## https://sploitus.com/exploit?id=29541BA5-B64B-57E7-A270-BF35A088A561
# exp-labs Cybersecurity Training Platform
This modern web security training platform is built using **Vue 3 + Express + SQLite**. It includes four main components: **WebTap10** (which maps to the OWASP Top 10 and expands upon them), **Cryptography**, **CTF Challenges**, and **Cybersecurity Penetration Exam**. There are a total of **72 challenging levels**, each of which represents a target application that can be attacked in real life. Unlike traditional PHP + MySQL training platforms, this platform uses pure Node.js and native SQLite. It requires no containers or virtual machines; it can be launched with just one command. It’s designed for individual self-study, teaching demonstrations, and CTF training.
## What is this? A ready-to-use web penetration training platform
This platform includes real, actionable vulnerability applications, knowledge tutorials, and comprehensive exams covering penetration testing knowledge. You can:
- Select levels from the **Challenge List** and access simulated real-world applications (such as e-commerce, ERP, email systems).
- Actually launch attacks on the target pages (injection, bypassing, privilege escalation, CSRF, SSRF, XXE…).
- Submit your findings to complete the level. The difficulty levels range from L1 for beginners to L5, featuring rare attack vectors.
- Review the **Vulnerability Knowledge Base** to understand the principles, then take the **Penetration Exam** to test your knowledge.
### Components
The platform consists of **four major content modules** and **one supporting module**:
| Module | Content | Quantity |
| ------------------------ | ------------------------------------------------------------------- | -------- |
| **① WebTap10 Practical Training** | 10 common vulnerabilities mapped to the OWASP Top 10. Each category has 5 difficulty levels (L1-L4 with different bypass techniques; L5 features rare attack vectors) | 50 Levels |
| **② Cryptography Training** | Common cryptography techniques used in penetration testing (encryption, classical ciphers, hash cracking, XOR, weak random numbers) | 5 Levels |
| **③ CTF Challenges** | CTF-related tasks such as image steganography, traffic analysis, compressed file cracking | 3 Levels |
| **④ Cybersecurity Penetration Exam** | Comprehensive exam covering penetration testing knowledge (14 subjects, 235 questions), both practice and exam modes | 14 Levels |
| **⑤ Vulnerability Knowledge Base** | Documentation for each vulnerability: life-like analogies, simple principles, attack methods, impacts, defenses | 11 Articles |
Total **72 challenging levels** (① 50 + ② 5 + ③ 3 + ④ 14). Each level represents a target application that can be attacked in real life.
## Advantages over traditional PHP training platforms
Traditional PHP training platforms (such as DVWA, Pikachu, sqli-labs) require a LNMP environment, database initialization, and multiple containers. Their interfaces are outdated, the questions are static, and they lack a comprehensive knowledge base. exp-labs addresses these issues with a thorough redesign:
| Dimension | Traditional PHP Training Platform | exp-labs |
|-------------------|---------------------------------- |-------------------------------------------------------------------|
| **Deployment** | Requires Apache/Nginx + PHP + MySQL; complex environment | Single-process Node.js, SQLite integrated; runs with `npm start` |
| **Architecture** | Front-end and back-end are intertwined; vulnerabilities and business logic mixed | Front-end Vue 3 + Back-end Express; vulnerabilities are isolated |
| **Question Types** | Repeating parameters for single vulnerabilities; focus on memorizing steps | Each question targets a specific target application; difficulty levels range from L1 to L5; includes rare attack vectors |
| **Feedback** | Correct/incorrect, no explanation | Correct answers displayed after grading; immediate feedback during practice |
| **Prevention of Memorization** | Fixed questions; answers can be memorized | Questions and options are randomized; exam mode involves randomly selecting 100 questions within a 90-minute time limit; scoring is based on four levels |
