vulhub README

The project's README from github.com/vulhub/vulhub. As one markdown file: README.md.

Vulhub

Chat on Discord GitHub Sponsors Vulnerabilities count GitHub language count GitHub contributors GitHub

Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required.

中文版本(Chinese version)

Quick Start

Install Docker (example for Ubuntu 24.04):

# Install the latest version docker
curl -s https://get.docker.com/ | sh

# Run docker service
systemctl start docker

For other operating systems, see the Docker documentation.

Although all Vulhub environments are running based on Docker Compose, you no longer need to install docker-compose separately. Instead, you can use the built-in docker compose command to start Vulhub environments.

Download and set up Vulhub:

git clone --depth 1 https://github.com/vulhub/vulhub

Launch a vulnerable environment:

cd vulhub/langflow/CVE-2025-3248  # Example: enter a vulnerability directory
docker compose up -d

Each environment directory contains a detailed README with reproduction steps and usage instructions.

Clean up after testing:

docker compose down -v

[!NOTE]

  • Use a VPS or VM with at least 1GB RAM for best results
  • The your-ip in documentation refers to your host/VPS IP, not the Docker container IP
  • Ensure Docker has permission to access all files in the current directory to avoid permission errors
  • Some environments may not support ARM architectures, see Troubleshooting for details
  • All environments are for testing and educational purposes only. Do not use in production!

Troubleshooting

Docker image pull fails in mainland China

Docker Hub may be inaccessible from mainland China. Use a registry mirror or run Vulhub on an overseas VPS.

Environments fail to start on Apple Silicon (M-series) Macs

Most Vulhub environments run natively on Docker Desktop for Mac with M-series chips. If an environment fails, try setting the platform explicitly:

export DOCKER_DEFAULT_PLATFORM=linux/amd64
docker compose up -d

Environments fail on Kali Linux

Some environments may fail on Kali Linux due to a low ulimit nofile setting. See the FAQ for the fix.

If you encounter issues that you cannot resolve, feel free to seek help from the community:

Contributing

We welcome contributions! Please read our Contributing Guide to get started.

Thanks to all contributors:

Partners

Our partners and users:

Sponsor Vulhub on GitHub Sponsor, OpenCollective, or Patreon 🙏

More ways to donate.

License

Vulhub is licensed under the MIT License. See LICENSE for details.

vulhub (vulhub/vulhub)

Searching Database…

21.4K ·GitHub
Vulhub
这是什么东西?Vulhub 是一个开源项目,收集了预先构建好、开箱即用的 Docker 漏洞环境:一条命令就能搭起一个可用的实验环境,用于安全研究、学习或演示。
所以它不是扫描工具——那这些环境具体长什么样?每个漏洞就是一个目录,里面有一套 Docker Compose 配置,可以在本地把带漏洞的服务跑起来,另外还附带一份详细的 README 说明文档。
我该怎么把一个环境跑起来?先安装 Docker,下载仓库,然后在对应的环境目录里运行 'docker compose up -d';文档里也写了清理步骤,测试完可以把环境拆掉。另外,Docker 还需要有权限读取该目录下的文件。
我需要先有 Docker 使用经验或者装别的工具吗?不需要有任何 Docker 使用经验,也不用单独安装 docker-compose——内置的 'docker compose' 命令就能把一切启动起来。
我能把这些环境一直挂在我的公网服务器上吗?不行——这些环境是故意做成有漏洞的,只用于测试和教学。README 里说得很明白:不要用于生产环境,测试完记得清理。
跑这些实验环境需要什么样的机器?建议至少准备一台 1GB 内存的 VPS 或虚拟机。大多数环境可以直接在 M 系列芯片的 Mac 上原生运行,但有些不支持 ARM,另外 Kali Linux 需要先修改 ulimit nofile 设置。
在哪里能找到复现某个具体漏洞的步骤?每个环境目录里都有自己详细的 README,包含复现步骤和使用说明,所以操作指南就在搭建环境的旁边。
为什么教程一直建议用海外 VPS?因为在中国大陆可能无法访问 Docker Hub——你要么配置一个镜像加速器,要么就在国外的 VPS 上运行 Vulhub。
复现步骤里的 'your-ip' 是什么意思?它始终指的是你主机或 VPS 的 IP 地址,而不是 Docker 容器的内部 IP。
文档有其他语言的版本吗?有——README 除了英文版,还附带了官方中文版。
What are similar projects?Claude-Red, CVE-2026-41940-PoC, CVE-2026-62911, DVWA, Relapse-Exploit, exploitarium, ARTEX, ARTEX
Which topics is it in?dockerfile, security-research, vulnerability, exploit, pentesting, containers, penetration-testing, hacking, cybersecurity, security-tools, docker-compose, learning
Creator
vulhub
Size
182.7 MB
Stars
21.4K
Updated
CommitOct 17
Age
9y
Commits · 90 Days