rapid7/hackazon

Health v2 · maintenance only

Flags: no_releases archived

Adoption not part of the score

1038 stars · 382 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Hackazon is a deliberately vulnerable online storefront web application built with PHP, AJAX, and RESTful APIs. It serves as a training and testing ground for IT security professionals to practice discovering vulnerabilities like SQL injection and cross-site scripting.

Use cases

• practice exploiting sql injection on a realistic web app
• test web application security scanners against a vulnerable target
• train security teams on xss and api vulnerabilities
• test rest api security testing tools
• set up a safe vulnerable storefront for pentest practice
• learn to secure shopping cart workflows

When to choose

• you need a realistic vulnerable web application for security testing or training
• you want to evaluate web app scanners and DAST tools against AJAX and REST interfaces
• you are teaching application security with hands-on exploitation exercises

When to avoid

• you need a production or secure e-commerce platform
• you require modern PHP versions or actively maintained dependencies
• you want a currently developed project with recent updates

Facets

application · maturity maintenance

security web-framework http-server security web-development penetration-testing php vulnerable-web-app security-training pentest-target sql-injection xss rest-api deliberately-insecure linux web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="rapid7/hackazon")