| **Knowledge Base** | None or rudimentary | Life-like analogies, simple principles, attack methods, defense strategies; complete learning experience |
| **Containerization** | Common, resource-intensive | No containers required; suitable for low-end machines for offline training |
## III. Functional Features
### 🎯 72 Practice Levels (List of Challenges)
#### 1. WebTap10 · 11 Types of Vulnerabilities × 5 Difficulty Levels (L1: Novice → L5: Purgatory)
For each type of vulnerability, L1-L4 levels involve **different bypass techniques**, while L5 Purgatory does not have any hints and uses rare attack vectors. | Category | L1: Novice | L2: Beginner | L3: Intermediate | L4: Expert | L5: Purgatory |
| ------- | ------------ | ------------ | ------------ | ------------ | ------------ |
| SQL Injection | Bypass with common passwords | Bypass with comments | UNION query | Bypass with keyword filtering | sqlmap writing files |
| XSS Attacks | Basic stealing | Double encoding | Fragmentation and concatenation | Multiple encoding countermeasures | CSP bypass for bare domains |
| Command Injection | Concatenation with semicolons | Bypass with pipe characters | Bypass with space filtering | Bypass with keyword filtering | TTY blind injection without output |
| File Upload | Bypass with double file extensions | Bypass with case sensitivity | Bypass with short tag content | Bypass with image header camouflage | Polyglot double parsing |
| Privilege Escalation | Enumeration of numeric IDs | Tampering with encoding parameters | Switching HTTP methods | Forging internal network request headers | Hash traversal |
| CSRF | GET-type cross-site attacks | Automatic form submission | Bypass with Referrer header verification | Bypass with Origin header verification | No Cookie injection |
| SSRF | Direct connection to loopback addresses | Bypass with localhost domain names | Bypass with decimal IP addresses | Bypass with IPv6 and short formats | Protocol smuggling |
| XXE | Direct reading of external entities | Utilization of parameter entities | Limited output (base64) | Parameter entity + encoding countermeasures | XInclude bypass |
| Path Traversal | Reading from directories | Multi-level traversal | Bypass with keyword filtering | Dual URL encoding | File descriptor traversal |
| Comprehensive Penetration | Injection + command injection | Comment injection + pipes | UNION + space bypass | Full-linkage with keyword filtering | No output, full-linkage |
#### 2. Cryptography (5 Challenges)
Base64 decoding → Caesar shift cipher → Hash cracking → XOR single-byte keys → Purgatory: Prediction of randomness
#### 3. Miscellaneous CTF Challenges (3 Challenges)
Normal images (image steganography) → Is this traffic real? (Wireshark traffic analysis) → Is this a normal zip file? (Compression package cracking)
### 🗂 Complete Challenge List (72 Challenges · #01-#72)
#### WebTap10 Practice (#01-#50)
| # | Category | Challenge Title |
|---|---|---|
| #01 | SQL Injection | Bypass with common passwords |
| #02 | SQL Injection | Bypass with comments |
| #03 | SQL Injection | UNION query |
| #04 | SQL Injection | Bypass with keyword filtering |
| #05 | SQL Injection | Purgatory · sqlmap writing files |
| #06 | XSS Attacks | Basic stealing |
| #07 | XSS Attacks | Double encoding |
| #08 | XSS Attacks | Fragmentation and concatenation |
| #09 | XSS Attacks | Multiple encoding countermeasures |
| #10 | XSS Attacks | Purgatory · CSP bypass for bare domains |
| #11 | Command Injection | Concatenation with semicolons |
| #12 | Command Injection | Bypass with pipe characters |
| #13 | Command Injection | Bypass with space filtering |
| #14 | Command Injection | Bypass with keyword filtering |
| #15 | Command Injection | Purgatory · TTY blind injection without output |
| #16 | File Upload | Bypass with double file extensions |
| #17 | File Upload | Bypass with case sensitivity |
| #18 | File Upload | Bypass with short tag content |
| #19 | File Upload | Bypass with image header camouflage |
| #20 | File Upload | Purgatory · Polyglot double parsing |
| #21 | Privilege Escalation | Enumeration of numeric IDs |
| #22 | Privilege Escalation | Tampering with encoding parameters |
| #23 | Privilege Escalation | Switching HTTP methods |
| #24 | Privilege Escalation | Forging internal network request headers |
