LLMVault The Ultimate Hands-On OWASP LLM Top 10 Training Platform ## 🎬 Demo Learn • Exploit • Defend A deliberately-vulnerable, CTF-style training range for the OWASP Top 10 for LLM Applications (2025) — WebGoat / KubeGoat, but for AI. 25 labs across three tiers: ten core one-per-category labs; ten advanced, multi-turn labs (jailbreaking, data poisoning, agent exploitation, model extraction); and five expert labs modelling real-world attack classes. Each tier unlocks the next. Every lab pairs the attack with a defense (in the private solutions guide): learn the fix by practising the break. > ⚠️ Everything here is intentionally insecure. Authorised, self-hosted security education only. Don't expose it to the internet or reuse its code in production. ## 📸 Screenshots | Labs (three tiers) | A lab in action | Completion card | |---|---|---| | | | | --- ## 🧩 Core Tier — OWASP LLM Top 10 | OWASP (2025) | Lab | Technique | |---|---|---| | LLM01 Prompt Injection | The Obedient Assistant | direct instruction override | | LLM02 Sensitive Info Disclosure | Redaction Theater | output-filter bypass via encoding | | LLM03 Supply Chain | Trust the Manifest? | typosquatted / unsigned dependency | | LLM04 Data & Model Poisoning | The Sleeper Phrase | poisoned-data backdoor trigger | | LLM05 Improper Output Handling | Rendered Without Question | unsanitised output → injection | | LLM06 Excessive Agency | Keys to the Kingdom | over-permissioned tool, no authz | | LLM07 System Prompt Leakage | Loose Lips | secret leaked from system prompt | | LLM08 Vector & Embedding | Retrieval Without Borders | RAG retrieval ignores ACLs | | LLM09 Misinformation | The Yes-Man | sycophancy / false authority | | LLM10 Unbounded Consumption | Denial of Wallet | runaway generation + leaky error | ## 🔥 Advanced Tier — Multi-Turn Challenges (unlocks after completing all 10 Core challenges) These are conversational: no single message wins — they require building state across turns (roleplay escalation, iterative poisoning, tool chaining, oracle querying). | OWASP | Lab | Advanced technique | |---|---|---| | LLM01 | Roleplay Unchained | multi-turn jailbreak via persona escalation | | LLM02 | Death by a Thousand Hints | fragment reconstruction from a partial-disclosure oracle | | LLM03 | The Tampered Registry | deployed-vs-canonical hash correlation | | LLM04 | Teach Me Wrong | active data poisoning of an online-learning filter | | LLM05 | The Note Keeper | stored / second-order injection | | LLM06 | Confused Deputy | agent tool-chaining (SSRF to internal metadata) | | LLM07 | Method Actor | multi-technique system-prompt extraction | | LLM08 | Crossed Wires | cross-tenant RAG memory bleed | | LLM09 | The Confident Liar | hallucination → overreliance cascade | | LLM10 | The Oracle | query-based model extraction | ## ⚔️ Expert Tier — Real-World Attack Classes (unlocked after all Advanced challenges are solved) Five expert labs modelli...