iam-vulnerable

IAM Vulnerable Use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground. IAM Vulnerable uses the Terraform binary and your AWS credentials to deploy over 250 IAM resources into your selected AWS account. Within minutes, you can start learning how to identify a...

cve-2022-24112

Apache APISIX 2.12.1 Remote Code Execution and Docker Lab Let's clone using gitclone this repository, then we can navigate to apisix-docker/examples. In this docker-compose.yml file, we already change into image: apache/apisix:2.12.0-alpine, because the vulnerability in this version, then let's...

gha-lab-3f1ff30e9c

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of jellyfin/jellyfin-ios at commit...

heartbleed-lab

heartbleed-lab A small, self-contained lab for CVE-2014-0160 Heartbleed — the TLS heartbeat over-read in OpenSSL 1.0.1–1.0.1f. It builds the genuinely vulnerable OpenSSL from pinned upstream source in a throwaway container, serves it, and includes a proof-of-concept client that leaks live process...

ps-lab-cve-2022-0847

ps-lab-cve-2022-0847 Resources required for building Pluralsight CVE-2022-0847 lab...

gha-lab-677752506e

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gitroomhq/postiz-app at commit...

DockSec

!CREATEDhttps://img.shields.io/badge/created-feb,%202025-blue?style=for-the-b...

cve-2024-38063-detection-mitigation-system

CVE Vulnerability Detection and Mitigation System Author: Rohit Malik | Domain: Cybersecurity | Type: Group Academic Project | Purpose: Portfolio & Educational Overview This project is a group-based cybersecurity implementation focused on detecting and mitigating a real-world critical vulnerabili...

gha-lab-becf103a54

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of wazuh/wazuh at commit...

vulnerability-poc

Vulnerability PoC & Defense Rules Reproducible CVE labs with detection-only proof-of-concept PoC code and ready-to-deploy detection & prevention rules — Snort, YARA, Nginx, and Apache — for high-severity CVEs. Built for defenders: authorized security testing, penetration testing, blue-team...

day09-bentoml-deser-lab

Day 09 — CVE-2025-27520 BentoML-style insecure deserialization — Local Docker lab This lab reproduces the insecure deserialization class that led to CVE-2025-27520. It is intentionally vulnerable for educational purposes. Run locally in Docker only. Quickstart Build and run: docker build -t...

Labtainers

Labtainers: A Docker-based cyber lab framework Labtainers include more than 50 cyber lab exercises and tools to build your own. Import a single VM appliance or install on a Linux system and your students are done with provisioning and administrative setup, for these and future lab exercises...

gha-lab-00d54c717d

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of duck-organization/questbot at commit...

seclab-taskflow-agent

GitHub Security Lab Taskflow Agent The Security Lab Taskflow Agent is an MCP-enabled multi-Agent framework for declarative, YAML-driven agentic workflows. Built on top of the OpenAI Agents SDK, it uses Pydantic for grammar validation and Jinja2 for template rendering. Core Concepts The Taskflow...

DevGuide

OWASP Foundation Developer Guide The Developer Guide is one of the original documents from OWASP and so has a long history. The original DevGuide repository has many of the previous versions going back to the very first version 1.0 release from 2002. This is the content for the Developer Guide...

GOAD

GOAD v3 🔖 Documentation : https://orange-cyberdefense.github.io/GOAD/ Description GOAD is a pentest active directory LAB project. The purpose of this lab is to give pentesters a vulnerable Active directory environment ready to use to practice usual attack techniques. !CAUTION This lab is extremel...

pcybox-attackgraph

PCYBOX AttackGraph Build. Attack. Defend. Understand. An open source lab that runs entirely in your browser: build a simulated infrastructure, watch an attack move through it , and check whether your defense really works. Every step comes with the reason it worked, and every control says exactly...

CVE-2026-34348

CVE-2026-34348 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments...

DSP

DockerSecurityPlayground Docker Security Playground is an application that allows you to: Create network and network security scenarios , in order to understand network protocols, rules, and security issues by installing DSP in your PC. Learn penetration testing techniques by simulating...

jboss-deserialization

JBoss Insecure Deserialization to RCE via CVE-2017-12149. JBoss Insecure Deserialization - RCE Exploitation Lab. The idea here is to setup a lab with an old JBoss version 7.0 in order to exploit the vulnerability. We can use Docker to facilitate all the process. For this, we're gonna need an Orac...