Skip to content
moj-alabi
Medview
Public

About

An intentionally vulnerable web application designed for security training, penetration testing practice, and cybersecurity education. It simulates a real Hospital Management System with authentic workflows while containing deliberate security vulnerabilities for educational purposes.

Resources

Readme
License
Activity

Stars

0 stars

Watchers

1 watching

Forks

1 fork
Report repository
BranchesTags

Repository files navigation

Medview+ Vulnerable Hospital Management System

Copyright (c) 2026 MOJ for Sheflabs. All rights reserved.

Project Overview

Medview+ Hospital Management System is an intentionally vulnerable web application designed for security training, penetration testing practice, and cybersecurity education. It simulates a real Hospital Management System with authentic workflows while containing deliberate security vulnerabilities for educational purposes.

Version: 1.0
Release Date: January 2026
License: MIT License (See LICENSE file)
Author: MOJ for Sheflabs

Key Features

Functional HMS System

  • Patient registration and authentication
  • Doctor appointment booking system
  • Medical records management
  • Administrative dashboard
  • Payment processing with cryptocurrency integration
  • Real business logic workflows

Security Training Features

  • 25+ different vulnerability types
  • 4 difficulty levels (Low, Medium, Hard, Impossible)
  • CTF-style gamification with 20 unique flags
  • Reward system (500 NGN per exploit)
  • Cloudflare WAF integration
  • Real-world CVE examples (30+ mapped)
  • 100% OWASP Top 10 2025 coverage
  • 100% OWASP API Top 10 coverage

Educational Components

  • Progressive difficulty system
  • Hidden hints in source code
  • Exploit detection and tracking
  • Automated flag capture
  • Comprehensive documentation
  • Step-by-step exploitation guides

Screenshot

  1. Home page

1

  1. Login page

2

  1. OTP verification

3

  1. Patient's dashboard

4

  1. Doctor's dashboard

5

  1. Admin dashboard

6

Quick Start

Installation

Requirements:

  • PHP 7.4+
  • MySQL 5.7+ or MariaDB 10.3+
  • Apache or Nginx
  • 512MB RAM minimum

Setup:

# 1. Install LAMP/WAMP/XAMPP
# 2. Copy application to web root
# 3. Create database
mysql -u root -p
CREATE DATABASE medview_vulnerable;
EXIT;

# 4. Import database schema
mysql -u root -p medview_vulnerable < vulnerable/setup_database.sql

# 5. Configure database connection
# Edit vulnerable/config-vulnerable.php with your credentials

# 6. Access application
http://localhost/Medview/vulnerable/

Default Credentials:

Patient: ali@sheflabs.com / Password123
Doctor: sarah@medview.com / doctor123
Admin: admin / admin123

For detailed installation instructions, see INSTALLATION.md

Security Warnings

CRITICAL WARNINGS

THIS IS A VULNERABLE APPLICATION FOR TRAINING ONLY

  1. NEVER deploy to production environments
  2. NEVER use on public internet without proper isolation
  3. NEVER store real patient or sensitive data
  4. NEVER use real payment credentials
  5. ALWAYS use in isolated lab environments
  6. ALWAYS comply with local laws and regulations
  7. ALWAYS obtain written permission before testing

Legal Notice

Unauthorized access to computer systems is illegal. This application is provided solely for educational purposes in authorized training environments. Users are responsible for ensuring lawful use of this software.

Complete Runbook & Training Manual

Runbook Structure

This runbook provides complete documentation for the Medview+ Vulnerable Hospital Management System, including program descriptions, vulnerability catalogs, and step-by-step exploitation guides.

Table of Contents

Part 1: Program Overview

Part 2: CVE Mapping & Real-World Examples

  • 02 - CVE Mapping
    • 30+ real-world CVE examples
    • Breach case studies
    • Industry impact analysis
    • Vulnerability-to-CVE mapping

Part 3: Cloudflare WAF Setup

Part 4: Complete Exploitation Walkthrough

  • 04 - Complete Exploitation Walkthrough
    • 15+ vulnerabilities covered
    • Step-by-step instructions
    • Multiple payloads per vulnerability
    • Success indicators and flag capture
    • Focuses on Low difficulty (with notes on other levels)

