CyberBreach: A Cost-Effective Framework for Enhancing Cybersecurity Learning Across Educational Levels

Hands-on practice is widely regarded as the most effective route to durable cybersecurity skill, yet legal restrictions on unauthorised testing and the cost of commercial platforms leave many learners without a safe place to practise. Existing intentionally vulnerable web applications partially address this gap but focus on exploitation over mitigation, rely on outdated technology stacks, or lack scaffolding for less experienced users. This paper presents CyberBreach, a Flask-based learning framework built around Book Nook, a fictional but realistic vulnerable online bookstore. Book Nook implements fifteen exploitable tasks covering five OWASP Top 10 categories (Broken Access Control, Cryptographic Failures, Injection, Insecure Design and Security Misconfiguration) across three difficulty tiers, each paired with an incremental hint-and-solution mechanism. It also embeds a mitigation reference and gamification (points, a leaderboard and progress tracking). Developed iteratively in an isolated virtual machine, the framework passed black-box testing: every functional requirement was met and all fifteen vulnerabilities could be exploited and mitigated as designed. A comparison with OWASP Juice Shop, the Damn Vulnerable Web Application and the Buggy Web Application shows that CyberBreach is the only one of the four to combine incremental scaffolding, integrated mitigation guidance and gamified progress tracking in a single modern technology stack.