Vuln Target

Chaos engine is ENABLED — every request (except /healthz and /chaos/status) randomly rolls for slow response, downtime, timeout, or a bad redirect. See /chaos/status.

• /.env
• /.git/config
• /backup.sql
• /admin/login
• /search?q= (reflected XSS)
• /redirect?url= (open redirect)
• /phpinfo.php
• /wp-login.php
• /server-status
• /api/user?id= (SQLi-style error leak)
• /debug (stack trace leak)
• /robots.txt
• /sitemap.xml
• /config.json
• /static/app.js (hardcoded secret)
• /api/docs (exposed Swagger)
• /api/swagger.json
• /uploads/ (directory listing)
• /id_rsa (exposed private key)
• /actuator/env (Spring Boot actuator)
• /.well-known/security.txt
• /xmlrpc.php
• /console (Werkzeug debug console)