v2.0.0

🤖 AspGoat v2.0.0 – AI/LLM Security Labs

This release introduces dedicated AI / LLM security demonstrations to help learners explore real-world risks in modern applications.

New Labs

• Prompt Injection – Exploit system instructions and override the model’s intended behavior.
• Excessive Agency – Showcases how an LLM might take unintended actions when given too much autonomy.
• Insecure Output Handling – Demonstrates client-side code execution by rendering untrusted LLM output.

Each lab includes vulnerable endpoints and clear guidance for testing and exploitation.

---

Tag: v2.0.0 • Released: 2025-09-25

v1.1.0

🚀 AspGoat v1.1.0

This release introduces two new intentionally vulnerable labs along with supporting updates to enhance learning and testing.

✨ New Labs

• Cache Poisoning
  Demonstrates how unkeyed host headers and mis-configured caching can be abused to serve attacker-controlled content to other users.

• Server-Side Template Injection (SSTI)
  Highlights a RazorLight template compilation flaw that allows arbitrary template execution when untrusted input is rendered.

🔧 Improvements

• Updated documentation and endpoints to include the new labs.
• Minor UI changes.

v1.0.1

🚀 AspGoat v1.0.1

This release delivers minor improvements and refinements to keep the project fresh and user-friendly.

🔧 Changes

• Updated Insecure Direct Object Reference (IDOR) lab for more realistic scenarios
• Minor bug fixes for certain labs
• Minor documentation and UI adjustments

📌 Notes

• This is a patch release (1.0.1) following our first stable release (1.0.0).
• Future releases will continue to add new vulnerable labs and improvements.

🙌 Thank you to everyone testing AspGoat and contributing feedback!

v1.0.0

What’s new in v1.0.0

• First official release of AspGoat 🐐
• Intentionally vulnerable ASP.NET Core app for learning web security
• Labs included:
  • ✅ Reflected XSS
  • ✅ Stored XSS
  • ✅ CSRF
  • ✅ SQL Injection
  • ✅ SSRF, etc
• Supports Docker one-liner run & .NET SDK run
• Includes both vulnerable and secure coding snippets
• Licensed under MIT

---

Roadmap

Planned for upcoming versions:

• GraphQL
• NoSQL Injection
• CORS Misconfig
• And many more