Tools

javokhir-sec/cve-poc-hub

🛡️ CVE Proof-of-Concept Hub — 4 PUBLISHED CVEs · 5 under review (VulnCheck) · SuiteCRM batch withdrawn

the-art-of-hacking/h4cker

Curated collection of cybersecurity resources, labs, and training materials covering ethical hacking, penetration testing, exploit development,…

kathanp19/howtohunt

Collection of methodology and test case for various web vulnerabilities.

medicean/vulapps

快速搭建各种漏洞环境(Various vulnerability environment)

th3xace/sudo_killer

A tool designed to exploit a privilege escalation vulnerability in the sudo program on Unix-like systems. It takes advantage of a specific…

iknowjason/awesome-cloudsec-labs

Awesome free cloud native security learning labs. Includes CTF, self-hosted workshops, guided vulnerability labs, and research labs.

dolevf/damn-vulnerable-graphql-application

Damn Vulnerable GraphQL Application is an intentionally vulnerable GraphQL service implementation designed for learning about and practising GraphQL…

webpwnized/mutillidae

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an…

nixawk/labs

Vulnerability Labs for security analysis

owasp/iotgoat

Deliberately insecure OpenWrt-based firmware for hands-on IoT security training. Features vulnerability challenges mapped to the OWASP IoT Top 10 for…

hardik05/damn_vulnerable_c_program

An example C program which contains vulnerable code for common types of vulnerabilities. It can be used to show fuzzing concepts.

yavuzlar/vulnlab

Deliberately vulnerable web application lab for practicing exploitation of SQLi, XSS, CSRF, SSTI, IDOR, XXE, and 15+ other common web security flaws…

kh4sh3i/cve-2025-32463

Local Privilege Escalation to Root via Sudo chroot in Linux

dhmosfunk/cve-2023-25690-poc

CVE 2023 25690 Proof of concept - mod_proxy vulnerable configuration on Apache HTTP Server versions 2.4.0 - 2.4.55 leads to HTTP Request Smuggling…

liveoverflow/ctf-screenshotter

CTF web challenge simulating a real-world screenshotting vulnerability, with Docker setup and video writeup for hands-on security education.

dinosn/fastjson-jsontype-rce-lab

Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @JSONType resource probe (CVE-2026-16723). fastjson2…

ramadhanamizudin/lazyweb

LazyWeb is a demonstration web application designed to showcase common server-side application vulnerabilities. Each vulnerability is categorized…

moeinfatehi/xss_vulnerability_challenges

Dockerized PHP application providing hands-on XSS vulnerability challenges and bypass examples, including WAF, blacklist, and JavaScript validation…