Dojo-101 is a GPL-3.0 offline-first knowledge base of 250+ Markdown cheat-sheets and 38 graded professional lab scenarios covering DevSecOps, pentest methodology, forensics and RF, built for trainers, students and authorized auditors.
| Tool | Aif4thah/Dojo-101 — offline-first cybersecurity, DevSecOps and pedagogical lab knowledge base (250+ fiches, 38 MESP scenarios) |
| Category | Reference knowledge base / security training material |
| Primary Use | Offline consultation during authorized audits, exam prep and CTF training; teaching material for cyber instructors via the 38 MESP scenarios |
| Safe Use | The README's own disclaimer restricts the repository to strictly pedagogical, authorized-audit and hardening purposes; content is documentation, not weaponized tooling, and is suited to labs and defensive research |
| Telemetry Note | As a passive Markdown documentation repository, Dojo-101 itself executes nothing and leaves no footprint; defenders should note that the linked sister project VulnerableLightApp is intentionally vulnerable and belongs only in isolated labs |
Dojo-101 is not a scanner, proxy or exploit framework — it is something arguably more durable: a curated, offline-first corpus of more than 250 technical reference sheets and 38 ready-to-grade professional scenarios, maintained by Michael Vacarella (@Aif4thah) and licensed under GPL-3.0. The repository's tagline pitches it at cybersecurity trainers, engineering schools, pentesters and DevSecOps engineers, and the structure backs that claim up. Everything lives in plain Markdown (.md) files organized into seven thematic pillars, each with its own folder-level README.md acting as an index. At roughly 207 stars, it is a community-scale project rather than a hype repository, and its value proposition is portability: clone it once and you have a searchable, air-gappable library.
The seven pillars deserve attention because they map cleanly onto how security work is actually divided. The largest by far is Dojo-101-Pentest with 127 sheets covering audit methodology, reconnaissance, web exploitation classes such as SQLi, XSS, XXE, SSTI and JWT attacks, Active Directory attack surface (Kerberos, BloodHound, Mimikatz), privilege escalation on both Linux and Windows, buffer overflows and pivoting. Alongside it, Dojo-101-DevSec holds 33 sheets on CI/CD integration, SAST/DAST tooling (CodeQL, Nuclei, SonarQube, ZAP), ASVS, STRIDE threat modeling and language-specific security guidance for Python, Rust, C, C#, JS and Flutter. What the README reveals is a deliberate breadth-over-depth-per-file philosophy: each fiche is a dense memory aid, not a tutorial.
The operational-security pillar, Dojo-101-SecOps, contributes 31 sheets on hardening Linux, Windows and Active Directory, Azure cloud, Docker, firewalling, VPNs (WireGuard, OpenVPN), PKI, TLS and SELinux. This is the defensive mirror of the pentest content, and it is worth noting that the same author maintains both sides — a structure that reinforces the educational framing. A defender reading the Kerberos sheet and the corresponding hardening sheet gets both perspectives from one source, which is exactly how mature security training should be sequenced.
Two smaller pillars round out the technical coverage. Dojo-101-Forensic offers 10 sheets on incident response, evidence collection, memory analysis with Volatility, Windows/Linux/Android forensics, reverse engineering with Ghidra and Radare2, and SIEM/log parsing with jq and yq. Dojo-101-RF is the more unusual inclusion: 17 sheets on software-defined radio (HackRF, RTL-SDR, GNU Radio), modulations, SIGINT, TEMPEST, Wi-Fi, Bluetooth, RFID/NFC, TETRA, satellites and drones. Few generalist cheat-sheet collections bother with radiofrequency material, and its presence signals that the author's intended audience includes practitioners working electronic-warfare and wireless assessment engagements — the repo topics explicitly list sdr and electronic-warfare.
The governance pillar, Dojo-101-Governance, is heavily French-flavored: ANSSI homologation, ISO 27001, EBIOS RM risk analysis, the Cyber Resilience Act, NIS2, the PASSI qualification framework, sovereignty considerations and cyber-crisis management. This is a useful signal for readers — the whole corpus is written with a French regulatory and pedagogical context in mind, aligned with the author's warning that users must comply with French penal code articles 323-1 and following. Non-French audiences will still find the technical sheets universally applicable, but the compliance material maps to EU and French frameworks specifically.
