One of the biggest hurdles for anyone trying to get into offensive security isn't motivation — it's finding somewhere legal to practise. Scanning a real website without written authorization is a criminal offence in most jurisdictions, and the handful of well-known vulnerable-by-design apps out there (DVWA, WebGoat, bWAPP) all run locally, meaning you need Docker, Java, or PHP set up correctly before you've even sent your first payload.

HackDrac is my answer to that friction: an intentionally vulnerable web application hosted live at hackdrac.abbytes.in, built specifically so beginners, students, and aspiring bug bounty hunters have a real, browser-accessible target to attack — no local setup required.

HackDrac is deliberately broken and exists purely for education. Every vulnerability in it is intentional and safe to exploit. Please keep all testing scoped to hackdrac.abbytes.in — never point these same techniques at systems you don't own or have explicit written permission to test.

Why Build Another Vulnerable App?

Most of the existing training platforms teach the theory of a vulnerability class well, but they rarely mirror how these bugs actually show up in production apps — buried behind a login flow, a multi-step form, or an API that only returns useful output once you've chained two smaller mistakes together. HackDrac was designed to sit in that gap: realistic enough to build genuine intuition, but safe and contained enough that a complete beginner can't break anything (including themselves).

It's also hosted permanently, which matters more than it sounds. A lot of learners lose momentum the moment a lab requires them to install a VM or fight with Docker networking before they've even started hacking. With HackDrac, the barrier to entry is a browser tab.

What You Can Practise

HackDrac ships with a set of classic — but still extremely common in the wild — vulnerability classes:

SQL Injection

Login forms and search fields that build queries by string concatenation instead of parameterized statements. A great place to build intuition for how a single unescaped quote can turn a WHERE clause against the developer, e.g. testing an input like ' OR '1'='1 against a login field and watching authentication logic fall apart.

Cross-Site Scripting (XSS)

Reflected and stored injection points where user input is rendered back into the page without sanitisation. Good for practising payload construction beyond the classic <script>alert(1)</script> — think event-handler based payloads and filter bypasses once basic tags get stripped.

Insecure Direct Object References (IDOR)

Endpoints that trust a client-supplied identifier without checking whether the logged-in user actually owns that resource. This is one of the most common — and most underrated — bug classes in real bug bounty programs, and HackDrac gives you a sandbox to get comfortable spotting it by simply incrementing or swapping IDs in requests.

Broken Authentication & Session Management

Weak session tokens, missing rate limiting, and logic flaws around login and password-reset flows — the kind of issues that don't show up in an automated scanner report but get flagged immediately by a human doing manual testing.

  • Realistic flow: vulnerabilities are woven into an actual login → dashboard → action flow, not isolated one-off text boxes.
  • No setup required: it's live at a public subdomain, so you can start testing from any browser.
  • Safe by design: nothing on the app is production data or connected to anything sensitive — break it as much as you want.

How to Approach It

If you're new to this, resist the urge to immediately reach for automated scanners. The whole point of a lab like HackDrac is to build manual testing instinct — the same instinct that separates a report full of false positives from one that actually gets paid out on a bug bounty program. A suggested workflow:

  1. Map the app first. Click through every page, form, and link as a normal user would. Note every place user input reaches the server — that's your attack surface.
  2. Intercept traffic with Burp Suite (Community Edition is free) or OWASP ZAP, and route your browser through the proxy so you can see and modify every request before it leaves your machine.
  3. Test one vulnerability class at a time. Don't try to find everything at once — pick SQL injection first, exhaust the login form and any search functionality, then move on to XSS.
  4. Read the response, not just the page. A lot of injection bugs give themselves away in a stack trace, an error message, or a response length difference long before you see anything change visually.
  5. Write it down. Practise documenting what you find the way you would in a real report: the request, the payload, the impact. This habit alone will make you a stronger candidate for bug bounty and junior pentest roles.
# Example: routing curl through Burp's proxy to poke at an endpoint manually
curl -x http://127.0.0.1:8080 -k http://hackdrac.abbytes.in/login \
  -d "username=admin&password=' OR '1'='1"
Payloads like the one above are shown purely as illustration of the vulnerability class and are only intended for use against HackDrac itself.

Who This Is For

  • Students and self-learners working through OWASP Top 10 concepts who want a real target instead of just reading about them.
  • Aspiring bug bounty hunters looking to build manual testing muscle before touching a live scope on HackerOne or Bugcrowd.
  • Developers who want to see, first-hand, how the mistakes they make in code translate into exploitable bugs — often the fastest way to internalise secure coding practices.
  • CTF players warming up on web categories before a competition.

Conclusion

Practising offensive security shouldn't require a local lab environment or a legal grey area. HackDrac exists so that anyone curious about how SQL injection, XSS, IDOR, and broken authentication actually work can go try it themselves, safely and legally, at hackdrac.abbytes.in. The source is also available on GitHub if you'd rather spin up your own local copy or study how the vulnerabilities were implemented.

If you end up finding something that feels like a real-world-grade bug on HackDrac, you're already thinking the way a professional penetration tester does — and if you'd rather have that skillset applied to your own application, that's exactly what I do for a living.