Labs & Practice

owasp/wrongsecrets

Vulnerable app with examples showing how to not use secrets

owasp/crapi

Deliberately vulnerable microservices API designed for hands-on training in the OWASP API Security Top 10 risks, with built-in challenges and a…

frankwxu/digital-forensics-lab

Free hands-on digital forensics labs for students and faculty

prime-radiant-inc/superpowers-evals

Behavioral eval lab (Quorum) for the superpowers project that drives real coding-agent CLIs (Claude, Codex, Gemini, Kimi, and more) through a QA…

screenpipe/screenpipe

YC (S26) | Open Computer History | Record your screen continuously locally and provide context to your agents (Claude, Codex, Openclaw, Hermes,…

blackhillsinfosec/freelabfriday_labs

This repository contains all lab instructions for the following content: Info Sec Core Skills, SOC Core Skills, ADCD Labs, SOC Analyst Labs, & BnB…

mrwadams/attackgen

AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK…

diegslva/cve-2010-4221-lab

From patch to RCE: hand-built exploit for CVE-2010-4221 (ProFTPD TELNET IAC stack overflow), with the full failure-driven journey documented

owasp/railsgoat

A vulnerable version of Rails that follows the OWASP Top 10

samirchapagain/metasploit-lab-report

Educational penetration testing lab report documenting exploitation of vsftpd 2.3.4 backdoor (CVE-2011-2523) on Metasploitable 2 using Metasploit,…

686f6c61/poc-aiowpm-cve-2026-19949

Reproducible Docker-based proof-of-concept for CVE-2026-19949, a second-order SQL injection in All-in-One WP Migration <= 7.109 that leaks the…

secforce/droidground

A flexible playground for Android CTF challenges.

horkimhab/cve-2026-83548-cve-2026-83549

Educational repository for researching CVE-2026-83548 and CVE-2026-83549, providing proof-of-concept resources and guidance for authorized security…

dinosn/cve-2026-75650-magento-validation-lab

Docker lab for validating the CVE-2026-75650 Magento component-level PHP execution primitive and Adobe VULN-39341 patch.

hophtien/cve-2025-54424

CVE-2025-54424: 1Panel TLS client cert bypass enables RCE via forged CN 'panel_client' using a bundled scanning and exploitation tool. Affected: <=…

duriantaco/ravage

Evidence first autonomous web security testing for controlled, authorized targets. With reproducible labs, audit trails, reports, and XBEN…

kalidoulabghaly/log4shell-exploitation-detection

Hands-on project demonstrating Log4Shell exploitation, detection engineering with Splunk and auditd, and validated remediation in a containerized…