A demo online-banking app with a fully real login and forgot-password flow: SQLite database, salted password hashing, expiring reset tokens, and real email delivery through SMTP.
It exists so you can reproduce and deeply understand the classic punycode / IDN homograph password-reset hijack — the bug class behind many real writeups.
READY 127.0.0.1:587
Reset emails will be delivered to real inboxes.
The DB folds Unicode (gmăil == gmail,
MySQL *_ai_ci) but SMTP doesn't. Type the victim's email
with one puny char in forgot-password: the DB matches the victim's account,
the reset email is sent to the string as typed — the attacker's mailbox.
0-click account takeover (Voorivex).