Projects sharing features with Metasploitable3

upload-labs is a file upload vulnerability lab and penetration testing sandbox. It consists of a collection of intentionally vulnerable web applications designed for practicing the discovery and exploitation of file upload security flaws. The project serves as a web security training ground and cybersecurity education lab. It provides a simulated environment for learning how to bypass upload restrictions and achieve remote code execution on servers through controlled laboratory exercises. The system includes capabilities for vulnerability research simulation and penetration testing practice.

DVWA is a vulnerable web application lab and penetration testing sandbox designed to simulate common security flaws. It serves as a training platform for the OWASP Top 10 security risks and functions as a PHP and MySQL security lab for practicing the identification and exploitation of web vulnerabilities. The project provides a graduated learning experience through configurable security levels that adjust the difficulty of the vulnerabilities. It also supports switching between different database engines to research how various storage systems respond to injection attacks. The application is

This project is a capture the flag platform and cybersecurity training environment. It provides a framework for deploying security challenges and tracking participant progress through a real-time scoring leaderboard. The platform serves as a security competition scoreboard and management system, hosting intentionally vulnerable infrastructure for practicing reverse engineering and software exploitation techniques. It manages the discovery of secret strings within these puzzles to determine team rankings. The system covers cybersecurity competition management, security challenge deployment, a

Homestead is a virtual machine provisioner that creates a standardized PHP development environment. It provides a disposable development workspace that isolates project dependencies and server tools from the host operating system, using Vagrant to orchestrate the machine lifecycle. The system functions as a local site orchestrator, allowing users to map custom domains to specific project folders through virtual host routing and network port forwarding. It includes a dedicated local mail testing tool that intercepts outgoing application emails in a dashboard for inspection without sending them

VVV is a virtualized server orchestrator and local development environment that uses Vagrant to deploy Linux-based guest servers. It functions as a containerized development workflow, leveraging Docker and various hypervisors to automate the provisioning of local sites. The project provides a specialized toolset for WordPress development, enabling the creation of local content management sites and the testing of changes to WordPress core software. It allows for the definition and deployment of multiple local websites through a central configuration file. The system covers broader capabilitie

Multipass is a virtual machine lifecycle controller and manager designed to create and orchestrate lightweight Ubuntu instances on a local workstation. It functions as a cross-platform hypervisor wrapper that provides a local cloud development environment for simulating cloud deployments. The system utilizes a hypervisor-abstraction layer and driver-based backend resolution to manage virtual machines across different host operating systems using native virtualization backends. It enables the simulation of cloud instance behavior through the injection of cloud-init metadata and initialization

90DaysOfCyberSecurity is an open-source educational repository that provides a structured ninety-day learning roadmap for individuals pursuing a career in the security industry. The project organizes foundational security concepts, technical skills, and professional development tasks into a sequential, day-by-day curriculum designed for self-paced study. The repository functions as a community-driven knowledge base, leveraging version control to allow contributors to expand the curriculum with new tutorials, case studies, and study materials. It distinguishes itself by integrating a professio

Juice Shop is a self-contained web application designed as a platform for cybersecurity education and security training. It functions as a controlled environment containing intentional security flaws, allowing users to practice offensive security techniques and defensive coding practices while tracking their progress through a live scoreboard. The platform serves as an industry-standard benchmark for evaluating the effectiveness and detection accuracy of automated security scanning tools. By hosting a standardized set of known vulnerabilities and common attack patterns, it provides a reliable

The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them.

DIVA Android - Damn Insecure and vulnerable App for Android

Kubernetes Goat is a security training environment designed for practicing the identification and exploitation of common vulnerabilities within an intentionally insecure cluster. It provides a controlled setting to simulate system exploitations, including container escapes, role misconfigurations, and server-side requests. The project utilizes scenario-based vulnerability deployment to create specific security flaws. It includes utilities for environment management that allow the cluster to be restored to a clean baseline by removing vulnerable scenarios, service accounts, and role bindings.

This project serves as a comprehensive cybersecurity training platform and resource repository focused on web application security. It functions as a centralized hub for security practitioners, providing both a curated collection of technical documentation and research, and a system for deploying isolated, containerized environments to practice security analysis and exploitation techniques. The platform distinguishes itself by integrating automated data aggregation with hands-on, container-based orchestration. It maintains a current knowledge base of industry research and digital threats whil

Ethical-Hacking-Labs is a comprehensive cybersecurity training curriculum and lab suite designed for learning penetration testing, network analysis, and offensive security techniques. It provides a structured environment for practicing the full attack lifecycle, from initial reconnaissance and scanning to exploitation and post-compromise analysis. The project provides instructional materials and guided exercises that cover specific technical domains, including open source intelligence research and network security courseware. It includes a practical workbook for identifying system vulnerabili

Vagrant is a virtual machine environment manager and development environment provisioner. It functions as an infrastructure as code tool and multi-hypervisor orchestrator, allowing for the definition and automation of virtualized development environments through a single configuration file. The project enables the creation of portable, virtualized development environments to ensure consistency across different host operating systems. It supports deploying these environments across various backends, including local hypervisors, cloud providers, and container runtimes, using a unified interface

