bikini/exploitarium

Exploitarium is a collection of proof-of-concept demonstrations for security vulnerabilities found in popular software. The author discovered these flaws (many through automated testing workflows) and published them to attract more people into cybersecurity research. Each folder contains a writeup and code showing how a specific bug works, things like remote code execution in Redis, privilege escalation in Docker, or URL leakage in Firefox. The author explicitly states this is for educational purposes and asks that nobody use the material maliciously. The repo covers a wide range of targets: developer tools like curl and nghttp2, media software like FFmpeg and VLC, remote desktop apps like AnyDesk and RustDesk, web platforms like Discourse and Nextcloud, image processing libraries like ImageMagick and Pillow, and infrastructure components like Docker and OpenVPN. Each entry is a self-contained folder with documentation explaining the vulnerability and a working proof of concept. Some entries were consolidated from standalone repos that previously existed separately. The audience is aspiring security researchers and people curious about how vulnerabilities work. If you're learning about bug hunting or want to understand what a real exploit looks like, these writeups serve as concrete examples. The author notes that some self-described researchers struggle to adapt the proofs to their own environments, so they plan to broaden the examples to be more accessible. What's notable is the author's use of AI in their workflow. They used a large language model to automate their fuzzing, a technique for finding bugs by feeding software unexpected inputs, but emphasize that you don't need the most expensive model to do this effectively. The proof-of-concept code itself was hand-typed, though AI helped with RustDesk work (a language the author was less familiar with) and generated all the README writeups, which they reviewed for accuracy.