Web App Range

The broadest web target: one app, planted weaknesses across every OWASP-style category.

Run a Cracken operation against a deliberately vulnerable web application and see it discover and confirm a spread of common web weaknesses. This range is a single multi-user web app seeded with planted vulnerabilities across the OWASP-style categories.

Authorized lab range — scope strictly to it

https://77.42.79.6/ is a disposable, isolated lab target provided for testing Cracken, and you are authorized to assess it. Point Cracken only at 77.42.79.6. Running the same operation against any other host — including a production system that happens to share that address elsewhere — is unauthorized testing.

Prerequisites

• Access to a realm in your tenant.
• A connected Tentacle with network reach to 77.42.79.6 on port 443.
• Optional: the built-in Web App Pentest Playbook (a system playbook available in every realm).

The target

Property	Value
URL	https://77.42.79.6/ (self-signed certificate — expect a TLS warning)
Type	Multi-user web application with login
Example account	support / 12345

The app ships with several low-privilege accounts and one admin account so the operation can test both unauthenticated and authenticated surfaces. The full credential list is in the appendix.

Run it in Cracken

1. Open or create a realm and confirm a Tentacle is connected.
2. Create a new operation and select the Web App Pentest Playbook, or describe the goal yourself — for example: "Map https://77.42.79.6/, then check for SQL injection, reflected and stored XSS, CSRF, IDOR, remote code execution, and authentication weaknesses. Confirm each finding."
3. Set the target to https://77.42.79.6/.
4. Run the operation. Manual waits for your approval before each action. Semi applies the configured policy and asks before actions it does not allow. Unleashed runs without those policy checks and is intended only for authorized, controlled research or testing.

A common pattern for this range is to let the agent map the app first, then spawn a sub-operation per vulnerability class so each check runs independently.

What to expect Cracken to find

The app has planted weaknesses in these categories. A successful run surfaces them as findings, with the linked hosts, endpoints, and credentials captured in the Cybergraph:

• SQL injection — in the project search, via raw string concatenation in the query.
• Cross-site scripting — reflected XSS in user search and stored XSS in the messaging feature.
• CSRF account takeover — the profile-update form has no anti-CSRF token.
• IDOR — project data is reachable by changing the object id in the URL with no ownership check.
• Remote code execution — command injection in the admin diagnostic panel.
• Authentication weaknesses — username enumeration through distinct login error messages, plus weak, reused passwords.

You have a clean PoC when the operation has confirmed at least one finding in each category and the report lists them with evidence.

Next steps

• Cyber ranges — the full list of lab targets.
• E-commerce web range — another black-box web target.
• Full estate compromise range — move from one web app to a whole network.

Appendix: range reference

Accounts and planted-vulnerability detail (spoilers)

This section is the answer key. Skip it if you want the operation to find everything on its own.

Accounts

Role	Username	Password
Admin	admin	monkey
User	accounting	123456
User	marketing	password
User	sales	12345678
User	hr	qwerty
User	webmaster	123456789
User	support	12345
User	test	1234
User	user	111111
User	john	1234567
User	mike	dragon
User	dragon	123123
User	qwerty	baseball

Planted vulnerabilities

1. SQL injection — blind boolean-based, in the project search. The query concatenates raw input. Probe value: q=test' OR '1'='1.
2. Cross-site scripting
   • Reflected — employee search echoes unsanitized error messages when searching a non-existent user.
   • Stored — messages are saved and rendered without sanitization, affecting inbox and sent views.
3. CSRF account takeover — /profile/update has no CSRF token; a hosted form can change the victim's email and password.
4. IDOR — /api/projects/{id}/details returns any project's data regardless of membership.
5. Remote code execution — command injection in the admin diagnostic panel runs arbitrary system commands.
6. Authentication weaknesses — login returns a different message for a non-existent user versus a wrong password, enabling username enumeration; all accounts use weak, common passwords.

These are target-app routes and behaviors, not Cracken routes.