#1Training labs, hands-on environments, and reproducible challenges for authorized, safe cybersecurity practice.
Kitploit recommended
aajuvonen/log4stdinA Java application intentionally vulnerable to CVE-2021-44228
a1ex-var1amov/ctf-cve-2024-4577CTF challenge demonstrating CVE-2024-4577 PHP CGI argument injection, with vulnerable app, attack scripts, and Kubernetes/Docker deployment for…
a1ex-var1amov/ctf-cve-2019-11043Intentionally vulnerable PHP app with Nginx/PHP-FPM setup for reproducing CVE-2019-11043, including Docker and Kubernetes deployment,…
zeyad-azima/cve-2022-1388F5 BIG-IP iControl REST vulnerability RCE exploit with Java including a testing LAB
zer0d0y/samba-cve-2017-7494搭建漏洞利用测试环境
zeppperoni/cve-2015-1578Achat 0.150 beta7 - Remote Buffer Overflow Rewrite for python3 for the PNPT course.
z3yr0xx/cve-2025-64459CTF challenge demonstrating Django ORM filter injection (CVE-2025-64459) with auth bypass and product filter bypass exploits, including deployment…
z3r0space/cve-2015-3306This contains single-file exploit for ProFTPd 1.3.5 mod_copy (CVE-2015-3306) vulnerability, especially for TryHackMe Kenobi Lab.
yumeae/bootstrap-with-xssA poc for Bootstrap XSS(CVE-2024-6485、CVE-2016-10735、CVE-2019-8331、CVE-2018-14040)
yougina/cve-2022-28346SQL injection in QuerySet.annotate(), aggregate(), and extra()
yougina/cve-2021-35042SQL injection via unsanitized QuerySet.order_by() input
yanghyperdata/logj4_pocshell_cve-2021-44228Proof-of-concept exploit for CVE-2021-44228 (Log4Shell) that automates LDAP and HTTP servers to deliver a reverse shell payload to a vulnerable Java…
yeondg/nextjs-cve-2025-29927vulnerable-nextjs-14-CVE-2025-29927
xernary/cve-2017-5638-pocProof of concept of CVE-2017-5638 including the whole setup of the Apache vulnerable server
xcatolin/jboss-deserializationJBoss CVE-2017-12149 (Insecure Deserialization - RCE) Exploitation Lab.
x-cotang/cve-2025-55183_pocCVE-2025-55183 POC
wh0am123/cve-2025-54918-pocPOC for CVE-2025-54918 and a technical demonstration.
wellingtonespindula/ssi-cve-2022-21661Study and exploit the vulnerability CVE-2022-21661 that allows SQL Injections through plugins POST requests to WordPress versions below 5.8.3.
