awesome-vulnerable-apps

ification syntax" but FWIU there's not a way to specify unsigned or signed cryptographic hashes, which e.g. Pipfile.lock supports: hashes for every variant of those versions of packages on {PyPI, and third-party package repos with TUF keys, too}. From https://pipenv.pypa.io/en/latest/basics/#pipenv-lock : $ pipenv lock > pipenv lock is used to create a Pipfile.lock, which declares all dependencies (and sub-dependencies) of your project, their latest available versions, and the current hashes for the downloaded files. This ensures repeatable, and most importantly deterministic, builds "Reproducible builds" of a DVWA Deliberately Vulnerable Web Application is a funny thing: https://en.wikipedia.org/wiki/Reproducible_builds Replication crisis https://en.wikipedia.org/wiki/Replication_crisis : > The replication crisis (also called the replicability crisis and the reproducibility crisis) is an ongoing methodological crisis in which it has been found that the results of many scientific studies are difficult or impossible to reproduce. Because the reproducibility of empirical results is an essential part of the scientific method,[2] such failures undermine the credibility of theories building on them and potentially call into question substantial parts of scientific knowledge. Just rebuilding or re-pulling a container image does not upgrade the versions of software installed within the container. See also: SBOM, CycloneDx, #LinkedReproducibility, #JupyterREES. `podman-pull` https://docs.podman.io/en/latest/markdown/podman-pull.1.html... ~: podman image pull busybox podman pull busybox docker pull busybox podman pull busybox centos fedora ubuntu debian "How to rebuild and update a container without downtime with docker-compose?" https://stackoverflow.com/questions/42529211/how-to-rebuild-... : docker-compose up -d --no-deps --build #[servicename] "Statistics-Based OWASP Top 10 2021 Proposal" https://dzone.com/articles/statistics-based-owasp-top-10-202... awesome-vulnerable-apps > OWASP Top 10 https://github.com/vavkamil/awesome-vulnerable-apps#owasp-to... : > OWASP Juice Shop: Probably the most modern and sophisticated insecure web application And there's a book, an Open Source Official Companion Guide book titled "Pwning Juice Shop": https://github.com/juice-shop/juice-shop#official-companion-... If the versions installed in the book are outdated, you too can bump the version strings in the dependency specs in the git repo and send a PR Pull Request (which also updates the Screenshots and Menu > Sequences and Keyboard Shortcuts in the book&docs); and then manually test that everything works with the updated "deps" dependencies. If it's an executablebooks/, a Computational Notebook (possibly in a Literate Computing style), you can "Restart & Run all" from the notebook UI button or a script, and then test that all automated test assertions pass, and then "diff" (visually compare), and then just manually read through the textual descriptions of commands to enter (because people who buy a Book presumably have a reasonable expectation that if they copy the commands from the book to a script by hand to learn them, the commands as written should run; it should work like the day you bought it for a projected term of many free word-of-mouth years. From https://github.com/juice-shop/juice-shop#docker-container : docker pull bkimminich/juice-shop docker run --rm -p 3000:3000 With podman [desktop], podman pull bkimminich/juice-shop podman run --rm -p 3000:3000 -n juiceshop0