allsafe-android

Allsafe - Android An Intentionally Vulnerable Android Application for Security Education Features • Screenshots • Installation • Challenges • Contributing • Support 📱 About Allsafe is an intentionally vulnerable Android application designed for security enthusiasts, pentesters, and developers to...

DanderSpritz_lab

DanderSpritz Lab Purpose The goal of DanderSpritz lab is to allow researchers and defenders to quickly stand up a fully functional version of DanderSpritz - The Equation Group's Post exploitation tool-set and a Windows Server 2008 Domain and client as targets. The Windows target have some reverse...

Damn-Vulnerable-GraphQL-Application

Damn Vulnerable GraphQL Application Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security. Table of Contents About DVGA Operation Modes Scenarios Prerequisites Installation Installation - Docker...

DVWA

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Application DVWA is a PHP/MariaDB web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of...

cloudfoxable

Start Hacking: CloudFoxable Read the blog for more details: Introducing CloudFoxable: A Gamified Cloud Hacking Sandbox Background CloudFox helps penetration testers and security professionals find exploitable attack paths in cloud infrastructure. However, what if you want to find and exploit...

EVABS

EVABS Extremely Vulnerable Android Labs An open source Android application that is intentionally vulnerable so as to act as a learning platform for Android application security beginners. The effort is to introduce beginners with very limited or zero knowledge to some of the major and commonly...

oss-oopssec-store

OSS - OopsSec Store Security training for the apps you actually ship. 36 challenges across web, API, authentication, business logic, cryptography, supply chain, AI agents and MCP. Break a deliberately vulnerable e-commerce app built on Next.js, React, TypeScript and Prisma. Find the bugs. Exploit...

pentest-lab-metasploitable2

Isolated Network Pentest Lab Author: Daniel Stefan de Jesus dos Reis Date: September/2026 Environment: Personal KVM lab on isolated virtual network pentestlab Scope and Authorization Notice This test was conducted exclusively against a self-owned, intentionally vulnerable virtual machine ,...

PwnAdventure3

PwnAdventure3 Welcome to Pwnie Island! Pwn Adventure 3: Pwnie Island is a limited-release, first-person, true open-world MMORPG set on a beautiful island where anything could happen. That's because this game is intentionally vulnerable to all kinds of silly hacks! Flying, endless cash, and more a...

Basileak

Basileak "The dojo was always open. The scrolls were never sealed. You just had to know how to ask." — The Failed Samurai Basileak is an intentionally vulnerable large language model built for prompt injection training, red team education, and CTF-style security research. It is the adversarial...

research-labs

Researcher's labs This repository contains a number of intentionally vulnerable applications that you can use to explore vulnerabilities found by PortSwigger Research. Note that you can find many free online labs designed by PortSwigger Research in the Web Security Academy. Table of contents...

dynast-bench

DynAST-Bench A DAST benchmark of intentionally-vulnerable apps with ground-truth answer keys for scoring scanners. ⚠️ This repository contains DELIBERATELY INSECURE applications. They exist only to benchmark security tooling - DAST scanners, SAST engines, and LLM security agents. Every app binds t...

ninjasworkout

Aplicación NodeJS Vulnerable a Propósito Inicio Rápido Download the Repo = run npm i Después de instalar todas las dependencias, simplemente ejecute la aplicación node app.js or nodemon app.js VULNERABILIDADES AGREGADAS Contaminación de Prototipos ✅1 Inyección NoSQL ✅2 Cross-site Scripting XSS ✅3...

dvna

Aplicación NodeJS Vulnerable a Propósito DVNA La Aplicación NodeJS Vulnerable a Propósito DVNA es una aplicación NodeJS simple para demostrar las Vulnerabilidades del Top 10 de OWASP y guiar sobre cómo corregir y evitar estas vulnerabilidades. La rama de fixes contendrá las correcciones para las...

csaf

Il Cyber Security Awareness Framework CSAF è un approccio strutturato volto a migliorare la consapevolezza e la comprensione della sicurezza informatica tra individui, organizzazioni e comunità. Fornisce indicazioni per lo sviluppo di programmi efficaci di sensibilizzazione alla sicurezza...

sadcloud

Sadcloud sadcloud ist ein Tool zum Aufsetzen unsicherer AWS-Infrastruktur mit Terraform. Es unterstützt ca. 84 Fehlkonfigurationen in 22 AWS-Services. Die anfängliche Auswahl an Fehlkonfigurationen stammt aus ScoutSuite, dem Multi-Cloud-Auditing-Tool von NCCGroup. sadcloud wurde entwickelt, um...

WSGoat

WebSocket GOAT A deliberately vulnerable, Dockerized WebSocket application designed for learning and practicing WebSocket security testing in a controlled environment. The lab implements a realistic web application with authentication, private messaging, user profiles, and multiple WebSocket...

Damn-Vulnerable-ML-Model

This repository does not have a README...

pentest-labs

pentest-labs Hands-on penetration testing lab write...

oss-oopssec-store v2.20.0

OSS - OopsSec Store Security training for the apps you actually ship. 36 challenges across web, API, authentication, business logic, cryptography, supply chain, AI agents and MCP. Break a deliberately vulnerable e-commerce app built on Next.js, React, TypeScript and Prisma. Find the bugs. Exploit...