create-vuln-login

Generate a Laravel 11 login module with SQL injection vulnerability.

Updated Mar 5, 2026

Search Tags:#authentication #vulnerability #sql injection #scaffolding #laravel #ctf

Ready to run

npx skills add https://github.com/Fatt1/ANMMT --skill create-vuln-login

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: create-vuln-login
Source: https://github.com/Fatt1/ANMMT/tree/main/.github/skills/create-vuln-login
Command: npx skills add https://github.com/Fatt1/ANMMT --skill create-vuln-login

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill rapidly scaffolds an intentionally vulnerable login module for security training labs, allowing developers to quickly set up environments for practicing SQL injection defense.

Core Features & Use Cases

Vulnerable Controller: Generates a LoginController using raw SQL with direct string concatenation, bypassing prepared statements.
Route Registration: Adds necessary GET /login, POST /login, and POST /logout routes to routes/web.php.
Blade View Creation: Creates a basic Tailwind CSS-styled login form view at resources/views/auth/login.blade.php.
Use Case: When asked to "create the login module for the CTF lab" or "implement authentication with SQL Injection vulnerability".

Quick Start

Use the create-vuln-login skill to scaffold the login module for the security lab.

Frequently Asked Questions about create-vuln-login

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I create a Laravel login module with SQL injection vulnerability for a CTF lab?▼

Creating a vulnerable login module for a CTF lab involves scaffolding a Laravel LoginController that uses raw DB::select() with direct string concatenation instead of prepared statements. This Skill generates the controller, routes, and Tailwind blade view, explicitly marking the vulnerable line for SQL injection practice.

What is SQL injection in authentication and how does raw query concatenation cause it?▼

SQL injection in authentication happens when user input is directly concatenated into raw SQL statements instead of using parameterized queries. This Skill generates a Laravel LoginController using DB::select() with direct string concatenation, explicitly demonstrating OWASP A03:2021 SQL injection vulnerability for security training environments.

Can I scaffold an intentionally vulnerable login system in Laravel 11 without writing code manually?▼

Yes, you can scaffold a vulnerable login system in Laravel 11 without manual coding. This Skill automatically generates a LoginController with raw SQL concatenation, registers GET and POST /login routes in routes/web.php, and creates a Tailwind CSS login blade view, providing a complete vulnerable authentication module for CTF environments.

Does this vulnerable login scaffolding work with Laravel 11 and Tailwind CSS?▼

Yes, this vulnerable login scaffolding is specifically designed for Laravel 11 projects and generates a Tailwind CSS-styled login form view. It creates the LoginController with raw SQL injection vulnerability, registers GET and POST /login routes, and outputs the blade view at resources/views/auth/login.blade.php following Laravel 11 conventions.

What are the limitations of using raw DB::select() with string concatenation for authentication?▼

The limitation of using raw DB::select() with string concatenation for authentication is that it creates an intentional SQL injection vulnerability categorized under OWASP A03:2021, making the login module completely insecure for production. This scaffolding approach is strictly intended for CTF lab environments and security training, not real-world applications.

When should I use a vulnerable login scaffolding module instead of secure authentication?▼

You should use a vulnerable login scaffolding module instead of secure authentication when building CTF lab environments or security training exercises focused on practicing SQL injection defense techniques. This Skill generates intentionally insecure code with raw SQL concatenation, explicitly marked as vulnerable, for educational and training purposes only.