| #25 | Privilege Escalation | Purgatory · Hash traversal |
| #26 | CSRF | GET-type cross-site requests |
| #27 | CSRF | Automatic form submission |
| #28 | CSRF | Bypass with Referrer header verification |
| #29 | CSRF | Bypass with Origin header verification |
| #30 | CSRF | Hell · No Cookie Injection |
| #31 | SSRF | Direct Connection to Loopback Address |
| #32 | SSRF | Bypass of localhost Domain Name |
| #33 | SSRF | Bypass of Decimal IP Addresses |
| #34 | SSRF | Bypass of IPv6 and Short Format |
| #35 | SSRF | Hell · Protocol Leakage |
| #36 | XXE | Direct Reading by External Entities |
| #37 | XXE | Utilization of Parameter Entities |
| #38 | XXE | Restricted Display (Base64 Encoding) |
| #39 | XXE | Parameter Entity + Encoding Countermeasures |
| #40 | XXE | Hell · XInclude Bypass |
| #41 | Path Traversal | Directory Traversal |
| #42 | Path Traversal | Multi-level Traversal |
| #43 | Path Traversal | Bypass of Keyword Filtering |
| #44 | Path Traversal | Double URL Encoding |
| #45 | Path Traversal | Hell · File Descriptor Traversal |
| #46 | Comprehensive Penetration | Injection + Command Injection |
| #47 | Comprehensive Penetration | Comment Injection + Pipeline Techniques |
| #48 | Comprehensive Penetration | UNION Injection + Space Bypass |
| #49 | Comprehensive Penetration | Full-Link Analysis of Keyword Filters |
| #50 | Comprehensive Penetration | Hell · Full-Link Bypass without Display |
#### Cryptology and Miscellaneous Topics (#51-#58)
| # | Category | Title |
| --- | ------ | ----------------------------------- |
| #51 | Cryptology | Base64 Decoding Information |
| #52 | Cryptology | Caesar Shift Cipher |
| #53 | Cryptology | Hash Breaching |
| #54 | Cryptology | XOR Single Byte Key |
| #55 | Cryptology | Hell · Prediction of Missing Randomness |
| #56 | Miscellaneous | Normal Images (Image Stealing) |
| #57 | Miscellaneous | Is This Traffic Real? (Traffic Analysis) |
| #58 | Miscellaneous | Is This a Normal Zip File? (Compression Breaching) |
#### Cybersecurity Penetration Exam (#59-#72)
corresponds to the following 14 topics, one question per topic. Complete all questions correctly to pass (number of questions and difficulty levels see exam table). ### 📝 Cybersecurity Penetration Exam (235 Questions · 14 Topics)
Comprehensive exam covering penetration knowledge, categorized by question type and difficulty level:
| Difficulty | Topic | Question Type | Number of Questions |
| -------- | --------------------- | -------------- | ---------------------- |
| L1 Novice | Multiple Choice · Simple Questions | Multiple Choice | 10 |
| L1 Novice | Judgment Questions | Judgment | 50 |
| L2 Beginner | Multiple Choice · Windows Special Questions | Multiple Choice | 10 |
| L2 Beginner | Multiple Choice · WiFi Protocols | Multiple Choice | 10 |
| L3 Intermediate | Multiple Choice · Intermediate Analysis Questions | Multiple Choice | 20 |
| L3 Intermediate | Multiple Choice · Security Audit Questions | Multiple Choice | 20 |
| L3 Intermediate | Multiple Choice · Hardware Hacking Questions | Multiple Choice | 10 |
| L3 Intermediate | Multiple Choice · IoT Security Questions | Multiple Choice | 15 |
| L3 Intermediate | Multiple Choice · Windows NT Questions | Multiple Choice | 14 |
| L3 Intermediate | Multiple Choice · Traceability Questions | Multiple Choice | 12 |
| L3 Intermediate | Multiple Choice · Android Reverse Engineering Questions | Multiple Choice | 13 |
| L4 Expert | Multiple Choice · Security Expert Questions | Multiple Choice | 30 |
| L4 Expert | Multiple Choice · Linux Kernel Questions | Multiple Choice | 16 |
| L4 Expert | PWN Questions | Short Answer | 5 |
**Total Questions:** 235 (Multiple Choice: 155 + Judgment: 50 + Multiple Choice: 25 + PWN: 5)
Two modes:
- **Practice Mode**: Answer questions by topic. Correct answers will immediately display as green markers with explanations. Suitable for learning.
- **Exam Mode**: Randomly select 100 questions (50 Multiple Choice, 30 Judgment, 15 Multiple Choice, 5 PWN). Time limit: 90 minutes. After submitting the exam, only scores and accuracy will be displayed. Scoring system: 60 Pass, 70 Good, 90 Excellent, 100 Perfect. A message will appear before the exam to ensure honesty: “Honesty is tested here!”
