$ show zhuifengshaonianhanlu/pikachu
Pikachu is a deliberately vulnerable web application built as a training ground for web penetration testing, covering common security flaws such as SQL injection, XSS, CSRF, RCE, file inclusion, unsafe file upload/download, SSRF, XXE, and deserialization. It is a LAMP stack (PHP + MySQL + Apache) monolith using a legacy Ace Admin template and Bootstrap 3. The codebase is organized into vulnerability categories under `/vul/`, a main application for navigation and configuration, and a separate XSS management backend (`/pkxss/`) for collecting stolen cookies, phishing credentials, and keystrokes. The project intentionally uses insecure coding patterns (e.g., raw SQL concatenation, `eval()`, `unserialize()` on user input) to demonstrate exploitation, and includes some secure alternatives for comparison. The repository is explicitly marked as 'asleep' by its authors, who recommend a successor project. It is not suitable for production deployment but serves as a valuable educational resource for security students and CTF players.
The LLM identified 2 files worth highlighting for reuse:
Contains three progressively more secure file upload handlers (`upload_client`, `upload_sick`, `upload`) that demonstrate client-side-only validation, MIME-type-only validation, and comprehensive validation (extension, MIME, and content inspection). This pattern is self-contained and could be extracted to teach or implement layered upload security, with minimal dependencies on the rest of the application.
Provides standalone utility functions for captcha generation (`vcode`, `vcodex`), CSRF token creation (`set_token`), and session-based login checks. The captcha functions use GD library and are fully self-contained; they can be reused in any PHP project requiring image-based CAPTCHA. The CSRF token pattern is also a reusable security building block.