# brokencrystals (NeuraLegion/BrightSec) — practice target

brokencrystals is a modern, API-heavy vulnerable app (NestJS + React) built to
exercise a broad span of real API flaws: SSRF, XXE, SSTI, path traversal, JWT
attacks (alg confusion, weak secret, JWK/JKU), mass assignment, SQL/NoSQL
injection, open redirect, XML and more. Project:
https://github.com/NeuraLegion/brokencrystals (its own license).

**No recon profile:** the app is served as a single-page React client, so its
root returns `index.html` (200) for any path — which the profile fingerprint's
negative-control guard correctly refuses (it can't tell real routes from
garbage). Instead, the swarm reaches brokencrystals through recon's crawl of the
app plus the `--verify` sweeps (SSRF / SSTI / command-injection / 403-bypass fire
on discovered endpoints regardless of a curated profile). The app also serves its
own OpenAPI at `/api/spec` — a rich map of the attack surface.

It uses prebuilt images (no local build), but the full stack is heavy (Keycloak
+ two Postgres + a gRPC proxy + a local LLM):

```sh
git clone https://github.com/NeuraLegion/brokencrystals
cd brokencrystals
docker compose -f compose.yml up -d        # pulls brightsec/brokencrystals + deps
until curl -sf http://localhost:3000/ >/dev/null; do sleep 5; done

# browse http://localhost:3000/api/spec for the endpoint map, then:
pentestswarm scan http://localhost:3000 --scope 127.0.0.1/32,localhost --swarm --verify --follow

docker compose -f compose.yml down -v
```

Flagship endpoints to point manual tests at (confirm against `/api/spec`):
`/api/file?path=` (path traversal / SSRF), `/api/render` (SSTI),
`/api/auth/jwt/*` (JWT attacks), `/api/users/one/{email}` (user enumeration).