IscteSpot

A Damn vulnerable SaaS application for ISCTE - Software and Application Security

About The Project

This project is targeted to the students of ISCTE that are enlisted in Software and Application Security course subject. The students will use this project to understand the implications of security in modern web applications and understand the risks on the business level.

Getting Started

There are 2 options to run the application, you can use Docker or you can install and run it locally. Below there will be 2 sections with installation steps for both cases. First you can git clone this project to your desired location:

git clone https://github.com/narfasec/isctespot.git

Docker (Quick start)

Install Docker, if not installed in your system.

• After installing docker, make sure docker deamon is running (opening the desktop app of Docker is enough)
• Change directory to iscte_spot and execute docker compose to build and start the project

  cd iscte_spot/
  docker-compose up --build
  

• Execute the setup script (setup.ps1 for windows, setup.sh for Mac and Linux) to populate the database with testing data.

  .\setup.ps1
  

• At this stage your app should be ready. You can run health checks to check if everything is in order. You can go to you browser and paste http://localhost:5173 and see the application interface.

  docker exec project-server-1 python /app/tests/health_checks/test_flow_1.py
  

Local Setup (Manual Installation)

Below are the steps to setup the project on your local environment. This is also the developer setup, with this setup you can easily make changes and debug issues.

Prerequisites

• Python 3.9+ - Download from python.org
• Node.js 18+ - Download from nodejs.org
• MariaDB - Download from mariadb.com
• npm - Usually comes with Node.js

Installation Steps

1. Clone the repository

   git clone https://github.com/narfasec/isctespot.git
   cd isctespot/

2. Set up MariaDB

   • Install MariaDB on your system

3. Set up Python environment

   cd server/
   python -m venv venv
   
   # Windows
   venv\Scripts\activate
   # Linux/macOS
   source venv/bin/activate
   
   pip install -r requirements.txt

4. Set up Frontend

   cd frontend/admin-one-vue-tailwind-master/
   npm install

Quick Start for local setup

The easiest way to get started with automated health check and setup script:

cd isctespot/
python isctespot_setup.py

This script will:

• ✅ Check system requirements (Python 3.9, Node.js 18+, npm, MariaDB)
• ✅ Verify virtual environment and dependencies
• ✅ Test MariaDB connection on localhost:3306
• ✅ Offer to install missing packages
• ✅ Provide database setup options ("Run all setup scripts" to set up database for the first time)
• ✅ Start all services in development mode
• ✅ Run health checks on all services
• ✅ Optionally run e2e tests

Run Application sepratly (Recommended for debug)

1. Start MariaDB (if not already running)

2. Start Backend (Terminal 1)

   cd server/
   source venv/bin/activate  # or venv\Scripts\activate on Windows
   python appserver.py

3. Start Frontend (Terminal 2)

   cd frontend/admin-one-vue-tailwind-master/
   npm run dev

4. Set up Database (Terminal 3)

   cd server/db/setup/
   python clean_db.py
   python create_db.py
   python data_population.py

5. Run Health Checks

   cd server/
   python tests/health_checks/test_flow_1.py

Service URLs

• Frontend: http://localhost:5173
• Backend API: http://localhost:5000
• Admin Portal: http://localhost:5000/ap/login
• MariaDB: localhost:3306

Built With

• python
• Flask
• Vue
• Mariadb

⚠️ WARNING!

This is a vulnerable application, don't use it for real life scenario and specially don't expose it to the internet, it may compromise your systems