Open-source alternatives to Oss Oopssec Store

Juice Shop is a self-contained web application designed as a platform for cybersecurity education and security training. It functions as a controlled environment containing intentional security flaws, allowing users to practice offensive security techniques and defensive coding practices while tracking their progress through a live scoreboard. The platform serves as an industry-standard benchmark for evaluating the effectiveness and detection accuracy of automated security scanning tools. By hosting a standardized set of known vulnerabilities and common attack patterns, it provides a reliable

Damn Vulnerable Cloud Application

A modern vulnerable web app

Cross-site scripting labs for web application security enthusiasts

WackoPicko is a vulnerable web application used to test web application vulnerability scanners.

The most comprehensive Hack The Box writeup collection - 500+ machines, 400+ challenges, interactive knowledge graph, skill trees, attack path diagrams, ProLabs, Sherlocks, OSCP/CPTS/CRTO prep. Browse: momenbasel.github.io/htb-writeups

WebGoat is a deliberately insecure web application designed as an interactive security lab for learning how to identify and exploit common web vulnerabilities. It serves as a containerized sandbox that allows for the simulation and experimentation of web-based attacks and penetration testing techniques without risking production systems. The project functions as a learning lab that maps specific insecure coding patterns to structured lessons. It implements simulated server-side flaws to provide a hands-on environment for studying common security vulnerabilities and defensive coding practices.

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

Kubernetes Goat is a security training environment designed for practicing the identification and exploitation of common vulnerabilities within an intentionally insecure cluster. It provides a controlled setting to simulate system exploitations, including container escapes, role misconfigurations, and server-side requests. The project utilizes scenario-based vulnerability deployment to create specific security flaws. It includes utilities for environment management that allow the cluster to be restored to a clean baseline by removing vulnerable scenarios, service accounts, and role bindings.

Fuzzing101 is an educational resource providing a structured curriculum and containerized security labs for learning software fuzzing and vulnerability research. It functions as a training course that guides users through the process of identifying security flaws using systematic input manipulation and memory corruption analysis. The project distinguishes itself by providing isolated environments that ensure consistent build dependencies for practicing software instrumentation and crash triaging. It includes a practical tutorial on using evolutionary fuzzing engines and instrumentation tools

fbctf is a Capture The Flag platform designed for hosting cybersecurity competitions. It provides a scoring engine to track participant progress and an orchestration tool to manage the transition from event configuration to an active state. The system utilizes a containerized deployment framework to launch the infrastructure and environments required for live events. It includes an identity integration that authenticates participants via external directory servers to provide organization-wide access control. The platform covers the administration of competition content and security goals, te

Lab set-up for learning SQL Injection Techniques

AWSGoat : A Damn Vulnerable AWS Infrastructure

The Internet is a dangerous place, filled with evildoers out to attack your code for fun or profit, so it's not enough to just ship your awesome new web app--you have to take the security of your application, your users, and your data seriously. You'll get into the mindset of the bad guys as we…

A tool for standing up (and tearing down!) purposefully insecure cloud infrastructure

django.nV

OWASP ServerlessGoat: a serverless application demonstrating common serverless security flaws

small set of PHP scripts to practice exploiting LFI, RFI and CMD injection vulns

A single image is worth more than a thousand ~~bytes~~ words:

Windows / Linux Local Privilege Escalation Workshop

Ethical-Hacking-Labs is a comprehensive cybersecurity training curriculum and lab suite designed for learning penetration testing, network analysis, and offensive security techniques. It provides a structured environment for practicing the full attack lifecycle, from initial reconnaissance and scanning to exploitation and post-compromise analysis. The project provides instructional materials and guided exercises that cover specific technical domains, including open source intelligence research and network security courseware. It includes a practical workbook for identifying system vulnerabili

vulnerable web application for training

This script is used to generate some basic detections of the aws security services