A collection of 10 vulnerable LAMP stack lab environments for practicing web application security testing. Each lab is containerized with Docker for easy deployment and isolation.
These labs are open source and free to use. No account, no paywall, no lab time credits. Clone the repo, start a container, and get to work.
| Lab | Preview | Description | Difficulty |
|---|---|---|---|
| Abby's Lab |  |
Break through Abby's IPS to breach her system. | Hard |
| Backdrop |  |
Dive into the Backdrop CMS challenge! Unravel hidden secrets and master this unique CMS. | Easy |
| Blogger |  |
Perform a penetration test against this blog. | Medium |
| Cloud Admin |  |
Dive into cloud security and uncover vulnerabilities in cloud and server environments. | Medium |
| Marketer |  |
Attack this marketing provider using your file upload and cryptography skills. | Medium |
| Mr Robot V2 |  |
FSociety's task: Hack Ecorp and their employees. | Medium |
| Pet Shop |  |
Find your way into this old, unfinished website. | Easy |
| Shuttle Booking |  |
Unleash the full power of XSS. | Medium |
| Splinter |  |
Exploit SSTI vulnerabilities at Unemployable INC. | Easy |
| Texas Ranger |  |
Yee haw! Show the Texas Rangers who's boss. | Easy |
New to this? Start with Texas Ranger, Pet Shop, or Backdrop, then work up to Abby's Lab.
- Docker
- Docker Compose
git clone https://github.com/Lorikeet-Security/owasp-top-10-labs-lamp-dockerized.git
cd owasp-top-10-labs-lamp-dockerized
# Start a specific lab
cd <lab-name>
docker-compose up -dTear a lab down when you are finished with it:
docker-compose down -vlab-name/
├── docker-compose.yml
├── Dockerfile
└── src/
└── (application source code)
Note: Shuttle Booking may require you to set an /etc/hosts config due to a DNS redirect on the lab machine to shuttlebooking.pctfs.
These labs contain intentionally vulnerable applications. They are built to be broken.
- Run them on an isolated host or a local VM, never on a production system
- Do not expose them to the public internet or to any network you do not control
- Bring them down when you are done rather than leaving them running
- Anything you learn here applies only to systems you own or have written authorization to test
Pull requests are welcome. Useful contributions include:
- Fixes to broken builds, images, or dependencies
- New labs that follow the existing structure
- Walkthroughs and writeups
- Improvements to setup, documentation, or container hygiene
Please do not commit real credentials, customer data, or anything that came out of a live engagement.
Hosted versions of these labs, leaderboards, and live CTF events run at parrot-ctfs.com. If your team wants a private CTF or a scored event, get in touch through lorikeetsecurity.com.
Released under the MIT License.
You are free to use, modify, and redistribute these labs, including commercially, for training, coursework, internal enablement, or your own CTF events. Attribution is appreciated but the only requirement is keeping the license and copyright notice intact.
© 2026 Lorikeet Corp | Parrot CTFs is a brand of Lorikeet Security
parrot-ctfs.com | lorikeetsecurity.com