A hands-on, interactive security lab built with Next.js 14 that lets you attack and fix real vulnerabilities side-by-side.
👉 seclab.vercel.app ← Deploy your own below
| Lab | Vulnerability | CWE | Severity |
|---|---|---|---|
| XSS | Cross-Site Scripting | CWE-79 | HIGH |
| SQLi | SQL Injection | CWE-89 | CRITICAL |
| CSRF | Cross-Site Request Forgery | CWE-352 | MEDIUM |
| IDOR | Insecure Direct Object Reference | CWE-639 | HIGH |
Each lab features:
- ✅ Live attack demos — payloads that actually work
- ✅ Side-by-side comparison — vulnerable vs secure code
- ✅ Inline code snippets — see the exact fix
- ✅ Real API routes — not mocked, actual Next.js backend
- Next.js 14 (App Router)
- TypeScript
- better-sqlite3 (in-memory database)
- CSS Modules (no UI framework)
- Deployed on Vercel
git clone https://github.com/YOUR_USERNAME/security-lab.git
cd security-lab
npm install
npm run devnpm i -g vercel
vercel --prod- Push to GitHub
- Go to vercel.com/new
- Import this repo
- Click Deploy — no env vars needed!
The app uses an in-memory SQLite database — no external database required.
security-lab/
├── app/
│ ├── page.tsx # Landing page
│ ├── xss/page.tsx # XSS lab
│ ├── sqli/page.tsx # SQL Injection lab
│ ├── csrf/page.tsx # CSRF lab
│ ├── idor/page.tsx # IDOR lab
│ └── api/
│ ├── xss-vulnerable/ # Raw innerHTML route
│ ├── xss-secure/ # Escaped output route
│ ├── sqli-vulnerable/ # String concat SQL route
│ ├── sqli-secure/ # Parameterized query route
│ ├── csrf-vulnerable/ # No token check route
│ ├── csrf-secure/ # Token validated route
│ ├── users-vulnerable/ # No auth check route
│ └── users-secure/ # Ownership check route
├── components/
│ └── LabShell.tsx # Shared lab layout
└── lib/
└── db.ts # In-memory SQLite setup
This project is intentionally vulnerable for educational purposes only. All exploits are sandboxed within this demo UI. No real data is stored. The in-memory database resets on every server restart. Do not use these patterns in production code.
PRs welcome! Ideas for new labs:
- Command Injection (CWE-78)
- XXE (CWE-611)
- SSRF (CWE-918)
- Broken Authentication
- Path Traversal
MIT — use freely for learning and teaching.