brokencrystals

Overview

Broken Crystals is an intentionally vulnerable benchmark application built with a React frontend and a Node.js/PostgreSQL backend. It implements numerous common security flaws including broken JWT authentication, XSS, CSRF, insecure cookies, directory listing, and weak password brute-forcing, making it an ideal target for testing automated security scanners like SecTester.

Capabilities

• ▸Implements broken JWT authentication vulnerabilities (none algorithm, RSA-to-HMAC, invalid signature, KID manipulation, brute forcing, rogue keys)
• ▸Provides endpoints vulnerable to reflective, persistent, and DOM-based XSS
• ▸Demonstrates CSRF and misconfigured CORS policies
• ▸Exposes common sensitive files and directory listings
• ▸Supports automated testing via SecTester and Jest

Best for

Benchmarking web application security scanners, Testing automated penetration testing tools, Learning and demonstrating web application vulnerabilities, Practicing security exploitation and mitigation techniques

Security considerations

This skill references a benchmark application containing intentional and severe security vulnerabilities. It should never be deployed to a public or production environment without strict isolation.

Categories