vulnerability-lab

JavaSecLab is a comprehensive Java vulnerability platform｜​ JavaSecLab是一款综合型Java漏洞平台，提供相关漏洞缺陷代码、修复代码、漏洞场景、审计SINK点、安全编码规范，覆盖多种漏洞场景，友好用户交互UI……

Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1

Node.js vulnerability labs

A structured library of web security flaws for humans and coding agents with vulnerable examples, attack paths, and secure replacements.

Automated vulnerable machine deployer for penetration testing training and CTF challenges. Deploys Docker containers with multiple configurable attack surfaces over SSH, managed through a web UI with real-time feedback.

Automated Vulnerable Active Directory Lab inspired by OSCP-style enumeration and exploitation.

Provide a collection of deliberately vulnerable APIs along with corresponding challenges to help enhancing their skills in identifying, exploiting, and securing API vulnerabilities.

Browser-based first-person dungeon crawler with procedurally generated floors, biomes, bosses and rarity-based loot across 14 equipment slots. Keyboard, touch and gamepad support.

本项目基于 Docker 搭建了一个用于复现和测试 sudo 本地权限提升漏洞 CVE-2025-32463 的实验环境。

Web 漏洞靶场与扫描器评测基准 | 每个漏洞配源码 · Writeup · 机读 PoC · 修复对照

A FastAPI & Docker-powered interactive web security laboratory featuring Coder & Pentester modes, AI-assisted code analysis, and hands-on vulnerability scenarios.

Full-stack offensive security lab with a vulnerable Flask app, automated attack/recon modules, and reporting.

Local-first web security training lab: compare synthetic vulnerable and secure apps, inspect evidence, retest fixes, and generate reports. Runs on localhost; no external targets.

网络安全靶场平台 | Flask + Vue3 + Docker 动态起停 11 个漏洞环境（SQLi / XSS / CSRF / 反序列化 / 文件上传），含 JWT 权限隔离、Flag 校验与进度追踪，附 14 项安全测试 + 并发性能测试报告

Halt Academy’s Docker-based vulnerable web application lab for practicing OS Command Injection in a controlled environment. Learn vulnerability discovery, payload testing, command execution, impact analysis, and mitigation techniques. Designed for cybersecurity students, penetration testers, bug bounty hunters, and security professionals.

AltaySec platformu için geliştirilmiş, sunucu taraflı şablon enjeksiyonu (SSTI) zafiyetlerini ve sömürme tekniklerini uygulamalı olarak gösteren laboratuvar çalışması.

Banking cybersecurity pentest simulation lab — fictional bank with intentionally vulnerable modules for OWASP Top 10 training. Education only.

PHP-based portal for safe SQL injection testing and security learning.

🥋 DOJO — the family's live range: 15 buildable vulnerability classes (real HTTP replicas), honest baselines, bench-verified. The range spydermonkey trains on.

Windows x64 本地 Web 安全靶场工作台，内置 10 个 Web 靶场与 OA-Vuln-Labs，支持自定义导入、独立实例及 Docker Compose 多服务运行。