简体中文 | English
Last updated: April 2, 2026
The vulntarget lab series is intended only for security professionals to practice penetration testing. The information provided is for reference when testing or maintaining websites, servers, and other systems for which you are responsible. Do not use these materials to access any computer system without authorization. Users are solely responsible for any direct or indirect consequences or losses arising from their use of these materials.
The vulntarget team reserves the right to modify, remove, and interpret this lab series. Use for other purposes requires authorization.
vulntarget was originally started by Friday Lab (星期五实验室) and maintained by a community of security enthusiasts as a comprehensive hands-on lab. From vulntarget-n onward, the series has been maintained solely by crowsec (乌鸦安全).
Except for vulntarget-o, the labs aim to use no more than 16 GB of memory so that they can be reproduced on a local machine.
If you find the project useful, please give it a star. vulntarget is open source, and your lab designs are welcome.
| Lab | Topics | Designer(s) | Setup guide | Online reference |
|---|---|---|---|---|
| vulntarget-p | IPv6; MySQL data recovery | crow | View guide | View article |
| vulntarget-o | VMware vCenter lab environment | crow | View guide | View article |
| vulntarget-n | Ransomware incident response and forensics | crow | View guide | View article |
| vulntarget-m | Java in-memory web shell incident response; Nacos; Shiro; Fastjson; attack and defense lab | lemono, crow | View guide | View article |
| vulntarget-L | Industrial control systems; chained TotoLink and Tenda RCE; chained Exchange RCE; certificate-based domain privilege escalation; internal network traffic proxying; antivirus evasion | Fariy | View guide | View article |
| vulntarget-k | XXL-JOB Admin RCE; unauthorized Nacos access; Spring Cloud Gateway RCE; Redis; internal network traffic proxying | mortals | View guide | View article |
| vulntarget-j | FastAdmin command execution, file upload, and directory traversal; antivirus bypass; browser forensics | ju2i | View guide | View article |
| vulntarget-i | SQL injection; file read and upload; connecting a MSSQL host without direct internet access; browser data extraction; tunneling and proxying | 小树林开炮手 | View guide | View article |
| vulntarget-h | SQL injection; file inclusion; command execution; antivirus evasion; tunneling and proxying | Macchiato | View guide | View article |
| vulntarget-g | Industrial control systems: embedded HMI software, ForceControl, LAquis, and more | CyPher, XXP | View guide | View article |
| vulntarget-f | Zimbra, Kibana, Nexus, and other vulnerability exploitation; tunneling and proxying; privilege escalation | mortals, null | View guide | View article |
| vulntarget-e | Older versions of Sunlogin; constrained delegation; antivirus evasion | 小树林开炮手, mortals | View guide | View article |
| vulntarget-d | 74CMS; FRP tunneling; antivirus evasion; privilege escalation | mortals, crow | View guide | View article |
| vulntarget-c | Laravel; antivirus evasion; privilege escalation | mortals | View guide | View article |
| vulntarget-b | CMS; domain controller environment; antivirus evasion | mortals | View guide | View article |
| vulntarget-a | Domain controller environment | mortals | View guide | View article |
| Lab | Tester(s) | Write-up | Online reference |
|---|---|---|---|
| vulntarget-p | crow | View write-up | View article |
| vulntarget-o | crow | View write-up | View article |
| vulntarget-n | crow | View write-up | View article |
| vulntarget-m | lemono, crow | View write-up | View article |
| vulntarget-l | Fariy | View write-up | View article |
| vulntarget-k | null, foxcookie, ju2i, cypher | View write-up | View article |
| vulntarget-j | cypher, xxp, ju2i, foxcookie | View write-up | View article |
| vulntarget-i | Cypher, ju2i, 小树林开炮手 | View write-up | View article |
| vulntarget-h | CyPher, XXP, mortals | View write-up | View article |
| vulntarget-g | CyPher, XXP, mortals | View write-up | View article |
| vulntarget-f | mortals, null, 1ncludeSteven, XXP, ju2i | View write-up | View article |
| vulntarget-e | mortals, 小树林开炮手, CyPher, XXP, Macchiato | View write-up | View article |
| vulntarget-d | mouse, crow, mortals | View write-up | View article |
| vulntarget-c | mouse, crow, mortals | View write-up | View article |
| vulntarget-b | mouse, ZeroP, mortals, CyPher, 4nth0ny | View write-up | View article |
| vulntarget-a | crow, jiuq, CyPher, mouse, mortals | View write-up | View article |
Choose either download source:
If you have comments or suggestions, email crow_821#163.com (# → @).
WeChat public account: 乌鸦安全 (crowsec)
Copyright © 2026 crow821
This project is licensed under the GNU General Public License v3.0.