zhuifengshaonianhanlu/pikachu

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

4504 stars · 797 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Pikachu is a deliberately vulnerable PHP/MySQL web application designed as a practice range for learning web security and penetration testing. It contains scenario-based exercises covering common vulnerability classes such as XSS, SQL injection, CSRF, RCE, file inclusion/upload, SSRF, XXE, and privilege escalation.

Use cases

• practice exploiting sql injection on a safe local target
• learn xss with guided scenarios and hints
• set up a vulnerable web app for security training
• practice csrf and ssrf exploitation in a lab
• teach web penetration testing to students
• test burp suite and other pentest tooling against known flaws

When to choose

• you are learning web penetration testing and need a hands-on vulnerable target
• you want scenario-based exercises with hints for many vulnerability classes
• you want a quick dockerized security lab

When to avoid

• you need a modern stack - the author recommends the Java/Spring-based MadRabbit successor instead
• you want a production or real application - it is intentionally insecure
• you cannot run PHP/MySQL locally or in a container

Facets

application · maturity maintenance

security penetration-testing web-framework security penetration-testing web-development education php self-hosted vulnerable-app ctf security-training practice-range deliberately-insecure xss sql-injection csrf ssrf web-server docker linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="zhuifengshaonianhanlu/pikachu")