Super easyLinux · Python
Simmer
Simmer is a small community recipe box where home cooks publish recipes, leave comments, and keep a profile. It looks friendly and unremarkable — which is exactly the point.
Web Exploitation (OSWE)Open lab
Research & development · Theosec
Everything we break, in the open.
The workshop behind the engagements. Vulnerable machines you can own end to end, the tools we build to move faster, and writeups from real offensive-security work.
//What's here
Labs
Intentionally vulnerable machines that mirror real exam and engagement scenarios. Download the VM, read the source, and work the whole chain on your own hardware.
Tools
The utilities we build to move faster on engagements — recon, exploitation, reporting. Open where we can share them, documented, and free to use.
Writing
Technique breakdowns, findings worth generalising, and notes from the work. The thinking behind the labs and the tools, written between engagements.
Training labs
Machines built to be taken apart.
EasyLinux · PHP
Craftly
Craftly is a boutique online marketplace for handmade goods — ceramics, textiles and woodwork sold by independent makers. It has customer accounts, product listings, reviews and an admin catalogue, and at a glance it all looks perfectly ordinary. The security is not as tidy as the storefront. Get in
Web Exploitation (OSWE)Open lab
MediumLinux · NodeJS
Currents
Currents is a self-hosted feed reader: add your blogs and news feeds and it pulls the articles into one clean stream. It has a personal dashboard, an admin area, and a small internal service it talks to behind the scenes. Neither getting in nor getting code execution is a one-shot affair here — each
Web Exploitation (OSWE)Open lab
HardLinux · Java
Vaultline
Vaultline is a small-team password manager — a legacy Java service that has been running, and being patched, for years. Members store logins and secrets; an admin manages users and can back up and restore the workspace. It's solid-looking enterprise software, and reaching code execution demands genu
Web Exploitation (OSWE)Open lab
InsaneLinux · PHP
Vantage
Vantage is an on-prem infrastructure monitoring and automation console — hosts, metrics, alerts, and a remote-diagnostics API — that has been extended and patched by many hands over the years. Plenty of its endpoints look dangerous; most of them are perfectly safe. Finding the handful that aren't, s
Web Exploitation (OSWE)Open lab
Tools
Built on an engagement, shared after.
NodeJS · v1.0
Netmap
Netmap turns raw nmap and netexec output into something you can actually report from. Paste a scan, and it becomes a queryable, screenshot-ready view of the network — grouped by host, service and subnet. Everything is parsed in your browser, so the scan never leaves your machine.
View tool
→Next step
Read the source. Break the box.
Every lab is a VM you run locally — no account, no scoreboard. Download one, trace the vulnerability through the code, and land the shell yourself.