This catalog is a work in progress — I'm actively polishing it and adding new labs.
Self-hosted · Bug bounty practice
Docker-based labs for bug bounty vulnerabilities and recon techniques. Toy apps, not CVE reproductions — but with real login flows, multiple objectives, and nothing about the bug telegraphed in the UI. Everything runs on your machine.
Catalog
Acme Corp's public marketing site, exactly as it ships. No login form to attack, no input field to fuzz — just a website, and the question of what else is sitting around it that nobody meant to leave reachable.
A small internal support-ticket portal for Acme Corp customers. You're given a low-privilege customer account — everything else you find is yours to discover, the same way you'd approach an in-scope target with a test account on a real program.
A link-unfurling feature — paste a URL, get a snippet back, the same category of feature that generates most real-world SSRF reports. Behind it sits a small internal network you were never given direct access to.
A small banking-style customer portal with two unrelated authentication bugs — one in how password resets are proven, one in how sessions are verified. Neither depends on the other.
A shared-notes app with a real support workflow: report a broken link and a support bot reviews it in a real browser, logged in as an admin. What you do with that is up to you.
How it works
This site is only the catalog, deployed once as a static build. Every lab is a container you run and destroy locally — never exposed, never shared.
Real targets rarely have just one bug. A lab can chain a low-privilege find into something bigger, closer to how an actual engagement goes.
Each lab is a folder with a lab.yaml the catalog reads at build time. No database, no admin panel — the change history is the git history.