WebGoat is a deliberately insecure web application designed for security training, providing hands-on lessons for the OWASP Top 10 vulnerabilities. In production, it operates as a Spring Boot monolith with a modular lesson architecture; each lesson is a self-contained endpoint that simulates a real-world vulnerability (SQL injection, XSS, CSRF, JWT misuse, etc.) and validates the user's attack payload. A companion application, WebWolf, acts as attacker infrastructure (file hosting, JWT encoding/decoding, request logging). The system includes user registration, progress tracking via JPA/Flyway with per-user database schemas, and a Thymeleaf/Backbone.js frontend with multilingual support. External dependencies include H2/HSQLDB, Spring Security, AsciiDoc rendering, and intentionally outdated libraries (e.g., jQuery 2.1.4) to demonstrate specific weaknesses. The architecture is well-structured but carries intentional technical debt for educational purposes. The most reusable components are the WebAuthn support utilities (CBOR, COSE, attestation parsing) and the command execution service, both of which demonstrate non-obvious engineering skill and can be extracted independently.
The repository is a comprehensive platform for AI red teaming education, hosting a series of Capture the Flag (CTF) challenges that target LLM vulnerabilities such as prompt injection, metaprompt extraction, and safety filter bypass. It is built as a modified version of Microsoft's Chat Copilot, integrating a multi-service architecture: a .NET Core chat backend with Semantic Kernel, a React frontend, a load balancer (Go), a scoring service (Flask/Celery), a picture submission service, and a challenge home page. The system is designed to be deployed via Docker Compose or Kubernetes, with each challenge running its own configured chat instance. While primarily an application, the repository also includes Jupyter notebooks using PyRIT for automated red teaming, blending application and research elements. The architecture is modular, with clear separation between services. The chat copilot backend provides real-time chat via SignalR, supports OpenAPI plugins, and integrates with Azure services (CosmosDB, Redis, Blob Storage, Content Safety). The scoring system supports both automatic (regex/LLM) and manual review, with CTFd flag submission. The platform is highly configurable through challenge JSON files, allowing different metaprompts, scorers, RAG inputs, and security settings. This makes it a flexible testbed for red teaming exercises. The repository demonstrates strong engineering practices with reusable components such as a generic repository pattern, authentication handlers, telemetry services, and a load balancer. However, it is tightly coupled to Azure and Semantic Kernel, and some features are intentionally insecure for educational purposes. The codebase is actively maintained and well-documented, making it suitable for both learning and running red teaming events.