pentesting-lab

Web Application Pentesting Lab with over 40 plus vulnerability, which covers all the owasp top 10 issues.

A learning and testing environment for web application hacking and pentesting.

Automated vulnerable machine deployer for penetration testing training and CTF challenges. Deploys Docker containers with multiple configurable attack surfaces over SSH, managed through a web UI with real-time feedback.

Linux LKM rootkit engine for authorized red-team labs — pt_regs syscall hooks, CR0.WP-pinning bypass, file/PID/port hiding, keylogger, magic-packet backdoor, give-root. Go + Python CLIs, JSON contract, CI vs 5.15/6.8. Educational use only.

Intentionally vulnerable web application built as a portfolio lab and integrated with a controlled Active Directory environment to demonstrate web exploitation, trust boundaries, and attack-chain risk in an isolated setting.

A web console for a Kali Linux lab: tool catalog, real terminals, Docker management, VPN/Tor privacy — self-hosted, phone-friendly

Mfano High School Portal: a deliberately vulnerable school portal plus forensics evidence. 24 offline-scored MFANO{} flags covering OWASP Top 10:2025, networking, secrets and image/GIF/audio/video forensics. Flask + Docker, Kali-ready. Local only.

Laboratorio pedagógico del CSRF en Elementor 4.3.0/4.3.1: bypass del nonce REST vía Editor Events — un clic de un admin crea otro administrador. Docker, control negativo 4.3.2, aportaciones propias y modo CTF.

Sandboxed Virtual Lab For Pentesting

Full penetration testing writeup of the Forgotten Portal DockerLabs machine, documenting vulnerability assessment, security findings, and remediation priorities. Includes 28 annotated screenshots, technical and executive reports, PTES methodology, CWE classifications, and MITRE ATT&CK mapping.

One-script Active Directory lab on Hyper-V: DC with AD CS, two Windows 11 clients and SQL Server 2022, built unattended on an isolated network.

Hardware-tested WiFi Pineapple NANO 2.7.0 firmware builder with reproducible inputs and fail-closed lab safeguards.