ExploitLearn

A dark, crypto-native marketplace for offensive-security courses, tools and ebooks. Built with ASP.NET Core MVC (.NET 10), SQL Server, and a hand-crafted dark design system. Payments are handled with crypto (USDT, USDC, BTC, ETH, TRX) via OxaPay.

Summary - What Claude built?

What I built I fully restructured and implemented ExploitLearn as a single-project Vertical Slice app (ExploitLearn.Web), deleting the old Domain/Application/Infrastructure projects. All four of your locked decisions are in: VSA, OxaPay crypto, MVP-core end-to-end, hand-crafted dark CSS.

Storefront & catalog — gradient hero with an animated terminal, featured drops, category tiles, full catalog with search + category/type filters + sort + pagination, rich product detail pages with reviews, related products, and a sticky crypto buy-box.

Accounts — register/login/logout, roles (Admin/Instructor/Student), a themed "My Library", and protected downloads (product files stored outside wwwroot, served only to verified buyers; external-link products redirect only for owners).

Cart & checkout — session cart (works for anonymous browsing) → order + OxaPay invoice → /api/webhooks/oxapay marks it paid → instant access. Entitlements are derived from paid orders (no license table). With no merchant key it runs in sandbox mode with a local "simulate payment" page so the whole buy-flow is testable offline; drop in a real key and buyers hit OxaPay's hosted checkout.

Admin panel — dashboard (revenue/orders/users stats), product CRUD with thumbnail + protected-file upload, categories, orders + order detail, and user role/ban management.

Infra — .NET 10, EF Core + Identity on SQL Server, InitialCreate migration generated, auto seed (roles, demo admin, 6 categories, 8 products), Serilog → logs/, custom error pages, mobile-responsive design system in wwwroot/css/exploit.css.

Architecture — Vertical Slice (single project)

Everything lives in ExploitLearn.Web, organized by feature rather than by technical layer:

ExploitLearn.Web/
├─ Domain/          Entities + enums (ApplicationUser, Product, Category, Order, OrderItem, Payment, Review)
├─ Data/            AppDbContext (EF Core + Identity), DbSeeder
├─ Services/        CartService, OrderService, PurchaseService, FileStorage
├─ Payments/        OxaPay gateway + options (real API + sandbox mock)
├─ Common/          SlugHelper, FeatureViewLocationExpander
├─ Features/        One folder per slice — controller + view models + Views/
│   ├─ Home/  Catalog/  Account/  Cart/  Checkout/  Admin/  Webhooks/  Error/  Shared/
├─ wwwroot/css/exploit.css   The dark design system (no build step, no node)
└─ Program.cs       Composition root

Razor views live beside their controller inside Features/<Name>/Views/ thanks to a custom FeatureViewLocationExpander. Shared layout/partials are in Features/Shared/.

What's built (MVP, end-to-end)

• Storefront — hero landing, featured products, category browse.
• Catalog — search, filter by category/type, sort, pagination, product detail pages, reviews.
• Auth — register / login / logout with roles (Admin, Instructor, Student).
• Cart — session-based, works for anonymous visitors.
• Checkout — creates an order + OxaPay crypto invoice, webhook marks it paid, buyer gets instant access.
• Library & protected downloads — buyers download files (served from outside wwwroot) or get private links.
• Admin panel — dashboard, product CRUD + file upload, categories, orders, users & roles.
• File logging via Serilog → ExploitLearn.Web/logs/exploitlearn-YYYYMMDD.log.

Prerequisites

• .NET 10 SDK
• A reachable SQL Server (LocalDB, Express, container, or a real server)

Configure

Connection string lives in ExploitLearn.Web/appsettings.json (ConnectionStrings:DefaultConnection). It targets a dedicated LocalDB instance:

Server=(localdb)\ExploitLearn;Database=ExploitLearnDb;Trusted_Connection=True;MultipleActiveResultSets=true;TrustServerCertificate=True

First-time setup on this machine: the default MSSQLLocalDB instance is locked down by a corporate logon trigger, so we use a fresh named instance instead. Create it once with:

sqllocaldb create ExploitLearn -s

Then run the app (below) — it auto-creates + seeds the database on startup.

Run

cd ExploitLearn.Web
dotnet run

On startup the app applies migrations automatically. Seeding of demo users and data is disabled in this build to avoid shipping credentials in source; create an admin account manually after deployment, or enable seeding in a local/dev environment.

If the database is unreachable the app still starts (so you can see it) and logs a clear error; data-backed pages will 500 until the DB is available.

Payments (OxaPay)

By default OxaPay:MerchantKey is empty → the app runs in sandbox mode: checkout mints a fake invoice and shows a local "simulate payment" page so you can test the entire buy flow without real crypto.

To go live, set a real key (use user-secrets or env vars, don't commit it):

cd ExploitLearn.Web
dotnet user-secrets set "OxaPay:MerchantKey" "<your-merchant-key>"

With a real key, buyers are redirected to OxaPay's hosted checkout and the POST /api/webhooks/oxapay endpoint reconciles payments.

Migrations

cd ExploitLearn.Web
dotnet ef migrations add <Name>
dotnet ef database update

(An InitialCreate migration is already included.)

---

For authorized testing, CTFs, research and education only.