cyber-battleground - A full-stack, hands-on cybersecurity simulation pl

项目说明

🛡️ Cyber Battleground

A full-stack, hands-on cybersecurity simulation platform for learning, teaching, and demonstrating both offensive and defensive web security.

Built for education, demos, and real-world security awareness.

---

Web Application

Attack Dashboard

Defense Dashboard

🚩 What is Cyber Battleground?

Cyber Battleground is an intentionally web application and security lab. It provides a safe, interacti to:

Explore and exploit real-world web (SQL Injection, XSS, brute-force, file upload, command injection)

Launch and obser via a custom Attack Dashboard

Monitor, detect, and block attacks in real time with a professional Defense Dashboard

Learn best practices and mitigation strategies for each , with in-app explanations

> ⚠️ WARNING: This project is intentionally insecure.
> Ne to a public server. Use only in isolated, local, or educational en.

---

✨ Features

Web Application

Built with Express (Node.js) and SQLite

Classic :

- SQL Injection (login)
- Cross-Site Scripting (XSS) (comments)
- Brute-force (login)
- Un File Upload
- Command Injection

Each page includes:

- A right-side card explaining the , example attacks, and mitigation strategies
- A prominent warning banner

Attack Dashboard

Modern, card-based UI with a dark hacker theme

Each attack (SQLi, brute-force, XSS, file upload, command injection) is an independent card

Manual and auto-attack buttons (auto-attack is rate-limited)

All attack scripts are Python-based, modular, and easy to extend

Defense Dashboard

Blue team theme, card-based layout

Li Per Minute chart (shows all real requests, smoothed, always )

Recent Requests table (last 5, with modal for full stream, attacks highlighted)

Detected Attacks (last 5 unique, deduplicated by endpoint/type/timestamp, attacks highlighted)

Blocked IPs section with unblock button

Clear Detections button to fully clear detection logs from both UI and backend

Note at the top about localhost IPs

Only real user/attack activity is shown; /api/*, /attack/*, /favicon.ico are filtered out

Detection & Defense Logic

Detects SQLi, XSS, brute-force login, malicious file upload (by extension), and command injection (by shell metacharacters)

All detected attacks are shown in the dashboard and highlighted in the chart and tables

Backend and frontend deduplication prevent duplicate detections from appearing

Auto-blocking for SQLi, XSS, and brute-force attacks

Other Features

Educational content: Every is explained with examples and defenses

Beautiful, modern UI: Green (web), red (attack), blue (defense) themes

All logs, attacks, and blocks are fully synchronized between memory and storage

Debug endpoints and logs for de and demo purposes

Responsi UI/UX

---

🛠️ Getting Started

1. Clone the Repo

2. Install Node.js Dependencies

Node.js: v18.x or later

Express: ^4.18.2

sqlite3: ^5.1.6

body-parser: ^1.20.2

multer: ^1.4.5-lts.1

3. Install Python Requirements

Python: 3.8+

requests: >=2.25.0

4. Run the App

5. Open in Browser

Home:

Website:

Attack Dashboard:

Defense Dashboard:

---

🧑‍💻 Usage & Educational Value

Try each : Read the right-side card for a detailed explanation and mitigation.

Attack: Use the Attack Dashboard to launch SQLi, brute-force, XSS, file upload, and command injection attacks (manual or auto).

Defend: Watch the Defense Dashboard detect, log, and block attacks in real time. Block/unblock IPs, see li, and learn how blue teams operate.

Learn: Every page is a mini-lesson in web security, with real code and real consequences.

---

🔍 Details of Each Component

Web App

/login.html: SQL Injection and brute-force login form

/comments.html: XSS- comment section

/upload.html: Un file upload

/cmd.html: Command injection input

Educational cards: Each page explains the , how to exploit it, and how to defend

Attack Dashboard

SQL Injection: Manual and auto attack forms, Python script for automated exploitation

Brute-force: Password list attack, Python script

XSS: Payload injection, Python script

File Upload: Malicious file upload, Python script

Command Injection: Shell metacharacter injection, Python script

Auto-attack: Each auto-attack is rate-limited and requires explicit user action

Defense Dashboard

Li Per Minute: All real requests, not just attacks, graphed for situational awareness

Recent Requests: Last 5 real requests, attacks highlighted, modal for full stream

Detected Attacks: Last 5 unique attacks, deduplicated, attacks highlighted

Blocked IPs: List of blocked IPs, with unblock button

Clear Detections: Button to clear all logs and detections

Filtering: Only real user/attack activity is shown; /api/*, /attack/*, /favicon.ico are filtered out

Detection Logic

SQL Injection: Detected by common SQLi patterns in login requests

XSS: Detected by script tags and event handlers in comments

Brute-force: Detected by repeated failed logins from the same IP

Malicious File Upload: Detected by dangerous file extensions

Command Injection: Detected by shell metacharacters in command input

Deduplication: Both backend and frontend deduplicate attacks by endpoint/type/timestamp

Auto-blocking: Offending IPs are blocked for SQLi, XSS, and brute-force

---

🤝 How to Contribute

This project is a work in progress and a community learning tool.

Feature ideas? Open an issue or pull request!

Found a bug? File an issue with steps to reproduce.

Want to add new , attacks, or defenses? Fork and PR!

Educators: Suggest content, labs, or integrations.

Designers: Help us make it even more beautiful and accessible.

Security pros: Review, test, and help us keep the project realistic and up-to-date.

> We welcome all contributions, feedback, and collaborators!

---

📚 License & Credits

MIT License

Inspired by OWASP Juice Shop, DVWA, and the broader security community

---

💡 Contact & Community

GitHub Issues

Buy Me a Coffee (BMAC)

GitHub: flatmarstheory

---

Let’s build the best open-source cybersecurity battleground together!

项目信息

开发语言：HTML

Star 数：8

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A full-stack, hands-on cybersecurity simulation platform for learning, teaching, and demonstrating both offensive and defensive web security.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	cyber-battleground - A full-stack, hands-on cybersecurity simulation pl
所属分类	防护思路
发布作者	admin
发布时间	2026-10-06 00:12:41
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	80
讨论数量	0
主题状态	正常讨论中

cyber-battleground - A full-stack, hands-on cybersecurity simulation pl

项目说明