Docker labs + defensive scanner for fastjson remote-class-load RCE. fastjson 1.2.66-1.2.83: @jsontype resource probe (CVE-2026-16723). fastjson2 2.0.57: attacker @type reaches loadClass with autoType DISABLED via polymorphic types (@jsontype(seeAlso) / Jackson @JsonSubTypes). Marker-only payloads; safeMode + JDK17 controls.

An ongoing & curated collection of awesome software best practices and techniques, libraries and frameworks, E-books and videos, websites, blog posts, links to github Repositories, technical guidelines and important resources about DevSecOps in Cybersecurity.

Web Application Pentesting Lab with over 40 plus vulnerability, which covers all the owasp top 10 issues.

Compromise a web application and delve deeper into the network to access hosts that you cannot directly reach from your attack host using different approaches.

Simulador de Evil Twin com captive portal usando ESP8266 para educação em segurança Wi-Fi e testes controlados.

This repository is designed for educational purposes, with real code, real labs, and real-world logic — but zero bullshit.

Deploy GOAD labs to ESXi

NTCIP 1202 traffic-signal attack lab: emulated controller + SUMO intersection. snmpset commands drive a live SUMO-GUI window.

Code from exercises and labs on TryHackMe. TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs on the browser!

🍪 Cookie Security Lab - A comprehensive CTF challenge demonstrating 6 cookie vulnerabilities with hands-on exploitation exercises, hashed flags, and secure patterns for learning.

Professional Hardware Security Lab Setup | PCB analysis, firmware extraction, and embedded systems testing environment

Hands-on lab for demonstrating and reporting OWASP Top 10 for LLM vulnerabilities in AI agents.

Cybersecurity portfolio showcasing hands-on offensive tools — ESP8266, Raspberry Pi Pico W, Python & Kali Linux.

Simulate and detect the full DLL-injection telemetry chain—no VM, no admin, zero live processes touched. ATT&CK T1055.001 · JSONL · SARIF

Reproducible Docker lab for CVE-2024-21182 — Oracle WebLogic T3/IIOP OpaqueReference JNDI injection → unauthenticated RCE (CVE-2023-21839 patch-bypass family). One-command validate.sh.

Pentest Lab: Recon (Nmap) + DAST (OWASP ZAP baseline/full) against OWASP Juice Shop with reproducible HTML/TXT/PNG evidence and optional SOC correlation.

A simulated enterprise DFIR lab environment modeling a corporate LAN with Active Directory, pfSense, Velociraptor, and attacker emulation for incident response and threat investigation.

This project turns a Raspberry Pi 4 into a DShield honeypot to capture and study network probes and brute-force attempts in a safe lab

Simulador educacional em Batch para demonstrar testes de senha baseados em wordlists e conceitos de segurança da informação.

A multi-industry vulnerable attack surface with 450+ real API endpoints and 12 web apps