# Pixi (DevSlop) — practice target

Pixi is a MongoDB-backed vulnerable app from the DevSlop project: BOLA /
cross-user reads, mass assignment of admin, admin functions behind a bare token
check, and a JWT that embeds the user's password.
Project: https://github.com/DevSlop/Pixi (MIT).

> **Experimental — not a one-command `--lab` target.** The only reliable
> prebuilt image (`insecureapps/pixi-app`) applies `csurf` CSRF protection
> *globally*, so every API write (login/register/edit) returns
> `form tampered with`, and no reachable route issues a usable CSRF token for
> the API sub-app (the HTML routes are registered *before* the csurf
> middleware). The result: Pixi's documented bugs can't be driven by the swarm
> — or by a human with curl. We removed it from the one-command target list so
> we don't advertise a target that finds nothing; the compose below still works
> for manual exploration. Re-promoting it needs an image without the global CSRF.

It uses the only prebuilt image (`insecureapps/pixi-app`) — the older **web
build** (server-rendered routes), paired with a one-container Mongo (the app
hardcodes the Mongo host `pixidb`):

```sh
docker compose -f deploy/lab/pixi/docker-compose.yml up -d
```

Two honest caveats:
- The image is **amd64-only**, so it runs under emulation on Apple Silicon
  (fine for a small Node app, just slower).
- This web build exposes server-rendered routes (`/register`, `/login`,
  `/other_users_profile/:id` for BOLA, `/admin/*`), **not** the `/api/*` JSON
  surface that the curated recon profile
  (`internal/agent/recon/apiprofile_pixi.go`) targets. That profile fingerprints
  `/api/pictures`, which 404s here, so it won't fire — the swarm reaches this
  build through its crawl plus the `--verify` sweeps instead.

Prefer the source-built `/api/*` build (what the recon profile curates)? Run it
from upstream and scan the API base:

```sh
git clone https://github.com/DevSlop/Pixi
cd Pixi
docker compose up -d           # builds app (frontend :8000, API :8090), mongo
until curl -sf http://localhost:8090/api/pictures >/dev/null; do sleep 3; done

pentestswarm scan http://localhost:8090 --scope 127.0.0.1/32,localhost --swarm --verify --follow

docker compose down -v
```

Login and register use the body fields **`user`** and **`pass`** (not
email/password), and register accepts an `is_admin` field (the mass-assignment flaw).