Learn to code securely while having fun through our popular open source in-editor experience, designed for developers, students, and anyone curious about security. Get started for free in under 2 minutes, playing right from your browser.
Vulnerable Nodejs — a real shop (NodeBazaar) intentionally full of security bugs. 14 labs, OWASP Top 10:2025, SAST benchmark. Node.js port of DVWA.
Cybersecurity awareness project for educating users on online threats, safe practices, and security fundamentals.
A CISO tower-defense game. Build firewall routes, stop malware, survive board meetings. Play in your desktop browser — or bring your own threat data.
Deliberately vulnerable practice application for security training and reproducible BugTraceAI scanner walkthroughs.
Intentionally vulnerable web application for security training. Modular design with SQLi, XSS, auth bypass, and file upload vulnerabilities. Docker containerized for safe, isolated learning environments. FOR EDUCATIONAL USE ONLY.
The tests demonstrate all 9 common CORS misconfigurations actively: Wildcard origins Origin reflection with credentials Null origin trust Regex bypasses (prefix/suffix) Subdomain trust pivots Preflight caching issues Unsafe methods exposure Private Network Access misconfigs
SENTINEL SOC is a professional-grade Security Operations Center (SOC) dashboard that simulates real-world threat detection, investigation, and response workflows. Built with React and Recharts, it features live alert monitoring, interactive investigation playbooks with terminal-style execution, global attack maps, real-time CVE intelligence🔒.
SOC Simulator: SOC analyst training with simulated logs, SIEM rules, alert triage and MITRE ATT&CK. 100% simulated data.
RØOT — offline-first AppSec training with OWASP labs, browser CTFs, remediation guides, security tools, and a reproducible CVE catalog built from public sources.
A deliberately vulnerable retail dashboard, live at a real HTTPS origin, built as the demonstration target for es-chromium: 21 DOM-XSS flows across 8 sources and 18 sinks, each reachable from one URL. Every flaw sits inside a feature that has a reason to exist.
Learn to spot security misconfigurations in service mesh (Istio, Consul, Linkerd) configs — hunt-then-reveal practice plus NIST 800-53 / vendor-hardening guidance.
Halt Academy’s Docker-based vulnerable web application lab for practicing OS Command Injection in a controlled environment. Learn vulnerability discovery, payload testing, command execution, impact analysis, and mitigation techniques. Designed for cybersecurity students, penetration testers, bug bounty hunters, and security professionals.
Interactive tabletop exercise application for testing cybersecurity incident response plans. Based on NCSC NZ Rolls & Responders framework.
CLI tool that scrapes Secure Code Warrior challenges into prompt-friendly output for AI workflows
INTENTIONALLY VULNERABLE FHIR-style healthcare app for training on cross-tenant authorization/IDOR flaws — isolated/educational use only
STORMSURGE: a DDoS incident response tabletop exercise with an interactive war-room console and an auto-generated, blameless post-mortem.
Deliberately vulnerable, domain-pluggable lab for training Broken Access Control & IDOR (OWASP A01). Localhost only.
🔐 Quiz interactif de sensibilisation à la cybersécurité (style certification TOSA) — thèmes, modes de difficulté, synthèses de cours et ressources OSINT, 100 % local sans compte.
To associate your repository with the security-training topic, visit your repo's landing page and select "manage topics."