Learn • Exploit • Defend
-8A2BE2?style=for-the-badge){kind=icon}
| 
| 
|
---
## 🧩 Core Tier — OWASP LLM Top 10
| OWASP (2025) | Lab | Technique |
|---|---|---|
| LLM01 Prompt Injection | The Obedient Assistant | direct instruction override |
| LLM02 Sensitive Info Disclosure | Redaction Theater | output-filter bypass via encoding |
| LLM03 Supply Chain | Trust the Manifest? | typosquatted / unsigned dependency |
| LLM04 Data & Model Poisoning | The Sleeper Phrase | poisoned-data backdoor trigger |
| LLM05 Improper Output Handling | Rendered Without Question | unsanitised output → injection |
| LLM06 Excessive Agency | Keys to the Kingdom | over-permissioned tool, no authz |
| LLM07 System Prompt Leakage | Loose Lips | secret leaked from system prompt |
| LLM08 Vector & Embedding | Retrieval Without Borders | RAG retrieval ignores ACLs |
| LLM09 Misinformation | The Yes-Man | sycophancy / false authority |
| LLM10 Unbounded Consumption | Denial of Wallet | runaway generation + leaky error |
## 🔥 Advanced Tier — Multi-Turn Challenges (unlocks after completing all 10 Core challenges)
These are **conversational**: no single message wins — they require building state across turns (roleplay escalation, iterative poisoning, tool chaining, oracle querying).
| OWASP | Lab | Advanced technique |
|---|---|---|
| LLM01 | Roleplay Unchained | **multi-turn jailbreak** via persona escalation |
| LLM02 | Death by a Thousand Hints | fragment reconstruction from a partial-disclosure oracle |
| LLM03 | The Tampered Registry | deployed-vs-canonical hash correlation |
| LLM04 | Teach Me Wrong | **active data poisoning** of an online-learning filter |
| LLM05 | The Note Keeper | **stored / second-order** injection |
| LLM06 | Confused Deputy | **agent tool-chaining** (SSRF to internal metadata) |
| LLM07 | Method Actor | multi-technique system-prompt extraction |
| LLM08 | Crossed Wires | cross-tenant RAG memory bleed |
| LLM09 | The Confident Liar | hallucination → overreliance cascade |
| LLM10 | The Oracle | **query-based model extraction** |
## ⚔️ Expert Tier — Real-World Attack Classes (unlocked after all Advanced challenges are solved)
Five **expert** labs modelling real-world, disclosed-vulnerability attack classes against LLM systems. Each is **simulated** — the app recognises the known payload and returns a flag; no real RCE/SSRF/SQL happens in the tool.
**This tier ships ENCRYPTED, and its contents are intentionally not listed here.** The challenges and flags are AES-encrypted (Fernet) into `challenges/expert.enc` with a key derived from a secret **Expert Access Key** that lives only in the operator's private vault — never in the repo. Cloning the repo yields ciphertext only; the specific scenarios stay secret until you earn them. To unlock, a player must (1) finish all Core + Advanced labs and (2) enter the key, which the operator (**CyberSunil**) hands out **manually** after the player shares their completion card. Wrong key → authenticated decryption fails → nothing is revealed.
> Discovering what's inside is part of the challenge. 🔒
---
## 🚀 Run it
```bash
pip install -r requirements.txt
python app.py
# open http://127.0.0.1:5000
```
No API key needed — the vulnerable assistants are **deterministic/scripted**, so flags reproduce reliably and the whole range runs fully offline.
---
## 🐳 Run with Docker
```bash
# build + run
docker compose up --build # then open http://127.0.0.1:5000
# or plain docker:
docker build -t llmvault .
docker run -p 5000:5000 llmvault
```
Served by gunicorn (single worker, so the in-memory scoreboard stays consistent).
**Do not expose this to the public internet** — it's intentionally vulnerable. To bind
to localhost only, use `"127.0.0.1:5000:5000"` in `docker-compose.yml`.
## 💾 Persistence (self-host friendly)
Progress and the scoreboard are saved to `data/progress.json` — **no database needed** — so
they survive page refresh *and* a server/container restart. In Docker the `./data` volume
keeps them across `docker compose down/up`. Delete the file to reset everyone.
