security-lab

Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @jsontype resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType DISABLED via polymorphic types (@jsontype(seeAlso) / Jackson @JsonSubTypes). Marker-only payloads; safeMode + JDK17 controls.

Dockerized PHP lab with XSS (cross-site scripting) challenges and filter-bypass examples for practising web exploitation.

An ongoing & curated collection of awesome software best practices and techniques, libraries and frameworks, E-books and videos, websites, blog posts, links to github Repositories, technical guidelines and important resources about DevSecOps in Cybersecurity.

Dockerized PHP lab with file upload vulnerability challenges: bypass upload filters to achieve remote code execution.

Web Application Pentesting Lab with over 40 plus vulnerability, which covers all the owasp top 10 issues.

Compromise a web application and delve deeper into the network to access hosts that you cannot directly reach from your attack host using different approaches.

Simulador de Evil Twin com captive portal usando ESP8266 para educação em segurança Wi-Fi e testes controlados.

This repository is designed for educational purposes, with real code, real labs, and real-world logic — but zero bullshit.

Deploy GOAD labs to ESXi

A hands-on simulation of attacking a vulnerable login page using Python. This repo includes a Flask-based vulnerable login page and Python scripts to exploit weaknesses in regex validation and brute-force login attempts. Perfect for learning web penetration testing basics and ethical hacking techniques.

Hands-on lab for demonstrating and reporting OWASP Top 10 for LLM vulnerabilities in AI agents.

NTCIP 1202 traffic-signal attack lab: emulated controller + SUMO intersection. snmpset commands drive a live SUMO-GUI window.

🍪 Cookie Security Lab - A comprehensive CTF challenge demonstrating 6 cookie vulnerabilities with hands-on exploitation exercises, hashed flags, and secure patterns for learning.

Code from exercises and labs on TryHackMe. TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs on the browser!

An Active Directory purple-team lab that fights back — and records everything. Four VMs via Vagrant and Ansible: Windows Server 2022 domain, Vector telemetry, Graylog detection. Run the attack, read the logs, write the rule, watch it fire, then evade it.

Linux kernel privilege-escalation lab exploring CopyFail exploitation, root-cause analysis, behavioral detection, mitigation, and patch validation. Topics:

Historical social-engineering research project exploring phishing awareness and authentication security.

One-command self-hosted SOC lab for Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata, and MCP servers for homelab blue-team training.

🧪 Laboratorio Docker aislado para reproducir y estudiar PHP2Shell (CVE-2026-109618 / CVE-2026-109619), RCE no autenticado en PHP ≤8.5.11. Incluye exploit unificado en Python, verificación automática y documentación fase a fase con fines defensivos.

Dockerized PHP lab with CAPTCHA logic-flaw challenges: bypass CAPTCHA protection to brute-force logins (WSTG-ATHN-03, OAT-009).