LLMVault - An intentionally vulnerable OWASP LLM Top 10 train

项目说明

<p align="center">
<img src="docs/banner.png" alt="LLMVault Banner" width="100%">
</p>

LLMVault v2.0

<h3 align="center">

🚀 The Ultimate Hands-On OWASP LLM Top 10 Training Platform

</h3>

🎬 Demo

<p align="center">
<img src="./docs/demo.gif" width="650" alt="LLMVault Demo">
</p>

<p align="center">
<strong>Learn • Exploit • Defend</strong>

</p>

<p align="center">

<img src=" alt="Stars">

<img src=" alt="Forks">

<img src=" alt="License">

<img src=" alt="Last Commit">

<img src=" alt="Issues">

<br>

<img src=")-8A2BE2?style=for-the-badge" alt="OWASP">

<img src=" alt="Docker">

<img src=" alt="Python">

</p>

A deliberately-, CTF-style training range for the OWASP Top 10 for LLM Applications (2025) — WebGoat / KubeGoat, but for AI.

It runs in two modes, and you pick one from the dashboard:

Play Mode is the scored range. 25 labs across three tiers: ten core one-per-category labs; ten ad, multi-turn labs (jailbreaking, data poisoning, agent exploitation, model extraction); and five expert labs modelling real-world attack classes. Each tier unlocks the next. The assistants are scripted, so flags reproduce every time and you can practise a technique until it's muscle memory.

Live Mode points the same attacks at a real model running on your machine. Nothing is scripted, the secret is generated fresh per session, and there is no flag to look up — you either talk the model into leaking it or you don't. No score, no penalties, unlimited hints.

Every lab pairs the attack with a defense: solve it, then read what would ha you.

> ⚠️ E here is intentionally insecure. Authorised, self-hosted security education only. Don't expose it to the internet or reuse its code in production.

🚀 What's new in v2.0.0

🔴 Live Mode

A real local model instead of a scripted bot — genuinely unpredictable, so yesterday's payload may die today.

📊 A real dashboard

🏅 Milestones and alerts

🕹️ Play Mode is untouched

E you had still works exactly as before.

Pre, in v1.1.0

📸 Screenshots

| Labs (three tiers) | A lab in action | Completion card |
|---|---|---|
| <img src="docs/labs.svg" width="300"> | <img src="docs/lab.svg" width="300"> | <img src="docs/completion-card.png" width="300"> |

---

🧩 Core Tier — OWASP LLM Top 10

| OWASP (2025) | Lab | Technique |
|---|---|---|
| LLM01 Prompt Injection | The Obedient Assistant | direct instruction o |
| LLM02 Sensitive Info Disclosure | Redaction Theater | output-filter bypass |
| LLM03 Supply Chain | Trust the Manifest? | typosquatted / unsigned dependency |
| LLM04 Data & Model Poisoning | The Sleeper Phrase | poisoned-data backdoor trigger |
| LLM05 Improper Output Handling | Rendered Without Question | unsanitised output → injection |
| LLM06 Excessi | Keys to the Kingdom | o tool, no authz |
| LLM07 System Prompt Leakage | Loose Lips | secret leaked from system prompt |
| LLM08 & Embedding | Retrie Borders | RAG retrie ACLs |
| LLM09 Misinformation | The Yes-Man | sycophancy / false authority |
| LLM10 Unbounded Consumption | Denial of Wallet | runaway generation + leaky error |

🔥 Ad Tier — Multi-Turn Challenges (unlocks after completing all 10 Core challenges)

These are con: no single message wins — they require building state across turns (roleplay escalation, iterati, tool chaining, oracle querying).

| OWASP | Lab | Ad technique |
|---|---|---|
| LLM01 | Roleplay Unchained | multi-turn jailbreak escalation |
| LLM02 | Death by a Thousand Hints | fragment reconstruction from a partial-disclosure oracle |
| LLM03 | The Tampered Registry | deployed- hash correlation |
| LLM04 | Teach Me Wrong | active data poisoning of an online-learning filter |
| LLM05 | The Note Keeper | stored / second-order injection |
| LLM06 | Confused Deputy | agent tool-chaining (SSRF to internal metadata) |
| LLM07 | Method Actor | multi-technique system-prompt extraction |
| LLM08 | Crossed Wires | cross-tenant RAG memory bleed |
| LLM09 | The Confident Liar | hallucination → o cascade |
| LLM10 | The Oracle | query-based model extraction |

⚔️ Expert Tier — Real-World Attack Classes (unlocked after all Ad challenges are solved)

Five expert labs modelling real-world, disclosed- attack classes against LLM systems. Each is simulated — the app recognises the known payload and returns a flag; no real RCE/SSRF/SQL happens in the tool.

This tier ships ENCRYPTED, and its contents are intentionally not listed here. The challenges and flags are AES-encrypted (Fernet) into challenges/expert.enc with a key derived from a secret Expert Access Key that lives only in the operator's private vault — never in the repo. Cloning the repo yields ciphertext only; the specific scenarios stay secret until you earn them. To unlock, a player must (1) finish all Core + Ad labs and (2) enter the key, which the operator (CyberSunil) hands out manually after the player shares their completion card. Wrong key → authenticated decryption fails → nothing is re.

