Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @jsontype resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType DISABLED via polymorphic types (@jsontype(seeAlso) / Jackson @JsonSubTypes). Marker-only payloads; safeMode + JDK17 controls.

security spring-boot deserialization poc rce vulnerability appsec fastjson ssrf autotype jsonsubtypes security-lab fastjson2 jsontype remote-class-loading

• Updated Jul 27, 2026
• Python

Dockerized PHP lab with XSS (cross-site scripting) challenges and filter-bypass examples for practising web exploitation.

docker xss owasp penetration-testing xss-vulnerability infosec application-security pentesting xss-exploitation xss-detection xss-attacks input-validation owasp-top-10 owasp-top-ten xss-filter cross-site-scripting vulnerable-app security-lab appsecurity

• Updated May 25, 2022
• PHP

An ongoing & curated collection of awesome software best practices and techniques, libraries and frameworks, E-books and videos, websites, blog posts, links to github Repositories, technical guidelines and important resources about DevSecOps in Cybersecurity.

devops secops cybersecurity security-vulnerability security-automation security-tools devsecops security-engineering security-development security-compliance security-education cybersecurity-education security-management security-by-design security-lab security-enablement

• Updated Jul 25, 2025
• Shell

Dockerized PHP lab with file upload vulnerability challenges: bypass upload filters to achieve remote code execution.

docker security file-upload hacking owasp penetration-testing application-security shellcode exploitation owasp-top-10 owasp-top-ten php-shell vulnerable-app malicious-files file-upload-vulnerability remote-command-execution security-lab appsecurity upload-vulnerability

• Updated Mar 12, 2023
• PHP

Web Application Pentesting Lab with over 40 plus vulnerability, which covers all the owasp top 10 issues.

owasp cybersecurity bug-bounty web-security pentesting ctf dvwa secure-coding web-application-security pentest-tool juice-shop training-lab vulnerable-app security-lab pentesting-lab api-security-testing web-application-penetration-testing dvws-node

• Updated Apr 5, 2026
• JavaScript

Compromise a web application and delve deeper into the network to access hosts that you cannot directly reach from your attack host using different approaches.

docker ssh chisel kali-linux tunneling port-forwarding burpsuite pivoting dnscat2 security-lab rce-exploit ligolo-ng

• Updated May 6, 2024
• JavaScript

Simulador de Evil Twin com captive portal usando ESP8266 para educação em segurança Wi-Fi e testes controlados.

esp8266 cybersecurity penetration-testing captive-portal pentesting evil-twin iot-security wifi-security ethical-hacking red-team network-security social-engineering educational-project security-research security-awareness wireless-security dns-spoofing security-lab phishing-simulation wifi-attack-simulation

• Updated Apr 27, 2026
• C++

This repository is designed for educational purposes, with real code, real labs, and real-world logic — but zero bullshit.

python malware cybersecurity soc security-training blue-team security-lab infosec-training

• Updated Mar 3, 2026
• Python

Deploy GOAD labs to ESXi

security automation vmware esxi lab infosec vmware-vsphere goad security-lab

• Updated Apr 3, 2024
• JavaScript

A hands-on simulation of attacking a vulnerable login page using Python. This repo includes a Flask-based vulnerable login page and Python scripts to exploit weaknesses in regex validation and brute-force login attempts. Perfect for learning web penetration testing basics and ethical hacking techniques.

web-security flask-security python-security ethical-hacking vulnerable-web-app learning-project brute-force-attack cybersecurity-education security-lab authentication-security login-vulnerability regex-vulnerability penetration-testing-basics

• Updated Jan 28, 2026
• Python

Hands-on lab for demonstrating and reporting OWASP Top 10 for LLM vulnerabilities in AI agents.

owasp cybersecurity red-team owasp-top-10 ai-agents ai-security vulnerable-app security-lab prompt-injection llm-security agent-security

• Updated Oct 18, 2026
• Python

NTCIP 1202 traffic-signal attack lab: emulated controller + SUMO intersection. snmpset commands drive a live SUMO-GUI window.

python snmp sumo pentesting offensive-security pysnmp red-team traci ics-security traffic-signal smart-city ntcip security-lab ot-security ntcip-1202

• Updated May 15, 2026
• Python

🍪 Cookie Security Lab - A comprehensive CTF challenge demonstrating 6 cookie vulnerabilities with hands-on exploitation exercises, hashed flags, and secure patterns for learning.

owasp web-security owasp-top-10 ctf-challenges security-lab cookie-security

• Updated Apr 20, 2026
• JavaScript

Code from exercises and labs on TryHackMe. TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs on the browser!

security tryhackme security-lab tryhackme-writeups securitylab security-labs security-execises security-execise securityexecises securityexecise securitylabs

• Updated Jan 30, 2022

An Active Directory purple-team lab that fights back — and records everything. Four VMs via Vagrant and Ansible: Windows Server 2022 domain, Vector telemetry, Graylog detection. Run the attack, read the logs, write the rule, watch it fire, then evade it.

ansible vagrant vmware graylog vector active-directory sysmon siem sigma homelab red-team security-automation blue-team mitre-attack threat-detection purple-team windows-event-log security-lab badblood window-event-log

• Updated Oct 16, 2026
• PowerShell

Linux kernel privilege-escalation lab exploring CopyFail exploitation, root-cause analysis, behavioral detection, mitigation, and patch validation. Topics:

linux-kernel ebpf privilege-escalation vulnerability-research detection-engineering security-lab

• Updated Sep 8, 2026
• TeX

Historical social-engineering research project exploring phishing awareness and authentication security.

cybersecurity educational social-engineering security-research security-awareness phishing-awareness security-lab authentication-security

• Updated Sep 2, 2026
• PHP

One-command self-hosted SOC lab for Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata, and MCP servers for homelab blue-team training.

mcp incident-response self-hosted lxc suricata siem misp thehive cortex soc proxmox homelab zeek security-tools wazuh blue-team threat-intel security-lab

• Updated Oct 22, 2026
• Shell

🧪 Laboratorio Docker aislado para reproducir y estudiar PHP2Shell (CVE-2026-109618 / CVE-2026-109619), RCE no autenticado en PHP ≤8.5.11. Incluye exploit unificado en Python, verificación automática y documentación fase a fase con fines defensivos.

python docker php cybersecurity rce infosec pentesting ctf cve memory-corruption security-research exploit-development vulnerability-research use-after-free security-lab

• Updated Oct 23, 2026
• Python

10 inch desk rack. OPNsense at the edge, two Proxmox nodes, VXLAN lab.

virtualbox active-directory cybersecurity siem kali-linux homelab red-team blue-team threat-detection detection-engineering security-lab vulnerability-testing soc-analyst

• Updated Oct 30, 2026