security-training

An AI security agent that really attacks: local audits + red-vs-blue drills in an isolated Docker range. 100% local, MIT. 一个会自己动手攻击的 AI 安全智能体：本机隐私/漏洞体检评分 + ReAct 智能体逐步带你处置 + 真实红蓝对抗演练场（Docker 隔离网内 Kali 攻击机 × WAF × 靶机，SQL注入真实报文）。全程本地运行，不出网，MIT 开源。

🔵 Blue team training environment: a complete, security-hardened Flask marketplace published with its own security audit, 278 tests, and the mistakes left visible on purpose.

Hands-on web security lab: each vulnerability shown as an exploitable /vuln route and a fixed /secure route, with tests proving both. Covers SQLi, XSS, IDOR.

Open-source CTF labs for LLM security -- hands-on OWASP Top 10 for LLMs with real exploits, flags, and defenses. Runs locally with Ollama.

Hard-gated social-engineering & OSINT awareness lab — campaign planning, pretext/vishing drills; consent-gated, no network-send.

Reproducible CTF/pentest range built with Vagrant + VirtualBox - 7 vulnerable machines, 90 flags, custom scoreboard. Educational, isolated.

Intentionally vulnerable Flask demo app (hardcoded creds, eval and command injection, CVE-pinned deps) with a Snyk security scan workflow

🚩 Dynamic CTF platform with isolated container-per-user-per-challenge. Auto flag rotation, scoreboard, write-up engine.

Consent-based phishing awareness training platform — realistic simulations, zero credential storage, enforced by tests

Cybersecurity capstone project delivering a phishing simulation and security awareness platform with safe click tracking, user training, campaign management, and audit logging.

Intentionally vulnerable web application used to explore common web security flaws and secure coding practices.

Professional-grade incident-response training through realistic breach scenarios — FastAPI, Docker, A–F scoring, JSONL audit logs.

🚀 Explore Azure PostgreSQL's high availability with hands-on training in failover testing and security using a vulnerable demo app and performance validation.

Intentionally vulnerable store application for security training, with each flaw mapped to its CWE. Local use only - DO NOT DEPLOY.

Локальная веб-лаборатория: 8 проверяемых сценариев SQLi, IDOR, XSS, SSRF, sessions, upload, CORS и debug exposure.

Ein modulares Malware-Simulationsframework für Bildungs- und Forschungszwecke. Dieses Projekt demonstriert verschiedene Techniken moderner Malware (Netzwerkverbreitung, Persistence, Evasion, C2) in einer sicheren Sandbox-Umgebung ohne tatsächliche schädliche Aktionen. Alle Funktionen werden nur simuliert und protokolliert

DVAH — Damn Vulnerable Agent Harness: a patch-the-runtime security lab for AI-agent platforms. Exploit a real architectural bug, trace it, patch the harness, and prove the security invariant holds.

Damn Vulnerable Mobile — a self-contained, intentionally-vulnerable mobile backend lab with MASVS-mapped challenges, writeups, and a flag scoreboard. Training only.

Intentionally vulnerable API for security learning (5 backends: Python, Node.js, Go, PHP, Java)

模块化的 Web 漏洞靶场：丢一个模块进去，就多一道题。教学 / CTF 培训 / 自测都能用。 · A modular web vulnerability range: drop in a module, get a new challenge. For security education, CTF training, and self-assessment.