> Disco what's inside is part of the challenge. 🔒

---

⚡ Live Mode — a real model, no script

Play Mode teaches you the shape of each attack against a bot that always answers the same way.
Live Mode takes that away. The assistant is a real LLM running locally, the secret it's guarding
is generated per session, and it streams its reply token by token so you can watch a jailbreak
land or fall apart mid-sentence.

There's no score here and no flag box. You win when the model itself gives up the secret, and the
app checks its output rather than your typing. Hints are free and there are as many as you want —
gating them behind a cost would only punish curiosity.

| Scenario | OWASP | What you're actually learning |
|---|---|---|
| The Helpdesk O | LLM01 Prompt Injection | A secret in a system prompt is not stored, it's just *context*. You'll get the model to hand over a Tier-2 escalation code by out-framing its instructions — and find that authority, urgency and role-play all still work on a li. |
| The Screenshot Triage | LLM01 Prompt Injection (multimodal) | Indirect injection. You never type the payload — you hide it in an image you upload, and the triage assistant reads it as instructions. This is the lesson people skip: text extracted from a file is user input, and OCR is an attack surface. |
| The Report Renderer | LLM05 Improper Output Handling | The model's reply looks harmless; the damage happens *downstream*, when a template engine renders it. You'll make the rendered report leak a value the model never saw, which is the difference between "the model said something bad" and "the model's output was executed". |

Each one ends with the defence — why the bug exists and what actually fixes it, not just
"sanitise your inputs".

Getting Live Mode running

Expect a few seconds per reply on a laptop CPU; that's normal. Running Ollama elsewhere? Point
OLLAMA_HOST at it. Prefer an OpenAI-compatible endpoint? Set OPENAI_API_KEY. Full notes in
docs/LI.md.

Skip this section entirely and nothing breaks. Without a local model the Live Zone shows the
setup steps and the other 25 labs carry on working offline.

---

🚀 Run it

Flask debug mode is off by default (the Werkzeug debugger runs arbitrary code). Only on a
trusted, local machine, opt in with LLM=1 python app.py (true also works).

No API key needed, ever. Play Mode's assistants are scripted, so flags reproduce reliably and
the whole range runs offline. Live Mode adds a real model, but it runs on your machine too — see
Live Mode below. Nothing in LLMVault calls a hosted API.

---

🐳 Run with Docker

Served by gunicorn (single worker, so the in-memory scoreboard stays consistent).
Do not expose this to the public internet — it's intentionally . To bind
to localhost only, use "127.0.0.1:5000:5000" in docker-compose.yml.

💾 Persistence (self-host friendly)

Progress and the scoreboard are saved to data/progress.json — no database needed — so
they survive page refresh *and* a ser restart. In Docker the ./data
keeps them across docker compose down/up. Delete the file to reset e.

🙋 Player experience

🕹️ How to play

1. On first launch you set a player name (locked once chosen — it can't be changed after).
2. From the dashboard, pick Play Mode for the scored labs or Live Mode for the real model.
3. Work the core labs; make each assistant leak its flag using that category's technique.
4. Clear all 10 core labs to unlock the ad tier; clear all ad to unlock the expert tier.
5. Reveal hints if stuck. Submit flags (LLMVAULT{...}, configurable in config.py).
6. Cards float on hover and turn green when solved; track e on the Scoreboard.

Scoring (Play Mode only): core 100–300 pts, ad 400, expert 500; hints cost
10 / 25 / 50, escalating. Your rank — Initiate up to Vault Master — is the highest threshold
your score has passed. Live Mode is deliberately outside all of this: no points either way, so
it can never move your scoreboard position.

---

🎓 Completion card & sharing

Three milestone cards unlock automatically as a pop-up the moment you finish a tier:
a green Beginner card (all 10 Core labs), a blue Master card (all 20 Core +
Ad), and a purple Expert card (the full 25). Each pop-up also shows the badges you now
hold, and they queue rather than o each other — clear two tiers in one submit and you see
both. All three live at /completion as well. Each has a Download card (PNG/SVG) button,
a pre-written caption (Copy), and LinkedIn/X openers.

Sharing an image: social sites can't auto-attach an image from a share link, so the
flow is: Download the card → open LinkedIn/X → paste the caption → attach the image.
Players post it and tag CyberSunil to receive the Expert Access Key. The card renders
ser as a themed SVG (/card.svg) and exports to PNG in-browser — no external deps.

🧱 Architecture

Each challenge is a Challenge subclass with a respond(message, state) that encodes the vuln; ad labs use the persistent state dict for multi-turn logic. Add your own by dropping a module in challenges/ (or challenges/ad/) and registering it.

---

👤 Credit & license

Made by CyberSunil. Copyright © 2026 Sunil Tripathy.. Released under the MIT License (see LICENSE), with a security notice that the project is deliberately and for authorised training only. Forks and deri works must comply with the MIT License. Use of the LLMVault branding remains subject to the trademark policy.

---

⚖️ Intellectual Property

The LLMVault™ name, logo, branding, artwork, banners, screenshots, documentation, and other assets are not licensed under the MIT License and may not be used without prior written permission.

---
*Break it here so you can defend it e.*

---

Contributions welcome — see CONTRIBUTING.md. Security policy: SECURITY.md.

项目信息

开发语言：Python

Star 数：332

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An intentionally vulnerable OWASP LLM Top 10 training platform for AI Security, Prompt Injection, RAG Security, Agent Security, and GenAI penetration testing.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。