auditPlayground 🧪

A curated collection of intentionally vulnerable environments for reproducing and analyzing real-world CVEs and security flaws in isolation — all containerized with Docker. Perfect for learning, hands-on experimentation, security research, and practicing security code review.

---

🔍 Index of Labs

SQL Injection (SQLI)

• CVE-2025-29744 – SQL Injection in pg-promise (Node.js ORM)

Insecure Direct Object Reference (IDOR)

• SWAP – Classic ID swap vulnerability.
• SWAPTWO – ID swap with MD5-hashed file names.
• RacingObject – Race-condition-based IDOR exploiting delayed ownership assignment.

---

💡 More labs coming soon...