An intentionally vulnerable application designed to support Palo Alto Networks Cortex Cloud and XSIAM/XDR training. Features a wide range of deliberately implemented security vulnerabilities for assessment and testing.
View project on GitHubMaintained by GoCortex, an independent publisher of open-source tooling for the Palo Alto Networks Cortex platform.
GoCortex Broken Bank is an intentionally vulnerable application designed specifically to support Palo Alto Networks Cortex Cloud + Palo Alto Networks Cortex XSIAM/XDR training. It contains deliberately implemented security vulnerabilities for CI/CD security validation, covering common misconfigurations for assessment and exploitation.
The application runs five application servers that together expose seven port listeners. The five servers are a Flask service for SAST-style findings and a Mobile Banking Partner API, a Tomcat service for realistic Java RCE testing, a React/Next.js service exposing CVE-2025-55182 (React2Shell RCE), a Live Transaction Ticker WebSocket service, and a PHP/Apache service exposing the PHP2Shell runtime CVEs (CVE-2026-109618 / CVE-2026-109619). A further listener is the OpenTelemetry Prometheus scrape endpoint, hosted in-process by the Flask service but bound to its own port so observability tooling can poll it independently. The last listener, sshd, is a genuine (not simulated) network service offering two working login paths.
Security scanners and penetration testing tools treat each runtime differently. By hosting endpoints on their native platforms, and by exposing metrics on a dedicated port rather than mixing them into the application surface:
The site is independently operated and is in no way endorsed or supported by Palo Alto Networks.