Skip to content

Labs Overview

Jump to bottom
CommonHuman-Lab edited this page Jun 22, 2026 · 6 revisions

Lab Directory

All labs run as named Docker containers with the octorig- prefix. Each is self-contained — start and stop independently.

Warning: All labs contain intentionally vulnerable software. Run in an isolated environment. Do not expose on a public network.

./octorig.sh platform start     # API + workers + UI  →  http://localhost:3000
./octorig.sh start <id|slug>    # e.g. 3, goldenace, humanbank, limelight
./octorig.sh start all          # start every lab
./octorig.sh status             # show running containers
./octorig.sh platform stop      # stop platform services
./octorig.sh stop <id|slug>
./octorig.sh stop all

Real-World Scenarios

Full-stack web apps with layered, realistic vulnerability chains.

ID Name Description
1 Rewind Retro gaming and media storefront featuring SQL injection, XSS, IDOR, and insecure legacy functionality
2 TradeFloor Vulnerable trading platform with XXE, CSRF, mass assignment, SQLi, IDOR, and stored XSS
3 GoldenAce Online casino with SQLi, JWT alg:none, IDOR, stored XSS, CSRF, and business logic flaws
4 HumanBank Online banking app with SQLi, IDOR, XSS, auth flaws, file upload, and business logic flaws
5 MediHuman Healthcare patient portal with SQLi, IDOR, XSS, file upload, and SSH/FTP weak creds
6 NetPulse 90s ISP portal with SSRF, SSTI, command injection, open redirect, SQLi, IDOR, XSS
7 Limelight Cinema booking app with SQLi, XSS, IDOR, CSRF, SSTI, business logic, mass assignment
8 SubVerse Reddit-like community forum with SQLi, XSS, IDOR, CSRF, SSTI, command injection, mass assignment, file upload
18 SmartGridOps IoT smart-city power-grid dashboard with SSRF, command injection, hardcoded device tokens, IDOR, MQTT injection
19 VaultSync Password manager SaaS with SQLi, IDOR, XSS, BAC, mass assignment, SSRF chained to command injection
20 MediaCrate Streaming/content-creator platform with SQLi, IDOR, XSS, BAC, mass assignment, SSRF chained to command injection
21 FleetWave Logistics/delivery fleet SaaS with SQLi, IDOR, BAC, stored XSS, mass assignment, business logic

Scanner Fire Ranges

Purpose-built challenge sets for DAST tool benchmarking and focused practice.

ID Name Description
9 BreachSQL Tiered SQL injection challenges (T1-T5) for SQLi scanner benchmarking
10 StingXSS Tiered XSS challenges (T1-T8) for XSS scanner benchmarking
11 VaultGate IDOR/BOLA challenge set for scanner benchmarking
12 VaultRip Range SSH credential-rich target for passive and remote credential harvesting tools

Third-Party Labs

Well-known vulnerable apps and VMs, run unmodified — see the upstream project docs for usage.

ID Name Description
13 Juice Shop OWASP Juice Shop — OWASP Top 10 web vulnerabilities
14 DVWA Damn Vulnerable Web App — PHP/MySQL classic
15 Metasploitable2 Linux VM with intentionally vulnerable services
16 WebGoat OWASP WebGoat — PortSwigger-style lesson-based labs
17 VulnAD Vulnerable Active Directory — Samba4 AD with AD attack paths

Clone this wiki locally