Skip to content
@SasanLabs

SasanLabs

No power on earth can stop an idea whose time has come.

Welcome to SasanLabs 🌱🔐✨

SasanLabs is an open-source educational platform for cybersecurity. Our goal is to make learning security practical, hands-on, and accessible to everyone.

We provide a modular ecosystem of labs and tools that help users explore real-world vulnerabilities, experiment with security concepts, and practice AI-driven security techniques.

  • ✅ Learn step-by-step how to exploit and secure vulnerabilities.
  • 🤖 Explore AI-based vulnerabilities in LLMForge.
  • 🛡️ Improve everyday security awareness with SAFE.

Our journey: image

We started by creating ZAP add-ons for security testing and quickly realized that building vulnerable apps for testing secuity tools was cumbersome. That inspired VulnerableApp, a lab where adding new vulnerabilities is easy. To support different tech stacks, we created a farm of vulnerable apps with a unified VulnerableApp-facade for simple orchestration. Later, we added LLM-based labs and SAFE, turning SasanLabs into a comprehensive educational platform for cybersecurity learners.

Whether you’re a developer, security enthusiast, or student, SasanLabs makes learning cybersecurity simple, practical, and fun. 🌿💡


Our Projects


Entire architecture stack

Join Us

  • ⭐ Star our repos
  • 🛠 Contribute code or ideas
  • 💡 Learn, explore, and experiment

Security made simple. Learning made fun. Built to last.

Pinned Loading

  1. VulnerableApp VulnerableApp Public

    OWASP VulnerableApp Project: Break it. Scan it. Reproduce it. Benchmark against it. Improve it.

    Java 461 770

  2. LLMForge LLMForge Public

    LLMForge is probably the most modern AI vulnerability lab for OWASP VulnerableApp — real-LLM-backed labs for prompt injection, LLM-orchestrated BOLA, and RAG attacks.

    Python 11 5

  3. VulnerableApp-facade VulnerableApp-facade Public

    VulnerableApp-facade is probably most modern lightweight distributed farm of Vulnerable Applications built for handling wide range of vulnerabilities across tech stacks.

    TypeScript 57 60

  4. VulnerableApp-php VulnerableApp-php Public

    Vulnerable Application written in PHP

    PHP 11 32

  5. owasp-zap-jwt-addon owasp-zap-jwt-addon Public

    OWASP ZAP addon for finding vulnerabilities in JWT Implementations

    Java 42 13

  6. owasp-zap-fileupload-addon owasp-zap-fileupload-addon Public

    OWASP ZAP add-on for finding vulnerabilities in File Upload functionality.

    Java 24 5

Repositories

Showing 10 of 12 repositories
  • VulnerableApp Public

    OWASP VulnerableApp Project: Break it. Scan it. Reproduce it. Benchmark against it. Improve it.

    SasanLabs/VulnerableApp's past year of commit activity
    Java 461 Apache-2.0 770 85 (24 issues need help) 22 Updated Sep 9, 2026
  • VulnerableApp-facade Public

    VulnerableApp-facade is probably most modern lightweight distributed farm of Vulnerable Applications built for handling wide range of vulnerabilities across tech stacks.

    SasanLabs/VulnerableApp-facade's past year of commit activity
    TypeScript 57 Apache-2.0 60 18 (2 issues need help) 1 Updated Sep 6, 2026
  • LLMForge Public

    LLMForge is probably the most modern AI vulnerability lab for OWASP VulnerableApp — real-LLM-backed labs for prompt injection, LLM-orchestrated BOLA, and RAG attacks.

    SasanLabs/LLMForge's past year of commit activity
    Python 11 Apache-2.0 5 4 (2 issues need help) 2 Updated Aug 3, 2026
  • VulnerableApp-php Public

    Vulnerable Application written in PHP

    SasanLabs/VulnerableApp-php's past year of commit activity
    PHP 11 Apache-2.0 32 10 (1 issue needs help) 1 Updated Jul 17, 2026
  • .github Public
    SasanLabs/.github's past year of commit activity
    0 0 0 0 Updated Jun 3, 2026
  • facade-schema Public

    Schema to fulfill the VulnerableApp-facade contract

    SasanLabs/facade-schema's past year of commit activity
    Java 2 Apache-2.0 1 0 0 Updated May 9, 2026
  • SAFE Public

    Security awareness for everyone

    SasanLabs/SAFE's past year of commit activity
    2 Apache-2.0 1 1 0 Updated May 4, 2026
  • owasp-zap-jwt-addon Public

    OWASP ZAP addon for finding vulnerabilities in JWT Implementations

    SasanLabs/owasp-zap-jwt-addon's past year of commit activity
    Java 42 Apache-2.0 13 12 (1 issue needs help) 2 Updated Mar 3, 2025
  • owasp-zap-fileupload-addon Public

    OWASP ZAP add-on for finding vulnerabilities in File Upload functionality.

    SasanLabs/owasp-zap-fileupload-addon's past year of commit activity
    Java 24 Apache-2.0 5 5 (5 issues need help) 0 Updated Aug 1, 2024
  • VulnerableApp-jsp Public

    Vulnerable Application specifically containing vulnerabilities related to jsp.

    SasanLabs/VulnerableApp-jsp's past year of commit activity
    Java 10 Apache-2.0 13 5 (2 issues need help) 0 Updated Feb 4, 2023