A deliberately vulnerable, CTF-style training range that walks authorized professionals through all ten OWASP LLM Top 10 (2025) categories, from prompt injection to model extraction, in scripted and live-model modes.
| Tool | CyberSunil/LLMVault — intentionally vulnerable OWASP LLM Top 10 (2025) CTF-style training platform, 322 stars, MIT licensed, Python |
| Category | Security training range / vulnerable-by-design lab |
| Primary Use | Practicing prompt injection, RAG abuse, excessive agency, and the other OWASP LLM categories against scripted bots or a real local Ollama model in a self-hosted lab |
| Safe Use | Educational, self-hosted security training only — authorized labs, team upskilling, and defensive research; the README explicitly warns never to expose it to the internet or reuse its code in production |
| Telemetry Note | Purely local: no hosted API calls, progress stored in data/progress.json, Live Mode runs a local Ollama model; as a defensive artifact it is benign unless someone mistakenly deploys its intentionally insecure code or exposes port 5000 |
LLMVault positions itself as the missing piece in AI security education: a WebGoat-style deliberately vulnerable range, but mapped to the OWASP Top 10 for LLM Applications (2025). Where most LLM security material is slide decks and taxonomy talk, this is a scored, tiered practice environment where you actually make a flawed assistant leak its flag using the technique each category describes. The README is unusually disciplined about scope — the repo is MIT licensed, written in Python with Flask, packaged with Docker, and every design decision is annotated with why it exists.
The platform runs in two distinct modes, selected from a dashboard. Play Mode is the scored range: 25 labs across three tiers — ten core labs (one per OWASP category), ten advanced multi-turn challenges, and five expert labs. Critically, the Play Mode assistants are scripted rather than model-driven, which means flags reproduce identically every run. That is a deliberate pedagogical choice: you can repeat a technique until it's muscle memory instead of fighting model nondeterminism while learning the underlying concept.
Live Mode, introduced in v2.0, removes that safety net. The same attack classes are pointed at a real model running locally via Ollama — roughly 2 GB, CPU-only, no GPU required — with a session-secret generated fresh each time. There is no flag to look up and no score; the app checks the model's actual output, and you either talk it into leaking the secret or you don't. The README is candid about the value here: a genuinely unpredictable target means yesterday's payload may simply fail today, which is closer to real assessment conditions than any scripted bot can be.
The core tier coverage is complete and faithful to the 2025 OWASP list. LLM01 is direct instruction override; LLM02 is output-filter bypass via encoding; LLM03 covers typosquatted and unsigned dependencies; LLM04 models a poisoned-data backdoor trigger; LLM05 is unsanitised output flowing into a renderer; LLM06 is an over-permissioned tool with no authorization check; LLM07 is system prompt leakage; LLM08 is RAG retrieval that ignores ACLs; LLM09 is sycophancy and false authority; LLM10 is Denial of Wallet via runaway generation. Each lab pairs the attack with a defense panel that appears after you solve it.
The advanced tier is where the design gets interesting, because every challenge is explicitly conversational. No single message wins — the labs require building state across turns: persona escalation for multi-turn jailbreaking, iterative poisoning of an online-learning filter, stored second-order injection, agent tool-chaining that walks a confused deputy from SSRF toward internal metadata, cross-tenant RAG memory bleed, and query-based model extraction against an oracle. The gating is progressive: clear all ten core labs to unlock advanced, clear all advanced to unlock expert.
The expert tier is the most unusual architectural choice in the repo. It ships encrypted — the challenges and flags are AES-encrypted via Fernet into challenges/expert.enc, with the key derived from an Expert Access Key that lives only in the operator's private vault and never in the repository. Cloning the repo yields ciphertext only; unlocking requires completing all prior tiers plus a key handed out manually by the maintainer after sharing a completion card. The scenarios are also simulated rather than real — the app recognizes the known payload and returns a flag, so no actual RCE, SSRF, or SQL executes inside the tool.
Live Mode's three scenarios are worth examining because each teaches a distinct lesson that generalizes beyond the lab. The Helpdesk Override demonstrates that a secret in a system prompt is context, not storage — authority framing, urgency, and role-play still work on a live model. The Screenshot Triage is indirect injection: the payload never passes through your keyboard but is hidden in an uploaded image that an OCR-capable triage assistant reads as instructions — a sharp illustration that text extracted from a file is user input. The Report Renderer targets downstream output handling, showing the difference between a model saying something bad and a model's output being executed by a template engine.
Operationally, the tool is refreshingly self-contained. No API key is ever needed — Play Mode runs entirely offline, and Live Mode runs on your own machine with nothing calling a hosted API. The basic invocation is pip install -r requirements.txt followed by python app.py, serving on http://127.0.0.1:5000; a docker compose up --build path is also provided, served by gunicorn in a single worker so the in-memory scoreboard stays consistent. Progress persists to data/progress.json, no database required, and deleting that file resets the range.
Several hardening details reveal a maintainer thinking like a defender. Flask debug mode is off by default with an explicit note that the Werkzeug debugger executes arbitrary code; opting in requires LLMVAULT_DEBUG=1 on a trusted local machine. Flag verification moved from plaintext matching to hash comparison in v1.1.0. The Docker guidance tells you to bind to 127.0.0.1 only and never expose the range publicly — reasonable warnings for anything intentionally vulnerable.
For defenders and security leads, the practical value is as a training asset. Every lab opens with a reference panel explaining the OWASP category in plain language, and solving one reveals a fix panel covering what would have stopped the attack — more specific than generic sanitization advice. Red teams can use it to build intuition for multi-turn LLM manipulation before touching authorized client environments; blue teams and appsec reviewers get a concrete mental model of failure modes like RAG ACL bypass and excessive agency that are increasingly showing up in real GenAI deployments. With good-first-issue and ctf among its topics, it is also positioned as a community project, not a one-shot demo.
Caveats are the standard ones for any vulnerable-by-design range: it is a training tool, not an assessment framework, and its intentionally insecure code must never be reused in production. For Ollama setups, the README points at OLLAMA_HOST for remote instances and OPENAI_API_KEY for OpenAI-compatible endpoints, with full detail in docs/LIVE_MODE_SETUP.md. If your team is moving into LLM application security and needs structured, repeatable, offline practice against the current OWASP taxonomy rather than another webinar, LLMVault is one of the more thoughtfully constructed ranges available.
CyberSunil/LLMVault.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.