I Built a Deliberately Vulnerable PHP/MySQL Lab for Web Security Practice

GMM — Fri, 04 Sep 2026 17:44:38 +0000

I wanted a local environment where I could practice vulnerabilities that feel closer to what security researchers encounter in real applications.

So, I built a deliberately vulnerable PHP/MySQL application for practicing web and API security.

Instead of creating another generic CTF-style challenge, I based the vulnerabilities on issues I have encountered during my own research and on patterns commonly found in real applications.

What Is Inside the Lab?

The application is fully Dockerized and currently contains 10 intentional vulnerabilities, including:

API-level BOLA
JWT forgery
Unrestricted file upload leading to remote code execution
Time-based SQL injection
Several other vulnerabilities left for you to discover

The goal is not only to find the vulnerabilities, but also to understand how they work, how they can be chained, and what security impact they may have.

Field Manuals

I also included field manuals in the repository.

They walk through the intended exploit chains, so you can use them if you get stuck or want to compare your approach with mine. If you prefer discovering everything yourself, try the lab before reading them.

Important Safety Note

This application is deliberately vulnerable. Run it only on your local machine or inside an isolated environment.

Never expose it directly to the internet or use its techniques against systems you do not own or have explicit permission to test.

Try the Lab

You can find the source code and setup instructions here:

Download the lab from GitHub

If you try it, let me know which vulnerabilities you find—or whether you manage to pop a shell!

The Mental State Monitor and ML Pipeline

GMM — Fri, 19 Jun 2026 09:19:32 +0000

I've been building a local AI assistant called Arwanos that runs
100% on your own machine — no cloud, no API keys, no data leaving
your device.

The latest version (v10) adds something I'm genuinely proud of:
a Mental State Monitor — an ML pipeline that reads your personal
journal, cross-references your patterns against 7,557 real therapy
session examples, and generates psychological questions that get
deeper with every session.

A few things it does that I think are interesting:

Builds a psychological profile from your journal history before asking anything
Questions never repeat — a 3-layer NLP check prevents it
Runs entirely offline after a one-time dataset build
Depth scales with session count (early sessions = surface, later = deep)

I wrote a full technical breakdown of the ML pipeline on my site —
phases, dataset sources, anti-duplication logic, and how the insight
pipeline works after each session.

👉 Read the full article here

Source code: