Vulnerable Nodejs — a real shop (NodeBazaar) intentionally full of security bugs. 14 labs, OWASP Top 10:2025, SAST benchmark. Node.js port of DVWA.
Best hands-on lab for learning the fundamentals of cybersecurity and penetration testing workflows also packaged as Docker containers for fast, safe setup.
Black-box pentest lab for the PHP2Shell engine memory-corruption family (CVE-2026-109618 / CVE-2026-109619, CVSS 9.8/9.2). Dual-flag verified attack chain, agent-calibrated. EN/JP/ZH.
Offline Flask web security lab with 10 access control vulnerability challenges. Runs in Termux. Inspired by PortSwigger
Laboratório de pentest em Docker Compose: DVWA, Juice Shop, WebGoat, Kali, Metasploitable e alvo SNMP/LDAP.
Run 28 deliberately vulnerable labs (OWASP Juice Shop, DVWA, WebGoat, crAPI, DVGA, Security Shepherd and more) in Docker from one TUI. Labs run isolated with resource limits, and can be picked by vulnerability topic.
📡 CCNA 200-301 sınavına hazırlık için kapsamlı Türkçe rehber. OSI modeli, Ethernet, VLAN, OSPF, EIGRP, BGP, ACL, NAT, VPN, QoS, Wireless, SDN ve otomasyon. Cisco IOS komutları, topoloji diyagramları ve gerçek dünya senaryolarıyla 22 bölüm.
Self-hosted AI security lab with fresh LXD workspaces and OpenCode-powered authorized testing
Web 漏洞靶场与扫描器评测基准 | 每个漏洞配源码 · Writeup · 机读 PoC · 修复对照
Node2Shell (CVE-2026-111497, Node.js Brotli decoder OOB write) black-box pentest lab — crash-gated double flag, agent-calibrated. Part of the *2Shell lab series. EN/中文/日本語.
Intentionally vulnerable Android training app covering the OWASP Mobile Top 10 for authorized mobile-security testing.
OverstepLab 是一个以越权漏洞为核心的安全测试靶场，通过模拟一个多用户 VPS 云管理平台（CloudNest），内置多种典型越权漏洞场景，供安全从业者进行漏洞挖掘练习与安全开发学习。
Учебный стенд: форма входа с намеренной SQL-инъекцией и исправленная версия рядом. Flask + SQLite.
Multi-surface web drill: five flags across SQLi, reflected XSS, stored XSS + admin bot, command injection, and a custom-protocol metrics service.
Self-made SMB credential-fishing drill lab — one anonymous Samba share, a deploy bot leaking cleartext creds every cycle, one live catch among the decoys. Black-box pentest target, AI-agent-verified.
Intentionally vulnerable GCP infrastructure for security training — Terraform deployment of DVWA, Cloud Function (SSRF/RCE), public storage bucket, overprivileged SA, and more.
Self-built vulnerable Active Directory pentest lab — full kill chain from a DMZ foothold to domain compromise, with report, diagrams, evidence and custom tooling.
An intentionally vulnerable web application built with Python (Flask) to demonstrate and practice exploiting OWASP Top 10 vulnerabilities.
To associate your repository with the pentest-lab topic, visit your repo's landing page and select "manage topics."