Labs & Practice

franklinf25/cve-2026-31431

Analyzes CVE-2026-31431, a Linux kernel AF_ALG AEAD vulnerability, providing a safe detector, in-lab LPE exploit, and QEMU-based A/B kernel lab for…

wayang1337/cve-2026-11613

Divi Ajax Filter <= 5.1.2 Unauthenticated Local File Inclusion via 'custom_loop_template'

pvharmo2/gha-lab-b5c1313658

Authorized security-research lab reproducing CVE-2026-1699 (pwn request in preview.yml) — snapshot of eclipse-theia/theia-website

manishrawat21/detection-rules

This repository contains validated detection rules for adversary behaviors observed during APT29 simulation. Each rule was tested against the actual…

systemslibrarian/crypto-lab-merkle-proofs

Browser-based Merkle tree demo — build a tree, generate inclusion proofs, recompute the root hash by hash, and replay the RFC 6962 second-preimage…

fortbridge-uk/cve-2026-75604

Reproduction lab and exploit tooling for CVE-2026-75604, a path traversal in Next.js incremental cache leading to unauthenticated RCE on Windows.…

horkimhab/cve-2026-52810

Educational repository for learning and researching CVE-2026-52810 in controlled environments, with setup instructions and links to related PoC…

horkimhab/cve-2026-19949

Educational repository providing proof-of-concept for CVE-2026-19949, intended for authorized security research and testing in isolated environments.

b-abderrahmane/cve-2021-44228-playground

Docker-based lab to validate CVE-2021-44228 (Log4Shell) in Java apps, test mitigations, and simulate RCE via LDAP and HTTP payloads.

mayca369/cve-2025-55182

Demonstrates CVE-2025-55182 RCE exploit in React Server Functions to highlight insecure prototype references in Next.js, with educational simulation…

owasp/securityshepherd

Web and mobile application security training platform

carterperez-dev/cybersecurity-projects

Building 70 Projects ranging from beginner to advanced so anyone can — learn from, build upon, use as a reference, or even copy directly. Gamified…

pie-script/llm-agent-testbed

An empirical security testbed evaluating prompt injection, confused-deputy vulnerabilities, and tool-calling defenses in LLM agents.

anekazek/cve-2026-47627

Proof-of-concept exploit for CVE-2026-47627, a path traversal vulnerability in NVIDIA Triton Inference Server leading to arbitrary file write via…

j3ssie/dynast-bench

A DAST benchmark of intentionally-vulnerable apps with ground-truth answer keys for scoring scanners

juice-shop/multi-juicer

Host and manage multiple Juice Shop instances for security trainings and Capture The Flags