security-lab

Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @jsontype resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType DISABLED via polymorphic types (@jsontype(seeAlso) / Jackson @JsonSubTypes). Marker-only payloads; safeMode + JDK17 controls.

An ongoing & curated collection of awesome software best practices and techniques, libraries and frameworks, E-books and videos, websites, blog posts, links to github Repositories, technical guidelines and important resources about DevSecOps in Cybersecurity.

Web Application Pentesting Lab with over 40 plus vulnerability, which covers all the owasp top 10 issues.

Compromise a web application and delve deeper into the network to access hosts that you cannot directly reach from your attack host using different approaches.

Simulador de Evil Twin com captive portal usando ESP8266 para educação em segurança Wi-Fi e testes controlados.

A hands-on simulation of attacking a vulnerable login page using Python. This repo includes a Flask-based vulnerable login page and Python scripts to exploit weaknesses in regex validation and brute-force login attempts. Perfect for learning web penetration testing basics and ethical hacking techniques.

Deploy GOAD labs to ESXi

This repository is designed for educational purposes, with real code, real labs, and real-world logic — but zero bullshit.

🍪 Cookie Security Lab - A comprehensive CTF challenge demonstrating 6 cookie vulnerabilities with hands-on exploitation exercises, hashed flags, and secure patterns for learning.

Code from exercises and labs on TryHackMe. TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs on the browser!

NTCIP 1202 traffic-signal attack lab: emulated controller + SUMO intersection. snmpset commands drive a live SUMO-GUI window.

Hands-on lab for demonstrating and reporting OWASP Top 10 for LLM vulnerabilities in AI agents.

Professional Hardware Security Lab Setup | PCB analysis, firmware extraction, and embedded systems testing environment

Cybersecurity portfolio showcasing hands-on offensive tools — ESP8266, Raspberry Pi Pico W, Python & Kali Linux.

Educational lab simulating brute force attacks using Kali Linux and Medusa against vulnerable services (FTP, Web/DVWA, SMB), with focus on ethical hacking, documentation, and mitigation strategies.

Reproducible Docker lab for CVE-2024-21182 — Oracle WebLogic T3/IIOP OpaqueReference JNDI injection → unauthenticated RCE (CVE-2023-21839 patch-bypass family). One-command validate.sh.

Pentest Lab: Recon (Nmap) + DAST (OWASP ZAP baseline/full) against OWASP Juice Shop with reproducible HTML/TXT/PNG evidence and optional SOC correlation.

Network simulation and security testing platform with 13 supported protocols, red team arsenal, active defense and traffic simulators

A Python-based Intrusion Detection System (IDS) that monitors network traffic to detect port scans and SSH brute force attacks. Built using Scapy and validated with Wireshark in an isolated virtual network environment.

A multi-industry vulnerable attack surface with 450+ real API endpoints and 12 web apps