> All questions and options are randomized each time the exam is taken to prevent memorization. ### 📐 Question Types (Four Types)
The exam includes **4 types of questions**, each with different answering methods and scoring rules:
| Question Type | Answering Method | Scoring Rules | Number of Questions |
| ------------ | ------------------- | -------------- | ---------------------- |
| **Multiple Choice** | Selecting 1 option from 4 options (Click on options) | Correct option matches selected item | 155 questions |
| **Question Type** | “Choose One: Correct/Incorrect” (Options randomly selected from left to right) | Score if the chosen option matches the stated facts in the question | 50 questions |
| **Multiple Choice** | Select multiple options from 4 choices (Can click to cancel) | Score only if the selected options *exactly match* the correct ones (No points for incorrect selections) | 25 questions |
| **PWN** | Free-text answer in the input field (Briefly describe the approach used) | Score if the answer includes **keywords from the reference answer** (Case sensitivity does not apply) | 5 questions |
Performance of each question type in both modes:
- **Practice Mode**: Immediate feedback upon selecting answers in single-choice, judgment, or multiple-choice questions—green for correct, red for incorrect. "Correct/Incorrect" is displayed at the bottom of the question. For PWN, the keywords are instantly compared after input, and the reference answer is displayed. All correct answers are shown after submitting the quiz.
- **Quiz Mode**: No indication of correctness during the answering process. Only scores and accuracy percentages are displayed after submission.
> Multiple-choice questions have strict scoring rules: Only options that *exactly match* the standard answer receive points. Selecting some options correctly does not earn points—this scoring method aligns with actual security assessment standards. ### 📚 Knowledge Base
For each vulnerability, we provide:
- Analogies from everyday life
- Simple explanations
- Common attack methods (including examples of payloads and their analysis)
- Consequences of the vulnerabilities
- Defense recommendations
- Notes for passing the quiz—creating a complete learning loop. ---
## 4. Get Started
Node.js version must be **≥ 22**. ```bash
# Install dependencies
npm install
# Development mode (Frontend: Vite + Backend: Hot Reload)
npm run dev
# Production mode
npm run build
npm start
```
After starting, visit **http://localhost:3000**:
1. The homepage automatically redirects to the “Install” page. Click “Install the” to initialize the database, create an administrator, and generate 72 random challenges.
2. Log in using the admin account.
3. Enter the “Challenges List” to start attacking, or enter the “Penetration Quiz” to test your skills.
> Reset the: Use the “Reset” button in the upper right corner (You need to enter “RESET” to confirm). This will clear all data and require reinstalling the. ---
## 5. Project Structure
```
exp-labs/
├── server/ # Express backend
│ ├── index.js # Service entry point (API + static hosting)
│ ├── seed.js # Challenge definitions and installation logic (72 challenges)
│ ├── exam-data.js # Penetration quiz database (235 questions)
│ ├── db.js # SQLite database layer
│ ├── auth.js # Authentication and session management
│ └── vuln/ # Implementations for various vulnerabilities (SQLi/XSS/commands/uploading…)
│ ├── scripts/ # Auxiliary scripts (pcap generation, etc.)
│ ├── public/ # Static resources like favicon.svg
│ └── e2e/ # Playwright end-to-end testing
```
### Main Technologies Used
| Layer | Technology |
| ------------ | ----------------------------------------- |
| Frontend | Vue 3, Vue Router, Pinia, Vite |
| Backend | Express 5, node:sqlite (built-in SQLite) |
| Testing | Vitest (Unit testing), Playwright (E2E) |
| Code Quality | TypeScript, ESLint, oxlint, Prettier |
---
## 6. Page Navigation
| Page | Route | Description |
| ---------- | ------------------- | ------------------------------------------ |
| Installation Page | `/install` | Redirects to the installation page automatically; initializes the upon clicking |
| Login Page | `/login` | Redirects to the login page after successful installation; allows administrators to log in |
| Challenges List | `/challenges` | Displays 72 challenges grouped by vulnerability type, along with progress |
| Challenge Details | `/challenges/:id` | Descriptions of challenges, vulnerability target pages, hints, and flag submissions |
| Penetration Quiz | `/exam` | Practice mode + Quiz mode (14 questions / timed challenges) |
| Vulnerability Knowledge Base | `/docs` | Documentation tutorials for various vulnerabilities |
---
## 7. Testing
```bash
npm run lint # ESLint + oxlint
npm run type-check # TypeScript type checking
npm run test:unit # Vitest unit testing
npm run test:e2e # Playwright end-to-end testing
```
---
## Disclaimer
This project is **only for security learning and teaching purposes**. All targets represent fictional business applications. Do not use these technologies in unauthorized real systems.
[source-iocs-preserved url=http://localhost:3000**：]