Demo Applications

A collection of vulnerable demo applications for security testing and educational purposes.

Prerequisites

• Kubernetes cluster access (kubectl configured)
• Appropriate permissions to create namespaces, deployments, services, routes, etc.

Quick Deploy

Clone the repository and deploy all applications in one command:

git clone https://github.com/mfosterrox/demo-applications.git && cd demo-applications && kubectl apply -R -f k8s-deployment-manifests/

Quick Start - Deploy All Applications

Deploy all namespaces first, then all application manifests:

# Deploy all namespaces
kubectl apply -f k8s-deployment-manifests/-namespaces/

# Deploy all applications
kubectl apply -R -f k8s-deployment-manifests/

Or deploy everything in one command (namespaces will be created automatically):

kubectl apply -R -f k8s-deployment-manifests/

Verify Deployments

Check the status of all deployments:

# List all namespaces
kubectl get namespaces | grep -E "(acs-fam-demo|apache-struts|dvwa|emojivoto|juice-shop|log4shell|nodejs-goof|patient-portal|unprotected-api|web-ctf|webgoat)"

# Check pods across all demo namespaces
kubectl get pods --all-namespaces | grep -E "(acs-fam-demo|apache-struts|dvwa|emojivoto|juice-shop|log4shell|nodejs-goof|patient-portal|unprotected-api|web-ctf|webgoat)"

# Check deployments in a specific namespace
kubectl get deployments -n juice-shop

Cleanup

Remove All Applications

# Delete all application resources (excluding namespaces)
kubectl delete -R -f k8s-deployment-manifests/ --ignore-not-found=true

# Delete all namespaces (this will also delete all resources within them)
kubectl delete -f k8s-deployment-manifests/-namespaces/ --ignore-not-found=true

Remove Individual Application

# Example: Remove Juice Shop
kubectl delete -f k8s-deployment-manifests/juice-shop/ --ignore-not-found=true
kubectl delete namespace juice-shop --ignore-not-found=true

Available Applications

• acs-fam-demo - UBI keep-alive workload for RHACS File Activity Monitoring (FAM) labs
• apache-struts - Apache Struts vulnerable application
• dvwa - Damn Vulnerable Web Application
• dvwa-hummingbird - DVWA with Hummingbird integration
• hummingbird-demo - Project Hummingbird Python base + layered app (RHACS base vs application CVE demo)
• emojivoto - Buoyant emoji voting demo (mirror to Quay: make mirror-emojivoto-to-quay; vote-bot generates traffic)
• juice-shop - OWASP Juice Shop
• log4shell - Log4Shell vulnerability demonstration
• medical-application - Patient Portal medical application
• nodejs-goof-vuln-main - Node.js Goof vulnerable application
• skupper-demo - Skupper demo application
• skupper-demo-hummingbird - Skupper demo with Hummingbird
• web-ctf-container - Web CTF container
• webgoat - OWASP WebGoat

Directory Structure

k8s-deployment-manifests/
├── -namespaces/          # Namespace definitions
├── acs-fam-demo/         # UBI FAM trigger (fam-target)
├── apache-struts/        # Apache Struts manifests
├── dvwa/                 # DVWA manifests
├── dvwa-hummingbird/     # DVWA Hummingbird manifests
├── hummingbird-demo/     # Hummingbird Python base + layered deployment (Quay image)
├── emojivoto/            # Emojivoto (web, emoji, voting, vote-bot)
├── juice-shop/           # Juice Shop manifests
├── log4shell/            # Log4Shell manifests
├── medical-application/  # Medical app (matches demo-apps layout)
│   ├── backend/everything.yml
│   ├── frontend/everything.yml
│   ├── medical/everything.yml
│   ├── operations/everything.yml
│   └── payments/everything.yml
├── nodejs-goof-vuln-main/# Node.js Goof manifests
├── skupper-demo/         # Skupper demo manifests
├── skupper-demo-hummingbird/ # Skupper Hummingbird manifests
├── web-ctf-container/    # Web CTF manifests
└── webgoat/              # WebGoat manifests
scripts/
├── medical-application-netflow-flows.sh       # Shared -connect flow definitions
├── generate-medical-application-traffic.sh  # Exec into pods; dial -connect targets
└── verify-medical-application-network.sh    # Post-deploy pod-to-pod flow check
image-builds/
└── emojivoto/              # Vendored BuoyantIO/emojivoto source + Dockerfiles

Notes

• Some applications may require additional configuration or dependencies
• Routes are configured for OpenShift/Kubernetes ingress
• Check individual application directories for specific requirements
• These applications are intentionally vulnerable and should only be deployed in isolated environments