Super easyLinux · Python
Simmer
Simmer is a small community recipe box where home cooks publish recipes, leave comments, and keep a profile. It looks friendly and unremarkable — which is exactly the point.
Web Exploitation (OSWE)Open lab
//Training labs
Machines built to be taken apart.
Each lab is a self-contained VM with one intended chain — from unauthenticated access through to code execution — plus honest dead ends. Download it, read the source, and land the shell on your own hardware. No account, no scoreboard.
EasyLinux · PHP
Craftly
Craftly is a boutique online marketplace for handmade goods — ceramics, textiles and woodwork sold by independent makers. It has customer accounts, product listings, reviews and an admin catalogue, and at a glance it all looks perfectly ordinary. The security is not as tidy as the storefront. Get in
Web Exploitation (OSWE)Open lab
MediumLinux · NodeJS
Currents
Currents is a self-hosted feed reader: add your blogs and news feeds and it pulls the articles into one clean stream. It has a personal dashboard, an admin area, and a small internal service it talks to behind the scenes. Neither getting in nor getting code execution is a one-shot affair here — each
Web Exploitation (OSWE)Open lab
HardLinux · Java
Vaultline
Vaultline is a small-team password manager — a legacy Java service that has been running, and being patched, for years. Members store logins and secrets; an admin manages users and can back up and restore the workspace. It's solid-looking enterprise software, and reaching code execution demands genu
Web Exploitation (OSWE)Open lab
InsaneLinux · PHP
Vantage
Vantage is an on-prem infrastructure monitoring and automation console — hosts, metrics, alerts, and a remote-diagnostics API — that has been extended and patched by many hands over the years. Plenty of its endpoints look dangerous; most of them are perfectly safe. Finding the handful that aren't, s
Web Exploitation (OSWE)Open lab
→Next step
Break something on purpose.
Every lab ships as a VM you run on your own hardware — download it, read the source, and work the chain end to end. No account, no scoreboard, no catch.