## 🙋 Player experience
- **First-run name gate** (locked once set) and a **one-time guided tutorial** on your first lab.
- Every lab opens with a **short reference panel** for its OWASP category — plain-language explanation plus what to watch for — before you start attacking it.
- After you solve a lab, a **📘 Learn — the fix** panel reveals the defensive lesson for that OWASP category.
- **Responsive layout** — works on phones (the sidebar collapses, panels stack).
## 🕹️ How to play
1. On first launch you set a **player name** (locked once chosen — it can't be changed after).
2. Work the **core** labs; make each assistant leak its flag using that category's technique.
3. Clear all 10 core labs to unlock the **advanced tier**; clear all advanced to unlock the **expert tier**.
4. Reveal **hints** if stuck (−5 pts each). Submit flags (`LLMVAULT{...}`, configurable in `config.py`).
5. Cards **float on hover** and turn **green when solved**; track everything on the **Scoreboard**.
**Scoring:** core 100–300 pts, advanced 400, expert 500; hints cost 10 / 25 / 50 (escalating).
---
## 🎓 Completion card & sharing
Two milestone cards unlock automatically as a pop-up the moment you finish a tier:
a **green Beginner** card (all 10 Core labs) and a **blue Master** card (all 20 Core +
Advanced). Both are also at `/completion`. Each has a **Download card (PNG/SVG)** button,
a pre-written caption (Copy), and LinkedIn/X openers.
**Sharing an image:** social sites can't auto-attach an image from a share link, so the
flow is: **Download the card → open LinkedIn/X → paste the caption → attach the image.**
Players post it and tag **CyberSunil** to receive the Expert Access Key. The card renders
server-side as a themed SVG (`/card.svg`) and exports to PNG in-browser — no external deps.
## 🧱 Architecture
```
app.py # Flask: labs, chat, hint, submit, scoreboard, name-gate, unlock gating
config.py # APP_NAME, AUTHOR/COPYRIGHT, flag prefix, scoring
owasp_notes.py # per-category reference panel content (shown on lab entry)
challenges/
__init__.py # Challenge base (tier), registry, core_labs()/advanced_labs()
llm01_..llm10_*.py # core labs
advanced/a01_..a10_*.py # advanced multi-turn labs
expert.enc # ENCRYPTED expert tier (ciphertext, shipped)
expert_meta.json # public KDF salt/params
expert_vault.py # runtime decryptor + declarative challenge engine
templates/ static/ # dark violet UI + completion card + expert key gate
static/img/notes/ # icon artwork for the per-category reference panels
Dockerfile docker-compose.yml # containerised deploy
LICENSE # MIT + security notice
```
Each challenge is a `Challenge` subclass with a `respond(message, state)` that encodes the vuln; advanced labs use the persistent `state` dict for multi-turn logic. Add your own by dropping a module in `challenges/` (or `challenges/advanced/`) and registering it.
---
## 👤 Credit & license
Made by **CyberSunil**. Copyright © 2026 Sunil Tripathy.. Released under the **MIT License** (see `LICENSE`), with a security notice that the project is deliberately vulnerable and for authorised training only. Forks and derivative works must comply with the MIT License. Use of the LLMVault branding remains subject to the trademark policy.
---
### ⚖️ Intellectual Property
- 📄 **Source Code:** MIT License
- ™️ **Trademark & Branding:** See [`TRADEMARKS.md`](https://github.com/CyberSunil/LLMVault/blob/HEAD/TRADEMARKS.md)
The **LLMVault™** name, logo, branding, artwork, banners, screenshots, documentation, and other visual assets are **not** licensed under the MIT License and may not be used without prior written permission.
---
*Break it here so you can defend it everywhere.*
---
Contributions welcome — see [CONTRIBUTING.md](https://github.com/CyberSunil/LLMVault/blob/HEAD/CONTRIBUTING.md). Security policy: [SECURITY.md](https://github.com/CyberSunil/LLMVault/blob/HEAD/SECURITY.md).