OWASP VulnerableApp-Facade
OWASP VulnerableApp-Facade - An OWASP incubator project
About OWASP VulnerableApp-Facade
VulnerableApp-facade is a small component which acts as a webserver and a gateway. It routes the calls to different Vulnerable Applications which are registered with it based on a url pattern. It also exposes a schema/contract (Vulnerability Definition) and if a vulnerable application adhere to that then it will be able to intract and route the traffic to that vulnerable application. It also provides the generic skeleton UI which it builds by reading the provided schema (Vulnerability Definition) from the vulnerable application and then loads the UI specific to vulnerable application inside the skeleton UserInterface.
VulnerableApp-facade is a farm of vulnerable applications where each application runs as a docker container. VulnerableApp-facade has docker-compose.yml file which contains docker configuration of other vulnerable applications along with docker configuration of VulnerableApp-facade.
In order to run entire suit please download and install Docker Compose. After installation, please copy the docker-compose.yml and run the following command from terminal:
docker-compose up
Then navigate to http://localhost:80 to play with the application
As docker-compose.yml contains all the applications which adhere to the schema of VulnerableApp-facade so in cause you are looking for specific vulnerable applications like only Java related vulnerable applications then remove other vulnerable applications from docker-compose.yml and then run steps as mentioned in the Simple start step.
VulnerableApp-facade have majorly 2 components:
React UI component is used to load the skeleton UserInterface and Lua module is used to merge the Vulnerability Definitions exposed by different vulnerable applications.
In order to do changes in React UI component,
Make sure that the application docker is running such that you can verify the changes.
In order to make changes in Lua module, the easy way is to add the changes in the lua files and build the docker image with those changes
by executing command: docker build . -t owasp-vulnerableapp-facade and then run the project as mentioned at How to run the project
Before raising the PR with UI changes please execute npm run pretty command in facade-app folder to auto handle formatting of javascript/typescript files.
Please raise a github issue for enhancement/issues in VulnerableApp-facade or send email to [email protected] regarding queries
we will try to resolve issues asap.
Project Resources
Project Leaders
Project Information
Incubator Project
Classification
Other
Language
Java
License
Apache License 2.0
Contributors
96
GitHub Stars
467
Downloads
4772
Corporate Supporters
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
Quick Links
Legal & Governance
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.