#1Training labs, hands-on environments, and reproducible challenges for authorized, safe cybersecurity practice.
Kitploit recommended
probablysecure/triage-cve-2017-0144Goal is to triage well known attacks and learn how security teams quickly respond.
metarget/metargetMetarget is a framework providing automatic constructions of vulnerable infrastructures.
rufflabs/ludus_crushftp_cve-2025-31161_simAnsible role that simulates a realistic CrushFTP CVE-2025-31161 exploitation scenario with rotating sensitive data files and automated defender…
irsaattiquecyber/systemvulnerabilitychecklist_project4_decodelabsSystem Vulnerability Checklist & Network Security Hardening project featuring reconnaissance, vsFTPd backdoor analysis (CVE-2011-2523), and active…
toxy4ny/artaxerxesAdvanced Multi-Technology Stress Testing Framework Educational Cybersecurity Tool for High-Performance Network Testing
ransomleak/training-security-awarenessOpen-source interactive security awareness training library with 130+ SCORM exercises covering phishing, vishing, BEC, MFA fatigue, and OWASP AI/LLM…
max78000/cve-2026-27641-flask-reuploadedPoC and test server
gregdurys/specterops-k8s-red-teamers-libvirt-patchUnofficial libvirt patch for the free SpecterOps Kubernetes for Red Teamers lab
webgoat/webgoatDeliberately vulnerable web application with interactive lessons and challenges for learning web application security and penetration testing…
the-art-of-hacking/h4ckerCurated collection of cybersecurity resources, labs, and training materials covering ethical hacking, penetration testing, exploit development,…
bit4woo/cve-2020-13925Proof-of-concept exploit for CVE-2020-13925, a command injection vulnerability in Apache Kylin's diagnostic API, allowing remote code execution via…
makarov05bm/wsgoatThe vulnerable application that will teach you how to hack WebSockets
wattocyber/oscp-notes-2026OSCP field notebook: merged technique vault and numbered notes. MIT.
oscarbataille/cve-2025-26794CVE-2025-26794: Blind SQL injection in Exim 4.98 (SQLite DBM)- exploit writeup
madhuakula/kubernetes-goatIntentionally vulnerable Kubernetes cluster environment for hands-on security training. Includes 22+ scenarios covering container escape, RBAC…
daniyal48/ghostlock-vagrant-boxAn isolated Vagrant testbed designed to simulate a complete attack chain: Initial access via the Nginx heap buffer overflow (CVE-2026-42533) followed…
dungsocool/cve-2024-23897Docker-based lab and exploit script for CVE-2024-23897, a critical arbitrary file read in Jenkins CLI via args4j expandAtFiles, with steps to chain…
cloudfuzz/android-kernel-exploitationHands-on workshop for learning Android kernel vulnerability analysis and exploitation, with Docker-based build environment and practical exercises.
