{"id":51784795,"url":"https://github.com/hjosugi/learning-security-labs","last_synced_at":"2026-07-20T16:31:38.726Z","repository":{"id":366151116,"uuid":"1275229881","full_name":"hjosugi/learning-security-labs","owner":"hjosugi","description":"Ethical hacking and defensive security learning repo using local OWASP-style labs","archived":false,"fork":false,"pushed_at":"2026-06-20T12:48:57.000Z","size":4,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-20T14:34:19.889Z","etag":null,"topics":["devsecops","ethical-hacking","learning","owasp","security","web-security"],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hjosugi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-20T12:22:51.000Z","updated_at":"2026-06-20T12:49:00.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/hjosugi/learning-security-labs","commit_stats":null,"previous_names":["hjosugi/learning-security-labs"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/hjosugi/learning-security-labs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hjosugi%2Flearning-security-labs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hjosugi%2Flearning-security-labs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hjosugi%2Flearning-security-labs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hjosugi%2Flearning-security-labs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hjosugi","download_url":"https://codeload.github.com/hjosugi/learning-security-labs/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hjosugi%2Flearning-security-labs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35693381,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"ssl_error","status_checked_at":"2026-07-20T02:08:09.736Z","response_time":111,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["devsecops","ethical-hacking","learning","owasp","security","web-security"],"created_at":"2026-07-20T16:31:36.820Z","updated_at":"2026-07-20T16:31:38.721Z","avatar_url":"https://github.com/hjosugi.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Learning Security Labs\n\nEthical hacking, secure coding, web security testing, threat modeling, and defensive security labs.\n\nLast verified: 2026-06-21\n\n## Development Environment\n\nIf Python is missing locally, enter the Nix shell:\n\n```bash\nnix develop\n```\n\n## Runnable Starter Project\n\nRun the localhost-only defensive header lab:\n\n```bash\npython3 projects/local-header-lab/check.py\npython3 projects/local-header-lab/test_headers.py\n```\n\n## Target Hands-On Projects\n\nOWASP input validation:\n\n```bash\npython3 projects/owasp-input-validation-lab/lab.py\npython3 projects/owasp-input-validation-lab/test_lab.py\n```\n\nAccess control (Broken Object-Level Authorization / IDOR):\n\n```bash\npython3 projects/access-control-lab/server.py\npython3 -m unittest discover -s projects/access-control-lab -p 'test_*.py'\n```\n\nKeep these labs local and defensive: demonstrate the vulnerable shape, then prove the safe version.\n\nSee `docs/learning-resources.md` for curated primary sources.\n\n## Safety Boundary\n\nThis repository is for authorized, local, educational security practice only.\n\nAllowed:\n\n- local vulnerable training apps\n- your own applications\n- intentionally created lab environments\n- defensive testing and verification\n- secure coding notes\n\nNot allowed:\n\n- scanning or attacking third-party systems\n- bypassing access controls on real services\n- credential theft\n- persistence, stealth, or malware\n- instructions for real-world abuse\n\n## What This Repo Teaches\n\nThis repo is for learning attacker-informed defensive engineering without crossing authorization boundaries.\n\nEach lab should make these parts explicit:\n\n- authorization scope\n- target environment\n- test objective\n- evidence to collect\n- expected finding format\n- remediation\n- verification after the fix\n- what is intentionally out of scope\n\n## Learning Path\n\n1. Security mindset and legal boundaries\n2. OWASP Top 10 awareness\n3. OWASP Web Security Testing Guide workflow\n4. Authentication and session testing in local labs\n5. Input validation and injection prevention\n6. Access control testing\n7. Dependency and secret scanning\n8. Threat modeling and secure design reviews\n9. Reporting: finding, impact, reproduction, remediation\n\n## Lab Rules\n\n- Default target is `localhost`.\n- Prefer intentionally vulnerable training apps or tiny apps created inside this repo.\n- Tool output should be trimmed to the useful evidence, not dumped wholesale.\n- No real credentials, real tokens, production domains, or private targets.\n- Each lab must include a defensive fix or verification step.\n\n## Planned Structure\n\n```text\nlabs/\n  local-web-security/\n  auth-session-lab/\n  access-control-lab/\n  dependency-scanning/\ndocs/\n  2026-learning-items.md\n  lab-strategy.md\n  legal-safety-boundaries.md\n  repository-profile.md\n```\n\n## What Belongs Elsewhere\n\n- general platform security checklists belong in `learning-platform-engineering`\n- production incident/runbook notes do not belong in a public lab repo\n- P2P abuse-resistance design belongs in `learning-platform-engineering`\n- backend implementation fixes can be mirrored in `learning-backend-ddd`\n\n## First Milestones\n\n1. Add a local vulnerable web lab with a clear legal/scope statement.\n2. Add ZAP baseline scanning against localhost only.\n3. Add an auth/session lab.\n4. Add an access-control lab.\n5. Add dependency and secret scanning examples.\n6. Add a finding report template.\n\n## References\n\n- OWASP Top 10: https://owasp.org/www-project-top-ten/\n- OWASP Web Security Testing Guide: https://owasp.org/www-project-web-security-testing-guide/\n- OWASP ASVS: https://owasp.org/www-project-application-security-verification-standard/\n- ZAP documentation: https://www.zaproxy.org/docs/\n\n## License\n\n0BSD. You can use, copy, modify, and distribute this project for almost any purpose.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhjosugi%2Flearning-security-labs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhjosugi%2Flearning-security-labs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhjosugi%2Flearning-security-labs/lists"}