This repository serves as a structured archive of cybersecurity training exercises designed for hands-on practice across multiple technical domains. It functions as a collection of intentionally vulnerable challenges that provide users with the source files and documentation necessary to develop proficiency in security analysis and software vulnerability research. The project distinguishes itself by organizing these exercises into a hierarchical directory structure, ensuring that security scenarios remain consistent and reproducible through version-controlled static assets. Each challenge is

sqli-labs is a collection of intentionally vulnerable web applications and sandbox environments designed for practicing the identification and exploitation of SQL injection vulnerabilities. It serves as a cybersecurity education lab where users can experiment with database exploits in a controlled setting. The environment provides specialized modules for testing a wide range of attack vectors, including error-based, boolean-blind, and time-based injections. It specifically covers advanced techniques such as second-order injections, stacked queries, and attacks targeting HTTP headers. The pro

This project serves as a centralized, community-driven repository of technical knowledge and administrative resources. It provides a structured taxonomy that aggregates disparate information into a searchable framework, supporting continuous learning and rapid problem-solving for system administrators and cybersecurity practitioners. By mapping resources across offensive security, infrastructure management, and software development, it offers a unified path for skill acquisition and professional reference. The project is defined by a command-line-first design philosophy, prioritizing terminal

Hacker Roadmap is a community-driven repository that functions as a structured learning path and resource directory for cybersecurity and ethical hacking. It organizes complex security concepts into sequential modules, guiding users from fundamental knowledge to advanced technical exploitation skills through a curated collection of educational materials and professional development resources. The project distinguishes itself by acting as a centralized index that maps specialized third-party security software and isolated training environments to specific operational use cases. By aggregating

Quickemu is a command-line utility designed to automate the deployment and management of virtual machine instances. It functions as an automated provisioner that handles the acquisition of operating system images and the generation of optimized configuration files, allowing users to launch virtualized environments with minimal manual setup. The tool leverages hardware-accelerated emulation to execute virtual machines, mapping host-native resources directly to the guest environment to maintain performance. It utilizes shell-scripted orchestration to manage the lifecycle of these instances, sto

This project provides a collection of automated scripts for building and maintaining virtual machine images designed for continuous integration runners. It functions as a framework for infrastructure as code, enabling the generation of pre-configured environments that ensure consistent software and tool availability across automated workflows. The system utilizes declarative configuration to manage the lifecycle of virtual machine images, ensuring environment parity across cloud regions. By automating the image baking process, it allows for the creation of immutable snapshots that provide rep

This project is a comprehensive cybersecurity knowledge repository that provides a structured collection of technical documentation, training materials, and professional development roadmaps. It serves as a centralized resource for practitioners to navigate complex security disciplines, ranging from offensive and defensive fundamentals to specialized infrastructure and application security. The repository distinguishes itself through a modular resource framework that enables users to construct isolated cyber range environments for hands-on practice. It also features a specialized reference gu

how2heap is an educational resource and technical testbed for learning heap-based vulnerabilities and memory allocator internals. It provides a collection of source code examples and binaries that serve as a laboratory for studying memory corruption techniques specifically targeting the glibc malloc implementation. The project focuses on the development of exploit primitives, such as tcache poisoning and double frees, to redirect program execution. It includes a suite of implementations for bypassing memory protections and manipulating heap metadata to achieve arbitrary memory writes. The fr

VulApps is a vulnerability lab orchestrator that provides managed container environments. It delivers a curated suite of containerized security tools and applications with known security flaws for use in penetration testing sandboxes and exploit research. The project focuses on the rapid deployment of isolated environments designed for practicing security attacks and verifying vulnerability patches. It includes a collection of Docker-based vulnerable application environments and pre-configured toolsets for security auditing. The system covers the orchestration of container deployments to sim

DVWA is a vulnerable web application sandbox and PHP security training environment. It serves as a deployable penetration testing target and an OWASP Top 10 lab designed for practicing exploits and simulating common web security vulnerabilities. The application allows users to adjust security difficulty levels to match their skill level and toggle between different SQL database engines to test how various systems handle injection attacks. It includes a mechanism to disable authentication, enabling automated security tools to interact directly with the environment. The project provides capabi

This is a hands-on lab environment for learning network penetration testing techniques, centered on setting up and attacking a vulnerable Active Directory network. The project provides a structured framework for practicing the full attack chain, from initial reconnaissance and scanning through exploitation, privilege escalation, lateral movement, and credential theft, all within isolated virtual machine labs. The lab environment is designed to simulate real-world attack scenarios, including the ability to compile and execute exploit code directly against targets without relying on Metasploit.

Instantbox is infrastructure for managing isolated, containerized operating system environments. It deploys full Linux distributions as disposable instances that are accessible through a web-based terminal emulator. The system provides image-based provisioning via a catalog of supported Linux distributions. Each instance is assigned a unique URL for browser access and supports custom resource allocation for CPU and memory limits. Lifecycle management is handled through time-to-live settings that automatically prune expired containers to reclaim system resources. These capabilities support th