{
 "schema_version": 1,
 "generated": "2026-10-20",
 "id": "martian56-redcell--practice-web-pentesting-on-vulnerable-apps",
 "repo": "martian56/redcell",
 "repo_url": "https://github.com/martian56/redcell",
 "repo_slug": "martian56-redcell",
 "title": "Practice web pentesting on vulnerable apps",
 "page_title": "How to practice web pentesting on vulnerable apps with Redcell",
 "summary": "Aim REDCELL at local intentionally vulnerable apps to learn how agent-driven testing works.",
 "who": "A student or CTF player who wants to see how an agent works through a web app without touching any real system.",
 "problem": "Practice labs are useful, but learning how a full engagement flows from recon to report is hard to see on your own.",
 "outcome": "A completed practice run against DVWA, Juice Shop, or WebGoat with a recorded attack surface, findings, and an exported report to compare with the known weaknesses.",
 "steps": [
  "Start the infrastructure with `docker compose -f docker-compose.dev.yml up -d` and complete the setup commands in the Quickstart.",
  "Start the local practice targets with `docker compose -f docker-compose.targets.yml up -d`.",
  "Open http://localhost:5183, sign in with `admin` / `admin`, and add a provider API key in Settings.",
  "Create a session with a target such as DVWA http://localhost:8081, Juice Shop http://localhost:3000, or WebGoat http://localhost:8082, and start the run.",
  "Use the live console to watch the agent graph, activity feed, and browser, then compare the recorded findings against the known weaknesses of the app."
 ],
 "agent_prompt": "Using the repo martian56/redcell, start the local practice targets from docker-compose.targets.yml and run a session against the Juice Shop at http://localhost:3000. Expected output: a list of recorded findings and an exported JSON report. Verify that the findings reference the local target and not any external host.",
 "agents": [
  "any"
 ],
 "difficulty": "Intermediate",
 "time": "1 hour",
 "basis": "readme",
 "caveat": "The practice targets are intentionally vulnerable, so keep them on localhost and do not expose them to a network you do not control.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "python",
 "requirements": [
  "Docker installed and able to pull the Kali image ghcr.io/martian56/redcell-kali:latest",
  "uv and bun installed for the Python and frontend processes",
  "A provider API key added in the Settings page (any LiteLLM-supported model)",
  "Written authorization and a defined scope for every target you test"
 ],
 "risk": "dual-use",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [],
 "best": false,
 "score": 0.9,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/martian56-redcell/practice-web-pentesting-on-vulnerable-apps/",
 "md": "https://dedupedai.com/use-cases/martian56-redcell/practice-web-pentesting-on-vulnerable-apps/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/martian56-redcell--practice-web-pentesting-on-vulnerable-apps.json",
 "api_version": "v1"
}