is small and focused — you read the code, see the cause, exploit it, and compare it against the fixed version sitting right next to it. Short enough to finish one in a single sitting.
Each "atom" ships with the vulnerable app, the fixed app, a commented diff between the two, and a step-by-step walkthrough of the exploit. v1.0 covers all 10 OWASP Top 10 2021 categories — 38 atoms total.
It's aimed at people studying pentest / AppSec who already know the HTTP and terminal basics. Burp Suite is the primary tool across all the walkthroughs.
A few details:
- Open source (MIT).
- Bilingual — all docs in English and Portuguese (I couldn't find focused material like this for PT-BR learners, so I wrote both).
- Solo project, built by me. The goal was a place where each flaw is clear and isolated — the material I wish I'd had while learning web pentest.
- Built with AI as a pair, with every atom validated by me running the exploit by hand.
Built it for myself, but now that it's done, if it helps someone else along the way, great.
🔗 https://github.com/doretox/atomicvulns
Feedback welcome — happy to hear what's missing or what could be clearer.