VulnHub
Repository of downloadable vulnerable-by-design virtual machines for offline practice.
Technical Architecture & Overview
VulnHub hosts community-built vulnerable VM images that users download and attack in their own lab environments, with difficulty ratings and walkthroughs linked per machine. OffSec (then Offensive Security) acquired the site in July 2020 and keeps the catalog available for free, although the newest listed entry dates from July 2022. Machines cover web, privesc, and network exploitation themes across many difficulty levels.
Targeted Technical Use Cases
Offline lab practice with full machines when internet-hosted platforms are not an option.
Evaluation & Trade-offs
Core Strengths
- +Works entirely inside your own hypervisor.
- +Catalog running since 2012, with community walkthroughs.
- +Free access to every machine.
Trade-Offs & Limitations
- -No hosted labs: machines are downloaded as VM images and run locally.
- -No new machines listed since July 2022, so software stacks are dated.
Defensive Security Application
Safe reproduction of attack paths for hands-on security training.
Frequently Asked Questions
What is VulnHub?→
VulnHub hosts community-built vulnerable VM images that users download and attack in their own lab environments, with difficulty ratings and walkthroughs linked per machine. OffSec (then Offensive Security) acquired the site in July 2020 and keeps the catalog available for free, although the newest listed entry dates from July 2022. Machines cover web, privesc, and network exploitation themes across many difficulty levels.
What is VulnHub used for?→
Offline lab practice with full machines when internet-hosted platforms are not an option.
What are the strengths of VulnHub?→
- +Works entirely inside your own hypervisor.
- +Catalog running since 2012, with community walkthroughs.
- +Free access to every machine.
What are the limitations of VulnHub?→
- +No hosted labs: machines are downloaded as VM images and run locally.
- +No new machines listed since July 2022, so software stacks are dated.
How is VulnHub used defensively?→
Safe reproduction of attack paths for hands-on security training.