# Practice targets — test index

Every bundled / supported vulnerable target, and exactly how to run the swarm
against it. Add `--verify` to confirm findings against the live target.

## A. One command (`--lab`) — image pulled, scoped to loopback, auto torn down

```sh
pentestswarm scan --lab --lab-target juiceshop  --verify --follow
pentestswarm scan --lab --lab-target crapi      --verify --follow
pentestswarm scan --lab --lab-target vampi      --verify --follow
pentestswarm scan --lab --lab-target dvga       --verify --follow
pentestswarm scan --lab --lab-target dvwa       --verify --follow   # first run: /setup.php (admin/password)
pentestswarm scan --lab --lab-target webgoat    --verify --follow   # slow Spring boot
pentestswarm scan --lab --lab-target bwapp      --verify --follow   # first run: /install.php (bee/bug)
pentestswarm scan --lab --lab-target mutillidae --verify --follow   # first run: /set-up-database.php
pentestswarm scan --lab --lab-target tiredful   --verify --follow   # DRF API under /api/v1/ (SQLite, self-contained)
pentestswarm scan --lab --lab-target nodegoat   --verify --follow   # Express/Mongo; register at /signup (DB auto-seeded on boot)
```

Deterministic, model-independent attack playbooks (verified live) ship for
**crapi, vampi, dvga, nodegoat** — these land known criticals every run with no
LLM/internet, so they are the demo-reliable targets. The others rely on recon +
the LLM swarm + `--verify` sweeps.

## B. Recon API profile — run the app (see per-target README), then scan its base URL

Recon auto-fingerprints these and feeds the exploit/--verify agents the curated
endpoint pack. These stay "run from upstream" because no trustworthy prebuilt
image makes them a reliable one-command target (see each README for why).

| Target | Run instructions | Scan |
|---|---|---|
| vAPI (roottusk) | `deploy/lab/vapi/README.md` | `pentestswarm scan http://localhost:8000 --scope 127.0.0.1/32,localhost --swarm --verify --follow` |
| Hackazon (rapid7) | `deploy/lab/hackazon/README.md` | `pentestswarm scan http://localhost:8083 --scope 127.0.0.1/32,localhost --swarm --verify --follow` |

## C. OpenAPI auto-discovery / crawl + sweeps — SPA-fronted (no curated profile)

Recon discovers the self-published OpenAPI spec (or crawls) and the `--verify`
sweeps (SSRF / SSTI / command-injection / 403-bypass) fire on discovered
endpoints.

| Target | Run instructions | Scan |
|---|---|---|
| DVWS-node | `deploy/lab/dvws/README.md` | `pentestswarm scan http://localhost --scope 127.0.0.1/32,localhost --swarm --verify --follow` |
| brokencrystals | `deploy/lab/brokencrystals/README.md` | `pentestswarm scan http://localhost:3000 --scope 127.0.0.1/32,localhost --swarm --verify --follow` |

## Experimental (not wired as targets)

- **Pixi (DevSlop)** — `deploy/lab/pixi/` still boots for manual exploration, but
  it is **not** a `--lab` target: the only prebuilt image applies `csurf` CSRF
  protection globally and hands out no usable token, so its API bugs can't be
  driven by the swarm (or curl). Re-promoting it needs a CSRF-free image. See the
  README.

## Deferred

- **OWASP Benchmark** — a synthetic Java test-case suite for scoring DAST/SAST
  *accuracy*, not a "find a real bug" demo target. It needs a scorecard harness
  (expected-result mapping), which is a separate build; deliberately not added
  as a scan target.