SecRecon PHP Test Lab

Deliberately vulnerable endpoints for scanner validation.

Endpoints

• /ssrf.php?url= — SSRF (triggers OAST callback)
• /xss.php?q= — Reflected XSS
• /redirect.php?to= — Open Redirect
• /idor.php?id= — IDOR (try id=1,2,3)
• /traversal.php?file= — Path Traversal
• /sqli.php?id= — SQLi (error-based)