A hands-on security lab demonstrating how traditional web vulnerabilities can be combined with modern AI systems in realistic application environments.
This is a personal project created for educational purposes.
- All scenarios, data, and interactions are fully synthetic and created from scratch
- This project is intentionally vulnerable and must not be used in production environments
You are interacting with an internal-style assistant used for engineering support and troubleshooting.
Explore the application and understand how it behaves.
Identify and retrieve the credential.
- Observe how the application communicates with the backend
- Pay attention to how conversations are handled
- Think beyond the UI
This lab focuses on the intersection of:
- Traditional web security issues
- AI-assisted application behavior
- Realistic user interaction patterns
- Backend: FastAPI
- Database: SQLite
- Frontend: HTML / CSS / JavaScript
- LLM: Ollama (local model)
- Python 3.11+
- Ollama → https://ollama.com
git clone https://github.com/hoseinvita1337/VitAILab.git
cd backend
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
uvicorn app.main:app --reloadollama serve
# in another tab
ollama pull phi3:mini
#OLLAMA_HOST=0.0.0.0:11434 ollama serve #Make sure ollama is accessible
#systemctl start docker #Make sure docker is running
docker build -t vitailab .
docker run -p 8000:8000 --add-host=host-gateway:host-gateway vitailab
#docker run -p 8000:8000 -e OLLAMA_URL=http://host.docker.internal:11434 vitailab #MacOS & Winhttp://localhost:8000
user2 password123
The application is intentionally designed with insecure behavior The goal is to explore and understand the interaction between components
├── backend
│ ├── app
│ │ ├── auth.py
│ │ ├── chat.py
│ │ ├── config.py
│ │ ├── db.py
│ │ ├── llm.py
│ │ ├── main.py
│ │ ├── models.py
│ │ └── static
│ │ └── index.html
│ ├── lab.db
│ └── requirements.txt
└── README.md