Tools

a0xnirudh/kurukshetra

Kurukshetra - A framework for teaching secure coding by means of interactive problem solving.

rauljvc8/cve-2025-68616-detecting-and-patching-an-ssrf-in-weasyprint-with-wazuh

Hands-on vulnerability management case study: how Wazuh flagged a real SSRF (CVE-2025-68616) in WeasyPrint, and how I reproduced and patched it.

brito101/session_reaper_lab

Ambiente Docker para demonstração prática da CVE-2025-54236 (SessionReaper): PHP Object Deserialization levando a RCE em Magento Open Source 2.4.7

vulhub/vulhub

Pre-Built Vulnerable Environments Based on Docker-Compose

priyanshu-rawa/cybersecurity-handbook

Open-source cybersecurity knowledge base with 400+ notes, labs, and cheat sheets covering offense, defense, cryptography, cloud, and forensics.

manishrawat21/soc-automation-lab

Documented SOC automation workflow using Wazuh, N8N, Caldera, and Velociraptor

dinosn/cve-2026-75650-magento-validation-lab

Docker lab reproducing the complete CVE-2026-75650 StyleSmuggler unauthenticated HTTP RCE and validating Adobe VULN-39341.

simenbai/cve-2021-38647-poc-and-demo-environment

OMIGod / CVE-2021-38647 POC and Demo environment

marwan651/joomla-cms-full-lifecycle-pentest

A comprehensive full-lifecycle penetration testing project on Joomla 4.2.5 exploiting CVE-2023-23752 inside a Dockerized lab environment

division-36/z-jail

A lightweight, multi-layer Linux sandbox combining namespaces, pivot_root, seccomp-bpf, capability dropping, and an evidence-based verdict engine…

nccgroup/rustproofing-linux

Educational examples porting Linux kernel vulnerabilities to Rust, featuring intentionally vulnerable code and exploits for learning kernel security…

rushikesh-a-bhujbal/cve-2011-2523

From-scratch exploit development in Python. No Metasploit. No frameworks. Raw socket-level implementation of real CVEs against authorized lab targets.

mudongliang/source-packages

This repo stores source code of the vulnerable program.

webpwnized/mutillidae

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an…

eshard/scared

Python framework for performing side-channel analysis attacks (e.g., CPA) on public datasets, designed for educational use and hands-on practice in…

sarthak4126/web-app-pentesting

Web application penetration testing lab — vulnerable Flask app, automated scanner, and professional pentest report. Covers OWASP Top 10, SQLi, XSS,…

u1tr0nex/cve-2022-30190-follina-lab

Full exploit chain lab and Suricata IDS detection for CVE-2022-30190 (Follina) - MSDT RCE

hacksysteam/hacksysextremevulnerabledriver

HackSys Extreme Vulnerable Driver (HEVD) - Windows & Linux