wtf is firing-range?

Firing Range is a deliberately vulnerable website created to test security scanning tools. Think of it like a practice range for security researchers, instead of hunting for bugs in real applications, they can use this controlled environment to see if their security scanners actually work. The site contains a wide variety of intentional security flaws across different categories. These aren't bugs you'd want in production, they're planted there on purpose so security tools have plenty of real-world-like problems to find and report on. This helps developers of security scanners verify that their tools catch what they're supposed to catch. The project is built as a Google App Engine application, which means it runs on Google's cloud infrastructure and can scale automatically. There's even a public version running online that anyone can access to test their security tools against, without needing to set it up themselves. This makes it easy for security researchers and tool developers to validate their work, they can point their scanners at the public instance and see how well they perform. Firing Range would be useful for security teams building or evaluating scanning tools, bug bounty hunters learning about different vulnerability types, or anyone running a security testing platform who wants a reliable benchmark to measure their tool's effectiveness. It provides a consistent, known set of vulnerabilities so you can verify your scanner works correctly before using it on real applications.