OWASP LLM Top 10 Hands-on CTF · EXPLORE→LEARN→PROVE→REFLECT 4-Stage Loop
A CTF-style LLM security lab built on Kolb’s experiential learning cycle — hands-on practice against OWASP LLM Top 10, covering real exploits, flags and defenses for prompt leakage, direct / indirect prompt injection, and SSRF via model output. Each module follows the four-stage pedagogy EXPLORE (blind test) → LEARN (theory) → PROVE (guided exploit) → REFLECT (hardening), runs fully offline via Ollama, and lets security people sharpen AI-security and LLM-pentest skills in a safe environment.
Turning "studying LLM security" from reading docs into experiential training — break it open in an offline sandbox, then patch it yourself.
Read the briefing, launch the intentionally vulnerable chatbot, and blind-test for the flag with zero hints. Real understanding starts the moment you try it yourself.
Study the vulnerability class: concepts, attack techniques, real-world incidents (data leaks, injection-driven exfiltration) and quizzes — figure out why it gets broken.
Follow the progressively hinted lab guide, extract FLAG{...} and submit it for SHA-256 verification — move from "knows" to "can do".
Learn defenses, then face the hardened variant of the same lab with protections applied. Can you still break it? Attack and defense in one loop.
The biggest LLM-security gap is between "read the OWASP doc" and "can actually break it open and patch it in a sandbox".
Security teams can read OWASP LLM Top 10 but rarely reproduce a prompt injection in a controlled environment — understanding stays conceptual.
Production systems cannot be used for practice, public ranges are scarce and mostly theoretical; there is no "intentionally vulnerable, safe-to-attack" offline sandbox.
Learning only attack leaves you unable to tell if hardening actually works; defenses easily stay on paper.
Injection-driven data exfiltration, poisoned-RAG privilege escalation — real-case details are rarely available; reproducible teaching samples are missing.
How shipped and planned modules align to the OWASP Top-10 LLM risks (planned modules marked "planned").
| OWASP Risk | Mapped Modules | |
|---|---|---|
| LLM01 Prompt Injection | Direct Injection (02), Indirect Injection (03), Multi-turn Jailbreak (06·planned), Prompt Obfuscation (10·planned) | Injection |
| LLM02 Insecure Output Handling | SSRF via Output (04), Output-Filter Bypass (09·planned), Multimodal Injection (12·planned) | Output |
| LLM03 Training Data Poisoning | RAG Poisoning (07·planned), Training Data Extraction (14·planned) | Poison |
| LLM04 Model Denial of Service | Model DoS (13·planned) | DoS |
| LLM05 Supply Chain | Supply-Chain / Plugin Attack (15·planned) | Supply |
| LLM06 Sensitive Info Disclosure | Prompt Leakage (01), Training Data Extraction (14·planned), Cross-Session Leak (16·planned) | Leak |
| LLM07 Insecure Plugin Design | Tool / Function Abuse (05·planned), Supply Chain (15·planned) | Plugin |
| LLM08 Excessive Agency | Tool Abuse (05·planned), Agent Hijacking (08·planned) | Agency |
| LLM09 Overreliance | Chained Exploits (17·planned), AI SOC Evasion (18·planned) | Reliance |
| LLM10 Model Theft | Embedding / Similarity Attack (11·planned), Training Data Extraction (14·planned) | Theft |
Every module is a full loop of "vulnerable lab + teaching + guided exploit + defense guide + automation script".
System-prompt extraction. Through over-privileged questions and role-play, fish the hidden system prompt out of the model and understand the information-disclosure boundary. Vuln port 8001 / hardened 8010.
User overrides bot behavior. Use a malicious instruction to override the model’s original setup and bypass role constraints, making the assistant do what the designer disallowed. Port 8002 / hardened 8003.
Contaminated data hijacks the LLM. Plant poisoned content in the retrieval / RAG context and indirectly steer model behavior through "external data". Port 8004 / hardened 8005.
SSRF through LLM output. Weaponize the model’s generation to trigger server-side requests against internal services, closing the "model output → internal-network probing" chain. Port 8006 / hardened 8007.
EXPLORE→LEARN→PROVE→REFLECT — every module completes "attack → learn → verify → defend".
4 foundational modules shipped; roadmap spans 6 tiers and 28+ hands-on modules.
The hard part is not a single bug, but engineering "LLM-security training" into a reproducible, attackable-and-defendable, offline experiential course.
EXPLORE→LEARN→PROVE→REFLECT turns "learning security" into a loop of breaking it open and patching it yourself — double reinforcement of memory and muscle memory.
Bound to 127.0.0.1, flags stored as SHA-256 hashes to prevent spoilers, no real credentials — even aggressive attacks stay in the local sandbox.
The same module ships vulnerable and hardened versions; defense effectiveness is verified by "can you still break it" — no more paper defenses.
llm_backend.py abstracts Ollama / OpenAI / Gemini; the lab is decoupled from the model, switching freely between offline privacy and cloud compute.
Convert technical capability into quantifiable, reusable business value.
Product content has been published based on internal materials. The following areas are planned for further development:
Explore Xianma AI solutions in other domains