The training pillar is where Dojo-101 distinguishes itself from a generic awesome-list. Dojo-101-Apprentissage contains 38 MESP — Mises en Situation Professionnelle, or professional work scenarios — that progress from beginner labs through hardening, auditing, DevSecOps, EBIOS RM, SDR exercises, wargames and CTFs, plus a guide on pedagogical engineering. The README explicitly targets independent trainers and training organizations, claiming the scenario structure follows a REAC/competence framework and can save weeks of course preparation. For an instructor building a curriculum, this is the most operationally valuable part of the repository: assessments you can deploy rather than topics you must sequence yourself.
Getting started is deliberately simple. The README recommends a shallow clone — git clone --depth 1 https://github.com/Aif4thah/Dojo-101 — after which you open the folder in VSCode and use Ctrl+Shift+F for instant keyword search across all sheets (Kerberos, GPO, EBIOS, HackRF are the given examples) and Ctrl+Shift+V to render Markdown with embedded Mermaid diagrams in HTML. The diagram in the root README, a flowchart linking the seven pillars to their sub-topics, is a good example of the visual scaffolding spread through the corpus. The intended environment is genuinely offline: clean rooms, internal audits, exams and travel are the stated use cases.
The second advertised usage mode is more forward-looking: the uniform plain-Markdown formatting makes the corpus directly indexable by coding assistants (Copilot, Cursor) for hardening, scripting and audit support tasks, usable as raw document bricks for custom agent skills or RAG pipelines without preprocessing, and compatible with self-hosted air-gapped models where audit data confidentiality matters. This is a pragmatic design choice — by avoiding proprietary formats and dependencies, the author has made the repository future-proof against whatever local-assistant tooling looks like next year. Teams building sovereign internal knowledge stacks should take note of the pattern even if they never adopt this specific content.
For hands-on practice, the README points to a sister project, VulnerableLightApp, a deliberately vulnerable application for code-audit, web-pentest and remediation training. The key word is deliberately: it exists so learners can practice in full legality against software designed to be broken, not as a template for attacking anything else. Pairing the reference sheets with a sandboxed target is pedagogically sound, and defenders reviewing this ecosystem should understand that VulnerableLightApp belongs in isolated lab networks only — its intentional flaws make it a liability if ever exposed to production traffic.
From a defensive-observation standpoint, Dojo-101 is inert: it is documentation, executes nothing, and leaves no telemetry anywhere. The relevant security consideration is contextual rather than technical — blue teams and SOC analysts who spot this repository in an engineer's downloads have found study material, not tooling. The sheets describing tools like Mimikatz, BloodHound and Nuclei are memory aids about those tools, not the tools themselves, and the repository's own disclaimer restricts everything to educational, authorized-audit and system-securing purposes with liability explicitly disclaimed for illegal use.
Maintenance is transparently a concern the author addresses head-on: the sponsorship section states that keeping 250+ sheets current, verifying commands, documenting new norms (CRA, NIS2, EBIOS RM) and designing realistic scenarios represents hundreds of hours of volunteer work, with tiered GitHub Sponsors options for students, trainers and institutions. There is a CONTRIBUTING.md for corrections and a SECURITY.md policy. Contributions are welcomed, the README badges track last-commit freshness, and the whole package — GPL-3.0, plain Markdown, offline-first, lab-oriented — reads as a genuinely useful piece of community infrastructure for authorized security education rather than a commercial funnel.
For the right audience, the verdict is straightforward. If you are a pentester who wants a searchable aide-mémoire for engagements without internet access, a DevSecOps engineer assembling hardening checklists, an RF enthusiast who rarely finds TEMPEST and TETRA notes in generalist collections, or an instructor who needs 38 evaluable scenarios tomorrow rather than next semester, Dojo-101 earns its disk space. It will not replace hands-on platforms, and the French regulatory material will not map everywhere, but as a free, ad-free, sovereignty-friendly knowledge base that runs anywhere git and a text editor do, it is exactly what it claims to be.
Aif4thah/Dojo-101.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.