Hands-on
Practice locally
The lessons teach the theory; the labs let you attack real, intentionally-vulnerable apps. Those apps are deliberately not hosted here — a live vulnerable app is a liability — so you run them on your own machine, where nothing is ever exposed to the internet.
▪ GitHub Codespaces
Nothing to install. Open the repo in a Codespace (Docker is preinstalled) and run the platform. Ports are forwarded to a private URL only you can see.
▪ Local Docker
With Docker installed, clone the repo and bring the platform up:
git clone https://github.com/0x6a03448f4d/OWASP-TOP10.git
cd OWASP-TOP10/platform/infra
docker compose up -dHow it fits together
Read a vulnerability’s lesson here, then launch its matching lab from the local dashboard (http://localhost) to try the attack and the fix yourself. Every lab is an isolated Docker container you can reset or tear down at any time.