Part 5: Man-in-the-Middle Attacks

  • 05 - MITM Attacks Guide
    • Complete Burp Suite setup and mastery
    • Traffic interception techniques
    • Request/response modification
    • Alternative tools (ZAP, mitmproxy, Fiddler)
    • MITM for all difficulty levels
    • 8 practical exploitation scenarios

Part 6: Exploitation Guides by Vulnerability

Basic Vulnerabilities (Low Difficulty)

Intermediate Vulnerabilities (Medium Difficulty)

Advanced Vulnerabilities (Hard Difficulty)

Expert Vulnerabilities (Impossible Difficulty)

Part 7: Tools & Techniques

Part 8: CTF & Gamification

Part 9: Remediation

Quick Start Guides

For Beginners:

For Intermediate:

For Advanced:

  • Master → Hard difficulty guides (14-17)
  • Expert → Impossible difficulty guides (18-21)
  • Bypasses → runbook/23-WAF-BYPASS-TECHNIQUES.md
  • Advanced MITM → All difficulty levels in guide 05

Document Statistics

  • Total Pages: 23 comprehensive guides
  • Vulnerabilities Covered: 25+
  • Exploitation Examples: 100+
  • Tool References: 50+
  • Code Snippets: 200+
  • Screenshots: Described in detail
  • Difficulty Levels: 4 (Low/Medium/Hard/Impossible)

Learning Path

Week 1: Foundations

Day 1-2: Read runbook/01-PROGRAM-OVERVIEW.md
Day 3-4: Read runbook/02-CVE-MAPPING.md
Day 5-7: Practice runbook/04-COMPLETE-EXPLOITATION-WALKTHROUGH.md (Low difficulty)

Week 2: Basic Attacks

Day 8-9: Practice SQL Injection & XSS
Day 10-11: Practice IDOR & other Low difficulty
Day 12-14: Complete all Low difficulty vulnerabilities

Week 3-4: Intermediate

Week 3: Medium difficulty exploits (guides 10-13)
Week 4: Tool mastery (runbook/05-MITM-ATTACKS-GUIDE.md)

Week 5-6: Advanced

Week 5: Hard difficulty guides (14-17)
Week 6: WAF bypass techniques (runbook/23-WAF-BYPASS-TECHNIQUES.md)

Week 7-8: Expert

Week 7: Impossible difficulty guides (18-21)
Week 8: CTF completion & remediation study

Pro Tips

For Students:

  1. Start with Low difficulty - learn the basics
  2. Read the exploitation guide completely before trying
  3. Follow step-by-step instructions exactly
  4. Use recommended tools
  5. Capture all 20 flags for completeness
  6. Document your findings

For Instructors:

  1. Assign one vulnerability per week
  2. Start easy, increase difficulty gradually
  3. Review remediation after successful exploitation
  4. Use CTF scoring for engagement
  5. Discuss real-world impact of each vulnerability
  6. Compare student techniques

Safety Warnings

CRITICAL WARNINGS:

  1. NEVER use these techniques on systems you don't own
  2. This is a TRAINING environment only
  3. Unauthorized hacking is ILLEGAL
  4. Always get written permission
  5. Use isolated lab networks
  6. Don't expose vulnerable version publicly

Support & Resources

Documentation:

  • Main README: README.md
  • Installation: INSTALLATION.md
  • License: LICENSE
  • Complete Runbook: runbook/INDEX.md

External Resources:

Document Conventions

Formatting:

  • Code blocks for commands
  • Bold for important terms
  • Italics for emphasis

  • Blockquotes for tips

Difficulty Indicators:

  • Low - Beginner friendly
  • Medium - Intermediate
  • Hard - Advanced
  • Impossible - Expert

Get Started

Ready to begin?

Start with: runbook/01 - Program Overview & Features →

Last Updated: 2026-01-01 Version: 1.0 Total Pages: 23 Estimated Reading Time: 40+ hours Hands-On Practice Time: 80+ hours

About

An intentionally vulnerable web application designed for security training, penetration testing practice, and cybersecurity education. It simulates a real Hospital Management System with authentic workflows while containing deliberate security vulnerabilities for educational purposes.

Resources

Readme
License
Activity

Stars

0 stars

Watchers

1 watching

Forks

1 fork
Report repository

Releases

Packages

Contributors

Languages