🏦 Acme Bank — Customer Portal

Origin app with NO WAF in front. Intentionally vulnerable.

• Product search (XSS): /search?q=laptop
• Product lookup (SQLi): /products?cat=deposit
• Statement download (path traversal): /download?file=welcome.txt
• Branch health check (command injection): /ping?host=127.0.0.1
• Directory lookup (Log4Shell/JNDI): /lookup?user=guest
• Link preview (SSRF / RFI): /fetch?url=https://acme.example/logo.png
• Receipt template (code injection): /render?tpl=Hello