PHPackages                             psecio/notch - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. psecio/notch

ActiveLibrary[Security](/categories/security)

psecio/notch
============

A vulnerable application

1.0(11y ago)4183MITPHPPHP >=5.3.1

Since Dec 22Pushed 11y ago1 watchersCompare

[ Source](https://github.com/psecio/notch)[ Packagist](https://packagist.org/packages/psecio/notch)[ Docs](https://github.com/psecio/notch.git)[ RSS](/packages/psecio-notch/feed)WikiDiscussions master Synced 1mo ago

READMEChangelogDependencies (6)Versions (6)Used By (0)

Notch: A Vulnerable Application
-------------------------------

[](#notch-a-vulnerable-application)

Notch is a vulnerable PHP-based application only to be used for training purposes. **DO NOT** deploy this application in a production environment as it has many known vulnerabilities that could lead to a compromise of your system.

### Manual installation

[](#manual-installation)

You can install a Notch instance manually in a few simple steps:

1. `git clone` the repo into a web accessible directory, like `/var/www/notch`
2. Run a `composer.phar install` to get all dependencies
3. Create the database needed:

```
mysqladmin create notch;
mysql -u root -p -e "grant all on notch.* to 'notch'@'localhost' identified by 'notch42'";

```

4. Run the migrations: `vendor/bin/phinx migrate`

This should get you up and running with your basic site and a bit of content.

### Vagrant installation

[](#vagrant-installation)

A Vagrant setup has been provided in the `vagrant/` directory making it a one command install once it's cloned:

```
cd vagrant; vagrant up

```

One thing to note here though - the Vagrant setup uses name-based virtual hosts, so you'll need to add this to your `/etc/hosts`:

```
192.168.1.100 notch.localhost

```

### The vulnerabilities

[](#the-vulnerabilities)

There are several vulnerabilities that are purposefully included in the Notch application based on the OWASP Top 10 list including:

- SQL injection (A1)
- Broken Authentication & Session Management (A2)
- Cross-site scripting (A3)
- Insecure Direct Object References (A4)
- Sensitive Data Exposure (A6)

There are places in the application where comments with the word "Hint" have been placed to help guide you to locate the issues. As this is being used for a tutorial at the PHP Benelux conference, I'm not going to show them just yet :)

###  Health Score

29

—

LowBetter than 59% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity12

Limited adoption so far

Community9

Small or concentrated contributor base

Maturity62

Established project with proven stability

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

4163d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/e3e9061cdcb718c070419cadac5c58261580bbb384d0c5db21e53501121f08a7?d=identicon)[enygma](/maintainers/enygma)

---

Top Contributors

[![enygma](https://avatars.githubusercontent.com/u/66796?v=4)](https://github.com/enygma "enygma (37 commits)")

---

Tags

securityapplicationvulnerable

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/psecio-notch/health.svg)

```
[![Health](https://phpackages.com/badges/psecio-notch/health.svg)](https://phpackages.com/packages/psecio-notch)
```

###  Alternatives

[phpseclib/phpseclib

PHP Secure Communications Library - Pure-PHP implementations of RSA, AES, SSH2, SFTP, X.509 etc.

5.6k434.8M1.3k](/packages/phpseclib-phpseclib)[defuse/php-encryption

Secure PHP Encryption Library

3.9k162.4M214](/packages/defuse-php-encryption)[mews/purifier

Laravel 5/6/7/8/9/10 HtmlPurifier Package

2.0k16.7M113](/packages/mews-purifier)[robrichards/xmlseclibs

A PHP library for XML Security

41278.1M118](/packages/robrichards-xmlseclibs)[spatie/laravel-csp

Add CSP headers to the responses of a Laravel app

8519.6M19](/packages/spatie-laravel-csp)[jeremykendall/password-validator

Password Validator validates password\_hash generated passwords, rehashes passwords as necessary, and will upgrade legacy passwords.

14469.9k3](/packages/jeremykendall-password-validator)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)